From b26a07ef9de8b655a0645e30845fc22d2ed7608b Mon Sep 17 00:00:00 2001
From: Eric Burke <eburke@openai.com>
Date: Wed, 8 Apr 2026 16:47:00 -0700
Subject: [PATCH] Fix for env var

---
 .github/actions/macos-code-sign/action.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/actions/macos-code-sign/action.yml b/.github/actions/macos-code-sign/action.yml
index 9c14931a02..a5b6c38450 100644
--- a/.github/actions/macos-code-sign/action.yml
+++ b/.github/actions/macos-code-sign/action.yml
@@ -44,6 +44,11 @@ runs:
           exit 1
         fi
 
+        if [[ "${APPLE_CERTIFICATE_PASSWORD+__codex_password_is_set__}" != "__codex_password_is_set__" ]]; then
+          echo "APPLE_CERTIFICATE_PASSWORD must be set for macOS signing"
+          exit 1
+        fi
+
         cert_path="${RUNNER_TEMP}/apple_signing_certificate.p12"
         echo "$APPLE_CERTIFICATE" | base64 -d > "$cert_path"