fix: gracefully handle invalid Apple certificate in release builds

When APPLE_CERTIFICATE secret contains invalid data, the security
import fails and breaks the entire build. Now validates the decoded
file and falls back to ad-hoc signing if import fails, instead of
aborting the release.

Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Author: its-mash

.github/workflows/release.yml

@@ -132,10 +132,20 @@ jobs:
             exit 0
           fi
           echo "$APPLE_CERTIFICATE" | base64 --decode > certificate.p12
+          # Validate the decoded file is a real PKCS#12 before attempting import
+          if [ ! -s certificate.p12 ]; then
+            echo "Certificate decode produced empty file — skipping import"
+            rm -f certificate.p12
+            exit 0
+          fi
           security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
           security default-keychain -s build.keychain
           security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
-          security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
+          if ! security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign; then
+            echo "⚠ Certificate import failed — falling back to ad-hoc signing"
+            rm -f certificate.p12
+            exit 0
+          fi
           security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
           rm certificate.p12