chore(release): ad-hoc sign macOS builds

Configure Tauri to ad-hoc sign macOS app and DMG builds without Apple Developer credentials.

Add a macOS signing verifier that checks the built app, the DMG payload, Mach-O signatures, quarantine xattrs, and expected Gatekeeper behavior.

Tighten README copy while keeping the platform install pills and accurate non-notarized macOS guidance.
This commit is contained in:
NimBold
2026-07-06 16:34:20 +03:30
parent 5ef0b3b5f6
commit a2a3b08d4e
5 changed files with 342 additions and 32 deletions
+3
View File
@@ -91,6 +91,9 @@ jobs:
if: runner.os == 'macOS'
run: |
APP="src-tauri/target/${{ matrix.target }}/release/bundle/macos/Firelink.app"
DMG="$(find src-tauri/target/${{ matrix.target }}/release/bundle/dmg -name '*.dmg' -print -quit)"
test -n "$DMG"
npm run verify:macos-signing -- --app "$APP" --dmg "$DMG"
node scripts/verify-binaries.js --search-root "$APP" --target ${{ matrix.target }}
node scripts/smoke-packaged-app.js --executable "$APP/Contents/MacOS/firelink"
- name: Verify Windows installer payload and launch