Macos Codesign Workflow

DevOps & Security

macos-codesign-workflow

Macos Codesign Workflow is an Agent Skill for devops & security published in the a5c-ai/babysitter repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Execute macOS code signing with Developer ID and hardened runtime requirements

View on GitHub ↗

QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

Open your project in Codex.
Copy and paste the prompt below.
Review files and risks before approving any action.

Prompt to paste

Inspect the Agent Skill at https://github.com/a5c-ai/babysitter/blob/HEAD/library/specializations/desktop-development/skills/macos-codesign-workflow/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/macos-codesign-workflow, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

macos-codesign-workflow

Execute macOS code signing with Developer ID certificates and hardened runtime. This skill handles the complete code signing process for macOS applications.

Capabilities

Sign app bundles with Developer ID
Configure hardened runtime
Sign nested frameworks and binaries
Configure entitlements
Verify signatures
Set up CI/CD signing
Handle keychain management

Input Schema

{
  "type": "object",
  "properties": {
    "appPath": { "type": "string" },
    "identity": { "type": "string" },
    "entitlements": { "type": "string" },
    "hardenedRuntime": { "type": "boolean", "default": true }
  },
  "required": ["appPath", "identity"]
}

Signing Commands

# Sign app bundle with hardened runtime
codesign --force --options runtime --timestamp \
    --entitlements MyApp.entitlements \
    --sign "Developer ID Application: Company Name (TEAMID)" \
    MyApp.app

# Sign nested components first
find MyApp.app -name "*.dylib" -o -name "*.framework" | \
    xargs -I {} codesign --force --options runtime --timestamp \
    --sign "Developer ID Application: Company Name (TEAMID)" {}

# Verify signature
codesign --verify --deep --strict --verbose=2 MyApp.app
spctl --assess --type execute --verbose MyApp.app

Related Skills

macos-notarization-workflow
macos-entitlements-generator