Release has been broken since 2026-08-28: codesign fails, and nothing has shipped since 08-19

[evandhoffman]

The Release workflow last ran on 2026-08-28 at 751994d and failed. It has not
run since, so the last shipped release is from 2026-08-19 (ced2296). Nine days of
commits have not been packaged, and nothing said so.

The failure

Package / Build and zip monitor.app
error: could not sign .build/monitor.app as Developer ID Application: EVAN DAVID HOFFMAN (94S5PZTVPY)
##[error]Process completed with exit code 1.

CI passed on the same commit. Only Release broke, which is why this went quiet: the
green check on the commit is real, and it is not the check that matters for shipping.

A lead on the cause

The same signing identity works on the same runner today. evanwtf/fancontrol signed
and notarized with it on 2026-09-04:

Signing as Developer ID Application: EVAN DAVID HOFFMAN (94S5PZTVPY)…
  .build/arm64-apple-macosx/release/fancontrol: valid on disk
  .build/arm64-apple-macosx/release/fancontrol: satisfies its Designated Requirement

So the certificate is present and usable on MacMiniM4_01. That points away from an
expired or missing identity and toward something local to this workflow — keychain
unlocking, the search order, or signing an .app bundle rather than a bare binary. Worth
diffing this repo's signing step against fancontrol's Scripts/build.sh, which is known
to work on that machine right now.

Also in that log, and unrelated

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to
run on Node.js 24: actions/checkout@v4

Bump actions/checkout to v5 while the file is open. It is not the failure.

Suggested order

1. Re-run the failed job to confirm it still fails, rather than fixing from a nine-day-old log.
2. Compare the signing step with evanwtf/fancontrol's, which works on the same runner today.
3. Cut a release once it is green, so the gap since 2026-08-19 closes.

Found in a GitHub inbox sweep, 2026-09-04. The inbox holds 128 unread ci_activity
notifications and this failure was inside them — see evanwtf/local-llm#129 for the
detector problem that let it sit.