Distillation

Date: July 21, 2026

• 🟡 (12:58) User provided full timestamped log from green CI run 29828172734 (Build Electron App (macOS) / "Build and Sign Electron App" step) for pnpm build:mac on package @spotlightjs/spotlight@4.11.7.
• 🟡 (12:58) Log confirms electron-builder version=24.13.3 was used in that green run (not app-builder-lib@26.15.7 previously inspected in node_modules) — assistant noted this run predates the version bump merged in PR #1335, and was itself PR #1334.
• 🟡 (12:58) Log env vars for the step: APPLE_API_ISSUER=69a6de81-4417-47e3-e053-5b8c7c11a4d1, APPLE_API_KEY_ID=3RC4SAF8T6, APPLE_API_KEY=/tmp/apple_key.pem, plus CSC_LINK/CSC_KEY_PASSWORD/GH_TOKEN masked.
• 🟡 (12:58) Log sequence for x64: packaging (12:00:17.89) → signing identity=CA886EB0F2EF765B26CDA592CD42DA4E9C92C916 (12:00:24.87) → notarization successful (12:03:09.13) → building zip/DMG (12:04:07). Gap between signing and notarization success ≈2.5 minutes.
• 🟡 (12:58) Log sequence for arm64: packaging (12:04:07.42) → signing same identity (12:04:15.27) → block map builds (12:04:42, 12:05:04) → notarization successful (12:06:53.03) → building arm64 zip (12:07:53.93).
• 🟡 (12:58) Assistant's refined analysis: "notarization successful" appears exactly once per arch (2 total) and immediately follows "signing" in the log — this line is emitted by electron-builder's internal notarizeIfProvided path, not by the afterSign script. Concluded only one notarization actually occurred per arch in this run.
• 🟡 (12:58) Assistant reasoning: since only one notarize event is logged per arch, the current config's afterSign script (scripts/notarize.cjs) did not produce a visibly distinct second notarization in this run — either it ran and was idempotent/silent, or its output wasn't logged distinctly. Assistant states removing the afterSign script should be safe since the internal env-var-triggered path alone is confirmed sufficient.
• 🟡 (12:58) Assistant flagged caution: this touches the signing/notarization path that was "just fixed" and can only be fully verified post-merge on main; began reconsidering whether the cleanup PR is worth doing right now given it's a non-urgent change with real risk in a sensitive area.