use a script and import cert at once

.ci/sign-macos.sh

+#!/bin/bash
+set -x
+set -o errexit
+
+echo "$MACOS_CERTIFICATE" | base64 --decode --output cert.p12
+
+security create-keychain -p "$MACOS_KEYCHAIN_PASSWORD" "$MACOS_KEYCHAIN_NAME" || true
+security default-keychain -s "$MACOS_KEYCHAIN_NAME"
+security unlock-keychain -p "$MACOS_KEYCHAIN_PASSWORD" "$MACOS_KEYCHAIN_NAME"
+security import cert.p12 -P "$MACOS_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
+security set-key-partition-list -S apple-tool:,apple: -s -k "$MACOS_KEYCHAIN_PASSWORD" "$MACOS_KEYCHAIN_NAME";
+codesign --deep --sign "$(security find-identity -v -p codesigning $MACOS_KEYCHAIN_NAME | head -1 | grep -o '".*"' | tr -d '"')" ygopro.app
+security lock-keychain "$MACOS_KEYCHAIN_NAME"

.gitlab-ci.yml

@@ -196,8 +196,7 @@ exec_macos_sign:
     - macos
   dependencies:
     - exec_macos
-  script:
-    - codesign --deep --sign "$(security find-identity -v -p codesigning $MACOS_KEYCHAIN_NAME | head -1 | grep -o '".*"' | tr -d '"')" ygopro.app
+  script: ./.ci/sign-macos.sh
   artifacts:
     paths:
       - ygopro.app