desktop: signed + notarized releases (mac arm64+intel, win, linux)#36
Merged
Conversation
Wire macOS Developer ID signing in CI (hardened runtime + explicit entitlements) and local notarization (Pattern C, scripts/notarize-release.mjs) run while the GitHub release is still a draft, so the build never blocks on Apple's notary queue and "Immutable releases" doesn't freeze unnotarized DMGs. Build macOS on native runners — arm64 on macos-latest, Intel x64 on macos-15-intel — so better-sqlite3 and the Prisma engine compile natively per arch (the previous single-runner cross-build shipped a broken Intel slice). Stop pinning arch in the config so --arm64/--x64 each build one slice. Gate the signing secrets to the macOS runners. Drop the Linux arm64 target (it would fail the x64-only runner and drop all Linux artifacts). Reprocess the app icon from the brand logo (macOS squircle -> full PNG set + .icns + .ico) and add a branded DMG (background + drag-to-Applications) plus NSIS installer icons. Move entitlements out of the gitignored build/ dir into resources/ and track dmg-background.png so the signing/packaging assets actually exist in CI. Restore release.mjs Stage D (notarize) before the un-draft. Update desktop.md.
packages/ui/src/assets.d.ts (declare module '*.svg' + the import.meta.env
type) and packages/web/src/vite-env.d.ts are hand-written ambient shims, but
.gitignore's packages/{ui,web}/src/**/*.d.ts rule excluded them. A fresh CI
checkout therefore lacked them, producing 178 TS2307/TS2339 errors during
typecheck (missing *.svg module decls + import.meta.env). Whitelist both back,
mirroring the existing !apps/desktop/src/ambient.d.ts exception.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes
pnpm release <version>produce signed + notarized macOS (Apple Silicon + Intel), Windows x64, and Linux x64 builds — and refreshes the app icon + DMG branding. Previously the pipeline shipped unsigned, arm64-only Mac.What changed
identity,hardenedRuntime: true, explicitentitlements/entitlementsInherit(incl.disable-library-validationforbetter-sqlite3). Secrets gated to the macOS runners.scripts/notarize-release.mjs(submit → staple → re-upload), run byrelease.mjswhile the release is still a draft — before un-drafting — so it never blocks CI on Apple's notary queue and "Immutable releases" can't freeze unnotarized DMGs.macos-latestand x64 onmacos-15-intel(native runners), sobetter-sqlite3+ the Prisma engine compile per-arch. Removed pinnedarchfrom the config so--arm64/--x64each build exactly one slice (the old single-runner cross-build shipped a broken Intel slice).arm64target (would fail the x64-onlyubuntu-latestrunner and drop all Linux artifacts)..icns+.ico.installerIcon/uninstallerIcon.entitlements.mac.plistout of the gitignoredbuild/dir into trackedresources/, and trackeddmg-background.png(gitignored by*.png) — both were missing from the repo and would break signing/packaging in a fresh CI checkout.Verified locally (real signed builds)
codesign -dvvv:Developer ID Application: Julia Kafarska (8Y2UTZ2NBZ),flags=0x10000(runtime), entitlements embedded.--arm64builds arm64 only (no broken cross-build).Applicationssymlink + new app/volume icon.Deferred (follow-up)
Auto-update serves one mac arch's
latest-mac.ymlchannel (the two runners overwrite each other). Auto-update was inert while unsigned; a merged manifest is a clean follow-up.