From 0df48f64e005624e2981b4bb897f7b1509694af8 Mon Sep 17 00:00:00 2001
From: Georg Friedrich <georg@entire.io>
Date: Tue, 6 Jan 2026 15:27:04 +1100
Subject: [PATCH 1/2] switch to goreleaser pro

---
 .github/workflows/release.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3a72e1d0b1..323cdeefb9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,9 @@ jobs:
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v6
         with:
+          distribution: goreleaser-pro
           version: latest
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}

From 9f0a4bb1ed0680ae657a2f48b50d26f60b3b23ee Mon Sep 17 00:00:00 2001
From: Georg Friedrich <georg@entire.io>
Date: Tue, 6 Jan 2026 15:57:39 +1100
Subject: [PATCH 2/2] add macOS signing and notarization

---
 .github/workflows/release.yml |  5 +++++
 .goreleaser.yaml              | 13 +++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 323cdeefb9..c82d77fa55 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,3 +30,8 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+          MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
+          MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
+          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
+          MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
+          MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 9f3604ed56..1b50cee05d 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -16,6 +16,19 @@ builds:
       - -X entire.io/cli/cmd/entire/cli.Version={{.Version}}
       - -X entire.io/cli/cmd/entire/cli.Commit={{.ShortCommit}}
 
+notarize:
+  macos:
+    - enabled: '{{ isEnvSet "MACOS_SIGN_P12" }}'
+      sign:
+        certificate: "{{.Env.MACOS_SIGN_P12}}"
+        password: "{{.Env.MACOS_SIGN_PASSWORD}}"
+      notarize:
+        issuer_id: "{{.Env.MACOS_NOTARY_ISSUER_ID}}"
+        key_id: "{{.Env.MACOS_NOTARY_KEY_ID}}"
+        key: "{{.Env.MACOS_NOTARY_KEY}}"
+        wait: true
+        timeout: 20m
+
 archives:
   - formats:
       - tar.gz