block/Apple Code Signing
Sign Apple applications via Block codesigning service (Lambda + Buildkite)
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Mar 20, 2026
- License
- Apache 2.0
Pinned Snippet
uses: block/apple-codesign-action@679535d1ab7c5a7c18e6f9afcba3464512cc3dde # v1.1.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| osx-codesign-role | IAM role ARN for OIDC authentication with AWS | yes | — |
| codesign-s3-bucket | S3 bucket for artifact transfer | yes | — |
| unsigned-artifact-path | Local path to the unsigned artifact (.app, .zip containing a .app, or .dmg containing a .app) | yes | — |
| entitlements-plist-path | Path to entitlements.plist to bundle into the signing payload | no | "" |
| artifact-name | Unique identifier for the S3 key (default: $GITHUB_SHA-$GITHUB_RUN_ID) | no | "" |
| branch | Branch override for the signing pipeline (only allowed for approved repos) | no | main |
Outputs
| name | description |
|---|---|
| signed-artifact-path | Local path to the downloaded signed artifact (.app inside a .zip) |
| signed-dmg-path | Local path to the DMG with signed .app swapped in (only set when input was a .dmg) |
| build-number | Build number from the signing service |
| signing-duration | Wall-clock seconds the signing took |