How to schedule mac codesign nightly (cron/launchd)?

I need to schedule Apple's codesign tool to run nightly on a macOS machine.

I have tried both cron and launchd but cannot get either to work correctly. I've tried many many things now... and I really don't care which I use as long as it works.

NOTE: My user account is a non-administrative account and I do not have root access. If there is a solution that requires root access, I am still interested to hear about it, but it won't fix my immediate problem!

Can anyone PLEASE help make this work with one or the other?

My attempt with cron

My User's crontab:

00 01 * * * /Users/user175695/test.sh > $HOME/test.log 2>&1

My test.sh script with plenty of security debugging output:

set -e
set -x

security unlock-keychain -p "my-password" /Users/user175695/Library/Keychains/login.keychain-db

echo "USER=$(whoami)"

security list-keychains
security list-keychains -d user
security default-keychain
security login-keychain
security show-keychain-info

security list-keychains -d user -s /Users/user175695/Library/Keychains/login.keychain-db
security unlock-keychain -p "my-password" /Users/user175695/Library/Keychains/login.keychain-db
security default-keychain -s /Users/user175695/Library/Keychains/login.keychain-db

security list-keychains
security list-keychains -d user
security default-keychain
security login-keychain
security show-keychain-info


/usr/bin/codesign --keychain /Users/user175695/Library/Keychains/login.keychain-db -s "Developer ID Application: My Name" -f --verbose /Users/user175695/my.app

Results of my test.sh script in test.log:

security unlock-keychain -p my-password /Users/user175695/Library/Keychains/login.keychain-db
++ whoami
+ echo USER=user175695
USER=user175695
+ security list-keychains
    "/Library/Keychains/System.keychain"
    "/Library/Keychains/System.keychain"
+ security list-keychains -d user
    "/Library/Keychains/System.keychain"
+ security default-keychain
    "/Library/Keychains/System.keychain"
+ security login-keychain
    "/Library/Keychains/System.keychain"
+ security show-keychain-info
Keychain "<NULL>" lock-on-sleep timeout=300s
+ security list-keychains -d user -s /Users/user175695/Library/Keychains/login.keychain-db
+ security unlock-keychain -p my-password /Users/user175695/Library/Keychains/login.keychain-db
+ security default-keychain -s /Users/user175695/Library/Keychains/login.keychain-db
+ security list-keychains
    "/Library/Keychains/System.keychain"
    "/Library/Keychains/System.keychain"
+ security list-keychains -d user
    "/Library/Keychains/System.keychain"
+ security default-keychain
    "/Library/Keychains/System.keychain"
+ security login-keychain
    "/Library/Keychains/System.keychain"
+ security show-keychain-info
Keychain "<NULL>" lock-on-sleep timeout=300s

+ /usr/bin/codesign --keychain /Users/user175695/Library/Keychains/login.keychain-db -s 'Developer ID Application: My Name' -f --verbose /Users/user175695/my.app
error: The specified item could not be found in the keychain.

At first glance the problem appears to be that the identify can't be found in the keychain /Users/user175695/Library/Keychains/login.keychain-db. The identity is actually in the keychain, but the man page for codesign says:

Note that filename will not be searched to resolve the signing identity's certificate chain unless it is also on the user's keychain search list.

We can see from test.log that the keychain login.keychain-db is not in the keychain search list. The call to security list-keychains -d user -s /Users/user175695/Library/Keychains/login.keychain-db, should remedy that... however that command is returning 0 exit code whilst doing nothing :-(

The test.sh script runs fine when run from an SSH session to the Mac machine, but does not run correctly from cron. Is there anything I can do to remedy this in Mac cron?

My attempt with launchd

I found many articles where people have similar problems with codesign and Mac's cron, and some of them suggested that switching to launchd was a viable workaround.

The problem I am seeing with launchd is that my launchd User Agent only runs whilst I am logged in to the Mac GUI (via RemoteDesktop). It does not work when I am logged in only via SSH or when I am logged out. That is obviously of no use for an automated nightly build.

My launchd user agent - ~/Library/LaunchAgents/com.evolvedbinary.afterdark.test.plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>Label</key>
        <string>com.evolvedbinary.afterdark.test</string>
        <key>ProgramArguments</key>
        <array>
            <string>/bin/bash</string>
            <string>/Users/user175695/test.sh</string>
        </array>
        <key>StartCalendarInterval</key>
        <!-- Run every day at 01:00 -->
        <dict>
            <key>Hour</key>
            <integer>01</integer>
            <key>Minute</key>
            <integer>00</integer>
        </dict>
    </dict>
</plist>

Can launchd user-agents which have a scheduled interval run when the user is logged-out? If so, what am I missing?