Make macOS signing/DMG steps conditional on APPLE_CERT_P12 secret

Gate all signing, notarization, and DMG creation steps behind
secrets.APPLE_CERT_P12 so forks without Apple signing credentials
can still run the release workflow successfully.

Author: eddoww

.github/workflows/release.yml

@@ -376,6 +376,8 @@ jobs:
     name: Build MacOS Release
     runs-on: macos-latest
     timeout-minutes: 30
+    env:
+      CAN_SIGN: ${{ env.CAN_SIGN == 'true' }}
 
     steps:
       - name: Checkout code
@@ -423,58 +425,54 @@ jobs:
           strip bin/moac
           strip -x bin/libastonia_net.dylib
 
-      # Build unsigned .app bundle
+      # ---- macOS signing + DMG (skipped when Apple secrets are not configured) ----
       - name: Build .app bundle
+        if: env.CAN_SIGN == 'true'
         run: make macos-appbundle
 
-      # Materialize the signing certificate from a base64-encoded secret
       - name: Install signing certificate
+        if: env.CAN_SIGN == 'true'
         run: |
           mkdir -p certs
           echo "${{ secrets.APPLE_CERT_P12 }}" | base64 --decode > certs/dist.p12
 
-      # Materialize the App Store Connect API key file in ./private_keys
-      # File name must match the api_key (KEY_ID) used later.
       - name: Install App Store Connect API key
+        if: env.CAN_SIGN == 'true'
         run: |
           mkdir -p private_keys
           echo '${{ secrets.APP_STORE_CONNECT_KEY }}' > "private_keys/AuthKey_${{ secrets.APP_STORE_CONNECT_KEY_ID }}.p8"
 
       - name: Install App Store Connect API key JSON
+        if: env.CAN_SIGN == 'true'
         run: |
           echo '${{ secrets.APP_STORE_CONNECT_KEY_JSON }}' > private_keys/appstore_key.json
 
-      - name: Rename app with to tmp name
-        run: |
-          mv distrib/Astonia.app distrib/Astonia-unsigned.app
+      - name: Rename app to tmp name
+        if: env.CAN_SIGN == 'true'
+        run: mv distrib/Astonia.app distrib/Astonia-unsigned.app
 
-      # 1) Sign app bundle
       - name: Sign Astonia.app
+        if: env.CAN_SIGN == 'true'
         uses: indygreg/apple-code-sign-action@v1
         with:
           input_path: distrib/Astonia-unsigned.app
           output_path: distrib/Astonia.app
-
-          # Code signing certificate
           p12_file: certs/dist.p12
           p12_password: ${{ secrets.APPLE_CERT_P12_PASSWORD }}
-
           notarize: false
           staple: false
-
           rcodesign_version: 0.29.0
-
-          # Extra arguments passed directly to `rcodesign sign`
           sign_args: |
             --binary-identifier
             com.prismaphonic.astonia
             --for-notarization
 
       - name: Remove unsigned app bundle
+        if: env.CAN_SIGN == 'true'
         run: rm -rf distrib/Astonia-unsigned.app
 
-      # 2) Create an unsigned DMG wrapping the notarized .app
-      - name: Create unsigned DMG from notarized app
+      - name: Create unsigned DMG from signed app
+        if: env.CAN_SIGN == 'true'
         run: |
           cd distrib
           hdiutil create \
@@ -486,33 +484,29 @@ jobs:
           cd ..
           ls -lh distrib/Astonia-macOS-unsigned.dmg
 
-      # 3) Sign + notarize + staple the DMG
       - name: Sign, notarize, and staple DMG
+        if: env.CAN_SIGN == 'true'
         uses: indygreg/apple-code-sign-action@v1
         with:
           input_path: distrib/Astonia-macOS-unsigned.dmg
           output_path: distrib/Astonia-macOS.dmg
-
-          # Code signing certificate
           p12_file: certs/dist.p12
           p12_password: ${{ secrets.APPLE_CERT_P12_PASSWORD }}
-
           rcodesign_version: 0.29.0
-
           sign_args: |
             --for-notarization
-
-          # Notarization
           notarize: true
           staple: true
           app_store_connect_api_key_json_file: private_keys/appstore_key.json
           app_store_connect_api_issuer: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
           app_store_connect_api_key: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
 
       - name: Remove unsigned DMG
+        if: env.CAN_SIGN == 'true'
         run: rm -f distrib/Astonia-macOS-unsigned.dmg
 
       - name: Upload signed DMG
+        if: env.CAN_SIGN == 'true'
         uses: actions/upload-artifact@v4
         with:
           name: macos-dmg
@@ -569,6 +563,7 @@ jobs:
 
       - name: Download macOS DMG
         uses: actions/download-artifact@v4
+        continue-on-error: true
         with:
           name: macos-dmg
           path: .
@@ -595,7 +590,7 @@ jobs:
           sha256sum linux_client.tar.gz > checksums.txt
           sha256sum windows_client.zip >> checksums.txt
           sha256sum astonia-client.AppImage >> checksums.txt
-          sha256sum Astonia-macOS.dmg >> checksums.txt
+          [ -f Astonia-macOS.dmg ] && sha256sum Astonia-macOS.dmg >> checksums.txt || true
           sha256sum mod-sdk.zip >> checksums.txt
 
       - name: Create Release