This is a macOS access-control prompt, not a signing failure. The private key lives in a keychain, and the keychain will not hand it to a program that has not been granted access. The first time codesign asks, macOS checks with you.
Locally that is a one-click annoyance. On a CI runner it is a build hang, because there is no desktop session and nobody to click anything. The job either sits until it times out, or fails with a related message: "User interaction is not allowed".
On your own Mac
Click Always Allow rather than Allow. Allow grants access once and you will see the prompt again on the next build. Always Allow adds codesign to the key's access-control list permanently.
On CI, which is why you are actually here
A fresh macOS runner imports your .p12 into a keychain, and that imported key has no access-control entries at all. Importing is not enough. You have to grant access explicitly in the same job, before the first codesign call.
KEYCHAIN=build.keychain KEYCHAIN_PASSWORD=$(uuidgen) # Create a dedicated keychain rather than polluting the login one security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN" security set-keychain-settings -lut 21600 "$KEYCHAIN" security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN" # Import the signing identity security import certificate.p12 \ -k "$KEYCHAIN" \ -P "$P12_PASSWORD" \ -T /usr/bin/codesign \ -T /usr/bin/security # The line that actually stops the prompt security set-key-partition-list \ -S apple-tool:,apple:,codesign: \ -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN" # Make it visible to xcodebuild security list-keychains -d user -s "$KEYCHAIN" login.keychain
Why the prompt returns after a certificate rotation
Access control is attached to the specific key, not to the certificate or your account. Rotate the certificate, generate a new key, and the new key starts with an empty access list. Any pipeline that imports signing material has to run the partition-list step every time, which is why it belongs in the build script rather than in a one-off setup you did months ago. See Apple code signing in CI/CD for the full runner setup.
Checking it worked
# Should list your identity without prompting security find-identity -v -p codesigning "$KEYCHAIN" # Should complete silently codesign --force --sign "Apple Development: you@example.com" /path/to/Some.app
If the second command still prompts or reports "User interaction is not allowed", the keychain is locked. Re-run security unlock-keychain, and check that set-keychain-settings did not apply a lock timeout shorter than your build.