erwin-wee · Oct 2, 2026 · Oct 2, 2026 · Oct 2, 2026
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -50,11 +50,13 @@ jobs:
       - name: Typecheck
         run: npm run typecheck
 
-      # Signing and notarization are driven by these secrets and only happen when
-      # they are set (see docs/RELEASING.md); unset secrets expand to empty
-      # strings, which electron-builder treats as "not provided".
+      # Unset secrets expand to empty strings. macOS signing treats an empty
+      # CSC_LINK as a certificate path, so remove it when signing is unconfigured.
       - name: Build
-        run: npm run ${{ matrix.dist }} -- --publish never
+        shell: bash
+        run: |
+          if [ -z "$CSC_LINK" ]; then unset CSC_LINK; fi
+          npm run ${{ matrix.dist }} -- --publish never
         env:
           CSC_LINK: ${{ secrets.CSC_LINK }}
           CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,7 +2,12 @@
 
 All notable changes to GitGood. Versions follow [semver](https://semver.org); release notes for each version are also on the [Releases page](https://github.com/erwin-wee/gitgood/releases).
 
-## 0.4.0 — 2026-10-02
+## 0.4.1 — 2026-10-02
+
+- Fixed macOS release packaging when signing secrets are not configured: an empty `CSC_LINK` is now removed before running electron-builder.
+- Includes all changes below from 0.4.0, whose release build failed and was not published.
+
+## 0.4.0 — 2026-10-02 (not published)
 
 A security, privacy and robustness pass over the whole app, plus the features that came out of it.
 

diff --git a/docs/RELEASING.md b/docs/RELEASING.md
@@ -52,7 +52,7 @@ Installed copies check the GitHub releases feed (via `electron-updater`) on laun
 
 ## Signing
 
-`release.yml` passes these repository secrets to the build step, and electron-builder signs and notarizes only when they are set; with none set the build is unsigned, exactly as before:
+`release.yml` passes these repository secrets to the build step, and electron-builder signs and notarizes only when they are set; with none set the build is unsigned. The build unsets an empty `CSC_LINK` because electron-builder on macOS treats it as a certificate path rather than an absent secret:
 
 | Secret | Used for |
 | --- | --- |

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "gitgood",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "A GitHub Desktop-style Git client for Windows, macOS and Linux that drives the git and gh CLIs",
   "main": "./out/main/index.js",
   "author": "Erwin Wee",