chore: sign apple binaries

[alejandroEsc]

What problem does this PR solve?:
Allows having to sign darwin images.

Which issue(s) does this PR fix?:

• https://jira.d2iq.com/browse/D2IQ-88902

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

[github-actions]

File	Coverage
All files	16%	❌
pkg/ansible/runner.go	0%	❌
pkg/app/artifacts.go	0%	❌
pkg/app/build.go	1%	❌
pkg/app/build_azure.go	0%	❌
pkg/app/build_gcp.go	0%	❌
pkg/app/config.go	47%	❌
pkg/app/errors.go	0%	❌
pkg/app/provision.go	0%	❌
pkg/app/root.go	0%	❌
pkg/app/validate.go	0%	❌
pkg/appansible/io.go	0%	❌
pkg/appansible/playbook.go	0%	❌
pkg/azure/azure.go	0%	❌
pkg/logging/logger.go	0%	❌
pkg/packer/manifest.go	0%	❌
pkg/packer/packer.go	0%	❌
pkg/stringutil/rand.go	0%	❌
pkg/version/info.go	8%	❌

Minimum allowed coverage is 75%

Generated by 🐒 cobertura-action against 9d8254c

[faiq]

let's move this whole thing to release-main.yaml

[alejandroEsc]

So this requires inputs to work, we can and maybe should call these on another workflow like that found in the release-main process. At least that was my hope. Here at least this allows us a repeatable mechanism to get this to work.

[faiq]

The inputs can be populated by the release-please task outputs the bump-kib job does this.

Keeping this here while it's draft is fine, but I really want to see it in the other file as another workflow.

[alejandroEsc]

Sure thing. There were some difficulties in the release job process itself that kept me from moving forward to that approach, it has been a while but I tried to communicate my frustration with that approach.

[supershal]

Closing the ticket as per discussion. The notarizing mac binary in github public repo is not secure enough as it may expose apple credentials. Once we finalize the approach, we can revisit this PR

[faiq]

When doing this we need to be sure to clean up

Apple-Actions/import-codesign-certs#8 (comment)