fix: sign macos bins

Author: dylanhitt

.github/workflows/publish.yml

@@ -8,6 +8,12 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    env:
+      QUILL_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
+      QUILL_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
+      QUILL_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
+      QUILL_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
+      QUILL_NOTARY_ISSUER: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
     steps:
       - uses: actions/checkout@v6
 
@@ -16,6 +22,10 @@ jobs:
         with:
           go-version-file: "./go.mod"
 
+      - name: Install quill
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/anchore/quill/main/install.sh | sh -s -- -b /usr/local/bin
+
       - name: GoReleaser
         uses: goreleaser/goreleaser-action@v6
         with:

.goreleaser.yaml

@@ -38,6 +38,17 @@ nfpms:
       - deb
       - rpm
 
+signs:
+  - cmd: quill
+    args:
+      - sign-and-notarize
+      - "${artifact}"
+      - --dry-run={{ .IsSnapshot }}
+      - --ad-hoc={{ .IsSnapshot }}
+      - -vv
+    artifacts: binary
+    output: true
+
 changelog:
   sort: asc