cmake-rn: make CODE_SIGNING_ALLOWED configurable for Apple builds

Add a --code-signing-allowed flag to the Apple platform of cmake-rn.
CODE_SIGNING_ALLOWED=NO remains the default (needed for the
free-standing dynamic libraries we produce), but a consumer who needs
signed binaries in the XCFramework - enterprise distribution, or a
target whose downstream tooling verifies signatures - can now opt in.

Addresses the Apple half of #418.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DaK9eAAF5G8wj6UT8VekAm

Author: claude

.changeset/silly-cobras-invite.md

@@ -0,0 +1,5 @@
+---
+"cmake-rn": minor
+---
+
+Add a `--code-signing-allowed` flag to `cmake-rn`. `CODE_SIGNING_ALLOWED=NO` remains the default (needed for the free-standing dynamic libraries we produce), but a consumer who needs signed binaries in the XCFramework can now pass `--code-signing-allowed` to opt in.

packages/cmake-rn/src/platforms/apple.ts

@@ -161,9 +161,15 @@ const appleBundleIdentifierOption = new Option(
   "Unique CFBundleIdentifier used for Apple framework artifacts",
 ).default(undefined, "com.callstackincubator.node-api.{libraryName}");
 
+const codeSigningAllowedOption = new Option(
+  "--code-signing-allowed",
+  "Allow code signing when building free dynamic libraries (passed as CODE_SIGNING_ALLOWED to xcodebuild)",
+).default(false);
+
 type AppleOpts = {
   xcframeworkExtension: boolean;
   appleBundleIdentifier?: string;
+  codeSigningAllowed: boolean;
 };
 
 function getBuildPath(baseBuildPath: string, triplet: Triplet) {
@@ -259,7 +265,8 @@ export const platform: Platform<Triplet[], AppleOpts> = {
   amendCommand(command) {
     return command
       .addOption(xcframeworkExtensionOption)
-      .addOption(appleBundleIdentifierOption);
+      .addOption(appleBundleIdentifierOption)
+      .addOption(codeSigningAllowedOption);
   },
   assertValidTriplets(triplets) {
     for (const suffix of SIMULATOR_TRIPLET_SUFFIXES) {
@@ -366,7 +373,7 @@ export const platform: Platform<Triplet[], AppleOpts> = {
   },
   async build(
     { spawn, triplet },
-    { build, target, configuration, appleBundleIdentifier },
+    { build, target, configuration, appleBundleIdentifier, codeSigningAllowed },
   ) {
     // We expect the final application to sign these binaries
     if (target.length > 1) {
@@ -440,9 +447,10 @@ export const platform: Platform<Triplet[], AppleOpts> = {
         ...(target.length > 0 ? ["--target", ...target] : []),
         "--",
 
-        // Skip code-signing (needed when building free dynamic libraries)
-        // TODO: Make this configurable
-        "CODE_SIGNING_ALLOWED=NO",
+        // Skip code-signing by default (needed when building free dynamic
+        // libraries), but let a consumer opt into signed binaries via
+        // --code-signing-allowed.
+        `CODE_SIGNING_ALLOWED=${codeSigningAllowed ? "YES" : "NO"}`,
       ]);
       // Create a framework
       const { artifacts } = sharedLibrary;