fix(vm): codesign macOS driver-vm with hypervisor entitlement in CI (#3507)

The release tarball ships an unsigned binary that fails at runtime
when Hypervisor.framework rejects the caller. Sign with the existing
entitlements plist during the build, before artifact upload.

Closes #3506

Signed-off-by: Florent Benoit <fbenoit@redhat.com>

Author: benoitf

.github/actions/build-rust-binary/action.yml

@@ -29,6 +29,10 @@ inputs:
     description: Additional flags passed to cargo build
     required: false
     default: ""
+  entitlements-file:
+    description: Path to an entitlements plist for macOS ad-hoc codesigning (skipped when empty or not on macOS)
+    required: false
+    default: ""
 runs:
   using: composite
   steps:
@@ -66,6 +70,15 @@ runs:
         # Confirm Syft can decode the embedded cargo-auditable metadata.
         SYFT_CHECK_FOR_APP_UPDATE=false syft "file:${binary}" -o cyclonedx-json | grep 'pkg:cargo/' > /dev/null
 
+    - name: Codesign with entitlements
+      if: inputs.entitlements-file != '' && runner.os == 'macOS'
+      shell: bash
+      env:
+        INPUTS_ENTITLEMENTS: ${{ inputs.entitlements-file }}
+        INPUTS_TRIPLE: ${{ inputs.triple }}
+        INPUTS_BINARY: ${{ inputs.binary }}
+      run: /usr/bin/codesign --entitlements "${INPUTS_ENTITLEMENTS}" --force -s - "target/${INPUTS_TRIPLE}/release/${INPUTS_BINARY}"
+
     - name: Upload ${{ inputs.binary }}
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:

.github/workflows/build-vm-driver.yml

@@ -39,6 +39,7 @@ jobs:
           - arch: aarch64
             triple: aarch64-apple-darwin
             runner: macos-15-xlarge
+            entitlements-file: crates/openshell-driver-vm/entitlements.plist
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     defaults:
@@ -109,3 +110,4 @@ jobs:
           triple: ${{ matrix.triple }}
           cargo-version: ${{ inputs['cargo-version'] }}
           supervisor-image-tag: ${{ inputs['supervisor-image-tag'] }}
+          entitlements-file: ${{ matrix.entitlements-file }}