fix(desktop): manage signing keychain explicitly

[waleedlatif1]

Summary

• import the Developer ID certificate into an explicit temporary macOS keychain
• keep the certificate password separate from the generated keychain password, avoiding the electron-builder 26.15.3 set-key-partition-list regression
• pass only CSC_KEYCHAIN to electron-builder, validate the signing identity before packaging, and always remove temporary signing credentials

Type of Change

• Bug fix

Testing

• signed, non-publishing Desktop Release run: certificate import, universal packaging, Developer ID signing, notarization, credential cleanup, artifact validation, and packaged smoke tests passed
• exercised certificate import and set-key-partition-list against a disposable .p12 and temporary keychain on macOS
• actionlint with shellcheck and YAML parsing
• 1,455 desktop tests
• monorepo type-check, lint, 45 audits, desktop bridge/IPC checks, block registry validation, and native-binary checksum verification

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 2, 2026 8:29pm UTC

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[greptile-apps]

Greptile Summary

The PR moves macOS Developer ID credentials into an explicitly managed temporary keychain to avoid electron-builder’s keychain-password regression.

• Imports the certificate using separate certificate and generated keychain passwords.
• Configures noninteractive signing access and validates the Developer ID identity before packaging.
• Supplies only the temporary keychain to electron-builder and removes signing credentials afterward.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness or security issues identified.

The packaging step receives only the explicitly prepared keychain, its access configuration matches the expected electron-builder signing flow, and cleanup does not interfere with subsequent artifact verification.

Important Files Changed

Filename	Overview
.github/workflows/desktop-release.yml	Explicitly manages the temporary signing keychain, limits credential scope between workflow steps, and performs unconditional credential cleanup without introducing an actionable failure.

_{Reviews (1): Last reviewed commit: "fix(desktop): manage signing keychain ex..." | Re-trigger Greptile}