WesandClaude Opus 4.6 74b557d47f feat(ci): sign and notarize OSS desktop release builds ...

Replace ad-hoc code signing with proper Apple code signing via
block/apple-codesign-action. The unsigned DMG from the Tauri build
is sent to Block's signing service which signs with a Developer ID
certificate, notarizes with Apple, and returns a signed DMG.

Updater artifacts (tar.gz + minisign signature) are now created
post-signing so the archive contains the properly signed .app.

Changes:
- Add codesign action step (pinned to v1.1.0 SHA)
- Add spctl notarization verification alongside codesign --verify
- Move updater artifact creation to post-signing step
- Use pnpm exec tauri signer (lockfile-pinned) instead of npx
- Name archive with version so GitHub asset filename matches
  latest.json URL (gh release upload # syntax is label-only)
- Add id-token: write permission for AWS OIDC
- Update RELEASING.md with new secrets and signed/notarized docs
- Remove signingIdentity and createUpdaterArtifacts from release config

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-05-04 09:08:07 -07:00

..

ISSUE_TEMPLATE

Initial commit

2026-03-06 21:00:58 +00:00

workflows

feat(ci): sign and notarize OSS desktop release builds

2026-05-04 09:08:07 -07:00