[markcallen]

Follow-up to #384.

Problem

xcrun notarytool submit --wait exits 0 as long as the submission completed — including when Apple comes back Invalid. The hook added in #384 checked only the exit code, so a rejected binary would have been archived and uploaded as though it had passed. Moving notarization ahead of the first upload only helps if notarization can actually fail the build.

Change

scripts/sign-and-notarize-darwin.sh — submit with --output-format json, read status and id with plutil (always present on macOS, so no new dependency), and require Accepted. On failure, print the raw response and fetch notarytool log for the submission so the rejection reason lands in the workflow output.

scripts/smoke-sign-notarize-hook.sh (new) — covers the hook's failure paths with codesign, ditto, and xcrun stubbed on PATH, so it runs with no signing identity, no credentials, and no network:

Case	Expected
Accepted	exit 0
Invalid, notarytool exits 0	exit 1 ← the regression
Rejected, notarytool exits 1	exit 1
missing APPLE_API_KEY_ISSUER_ID	exit 1
missing App Store Connect key file	exit 1
non-darwin build	exit 0, no-op

.github/workflows/examples-smoke.yml — runs it as a macos-latest job.

Validation

• Ran the smoke test against the previous exit-code-only logic: it fails on exactly the Invalid case (expected exit 1, got 0). Restored the fix: all six cases pass.
• shellcheck clean on both scripts; yamllint clean on the workflow.
• pnpm test — 385 passed.

Note

I drafted a matching line for the shared publishing rule and backed it out: it pushed the emitted publishing.md to 5118 bytes against the 5120-byte budget, and a 2-byte margin isn't worth it for a tool-specific caveat. The rule already carries the ordering requirement; the status-assertion detail lives in the script comment and is now pinned by the smoke test. Worth knowing that rule is at 5076/5120 — the next edit to it will likely need a trim elsewhere.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

Copilot review overview

🟢 Approval recommended

The release guard is correct and tested; the remaining environment-isolation issue is non-blocking.

Review effort: Balanced
Findings: 1

Open (1)

• Clear inherited issuer ID before testing missing-variable failure · New

What changed in this PR

Ensures Apple notarization rejection aborts releases before artifacts are uploaded.

Changes:

• Validates notarization JSON status and reports rejection logs.
• Adds macOS smoke coverage for success and failure paths.
• Runs the smoke test in CI.

File	Description
scripts/​sign-and-notarize-darwin.sh	Enforces Accepted notarization status.
scripts/​smoke-sign-notarize-hook.sh	Adds stubbed hook smoke tests.
.github/​workflows/​examples-smoke.yml	Adds the macOS smoke job.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.