> Electron apps have tools for automatically signing on GitHub actions so looking though what they do might help?

These only sign/notarise the dmg or app bundles (or the binaries inside them), so I don’t think that will help the OP unless they’re willing to wrap their CLI app in an Electron app, unfortunately.