macOS runner: codesign "User interaction is not allowed" in CI

By Daniel Zoghalchali·Latchkey

The signing key is protected by an access control that wants to show an "allow access" dialog. CI runs headless, so the prompt cannot appear and codesign fails with "User interaction is not allowed".

What this error means

A codesign step fails with "User interaction is not allowed." or "errSecInteractionNotAllowed", typically the first time the imported key is used in the job.

MyApp.app: User interaction is not allowed.

Common causes

The key has no partition list for tools

After importing, the key restricts access to specific apps. Without a partition list entry for the codesign tool, macOS would prompt, which CI cannot answer.

The keychain is locked and prompts to unlock

A locked keychain triggers an unlock dialog the headless session cannot present.

How to fix it

Set the key partition list

1. Import the .p12 into the CI keychain.
2. Run security set-key-partition-list so apple tools may use the key without prompting.
3. Unlock the keychain before signing.

security import cert.p12 -k build.keychain -P "$P12_PW" -T /usr/bin/codesign
security set-key-partition-list -S apple-tool:,apple: -s -k "$PW" build.keychain

Keep the keychain unlocked for the job

Unlock and raise the lock timeout so no unlock dialog is needed mid-build.

security unlock-keychain -p "$PW" build.keychain
security set-keychain-settings -lut 21600 build.keychain

How to prevent it

• Always set the key partition list after importing a signing identity.
• Pass -T /usr/bin/codesign on import so the tool is allowed.
• Unlock the keychain with a long timeout before signing steps.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions