完善桌面端发布稳定化门禁

frontend/scripts/verify-release-build-env.mjs

@@ -47,6 +47,9 @@ if (isTagBuild) {
 
 if (env.REQUIRE_DESKTOP_SIGNING === "true") {
   assert(process.platform === "darwin", "Signed macOS desktop release builds must run on macOS.");
+  if (isCi) {
+    assert(isTagBuild, "Signed desktop release candidate builds in CI must run from a release tag.");
+  }
   requireEnv("TAURI_SIGNING_PRIVATE_KEY");
   requireEnv("TAURI_SIGNING_PRIVATE_KEY_PASSWORD");
   requireEnv("APPLE_ID");
@@ -56,6 +59,9 @@ if (env.REQUIRE_DESKTOP_SIGNING === "true") {
     Boolean(env.APPLE_CERTIFICATE || env.APPLE_SIGNING_IDENTITY),
     "APPLE_CERTIFICATE or APPLE_SIGNING_IDENTITY must be configured for macOS signing.",
   );
+  if (env.APPLE_CERTIFICATE) {
+    requireEnv("APPLE_CERTIFICATE_PASSWORD");
+  }
 }
 
 if (failures.length > 0) {