[devin-ai-integration]

Summary

This documents optional macOS code signing for CLIs built with Fern's CLI generator. Signing turns on when the CLI repository has three Actions secrets (CODESIGN_CERTIFICATE, CODESIGN_CERTIFICATE_PASSWORD, CODESIGN_IDENTITY). It also documents the new macOS Keychain prompt behavior. For customers, the change means end users of their CLI stop seeing a Keychain security prompt after every rebuild or upgrade: one Always Allow now lasts, and signing with a stable Developer ID identity keeps that approval tied to the same signer across releases.

Implements docs for: fix(cli-generator): stop repeated macOS keychain prompts and name keychain denials (fern-api/fern#18622)

Pages changed

• fern/products/cli-generator/publishing.mdx: new Sign macOS binaries subsection under Publish your CLI, placed after the attestations paragraph. It has a table of the three secrets and says all three are required. Without them, the workflow logs that the binaries stay unsigned and builds exactly as before. It notes the minimum version (CLI generator 0.58.2) and that signing doesn't include notarization.
• fern/products/cli-generator/authentication.mdx: one paragraph in Storage and inheritance covering what changes on macOS:
  • The Keychain dialog names security, not the CLI.
  • Always Allow persists across rebuilds and upgrades.
  • A credential saved by an older build prompts once after upgrading.
  • A denied dialog or locked Keychain now produces a "couldn't read from the macOS Keychain" error.
  • The paragraph links to the new signing section.

How the secret formats were checked

The formats come from cargo-dist's cargo-dist/src/sign/macos.rs. CODESIGN_CERTIFICATE is base64-decoded and written to cert.p12, and CODESIGN_IDENTITY is passed to codesign --sign. The cargo-dist book page for macOS signing now returns 404.

Things for the reviewer to check

• The pages don't claim Gatekeeper trust. cargo-dist signs but doesn't notarize (its source marks notarization as future work), so quarantined downloads may still be blocked by Gatekeeper.
• Confirm that 0.58.2 is the right minimum version. These changelog entries sit under 0.58.2 in generators/cli/versions.yml.

fern check --warnings reports 0 errors, and pre-commit/vale passes (its warnings are on lines this PR didn't touch).

Link to Devin session: https://app.devin.ai/sessions/699c1ced3cd24c7eab5f62733a849438
Open in Devin Desktop: https://app.devin.ai/desktop/session/699c1ced3cd24c7eab5f62733a849438?variant=devin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

🌿 Preview your docs: https://fern-preview-devin-1793552898-cli-macos-signing.docs.buildwithfern.com/learn

Here are the markdown pages you've updated:

• learn/cli-generator/get-started/authentication
• learn/cli-generator/get-started/publishing