fix(ci): unblock macOS dev-release prereqs (#1231)

* fix(ci): unblock macOS dev-release prereqs

* fix(ci): preserve entitlements under hardened runtime

Author: TimeToBuildBob

Makefile

@@ -131,8 +131,12 @@ uninstall:
 test:
 	@for module in $(TESTABLES); do \
 		echo "Running tests for $$module"; \
-		poetry run make -C $$module test || { echo "Error in $$module tests"; exit 2; }; \
-    done
+		if [ -f "$$module/pyproject.toml" ]; then \
+			(cd $$module && poetry run make test) || { echo "Error in $$module tests"; exit 2; }; \
+		else \
+			make -C $$module test || { echo "Error in $$module tests"; exit 2; }; \
+		fi; \
+	done
 
 test-integration:
 	# TODO: Move "integration tests" to aw-client

scripts/package/build_app_tauri.sh

@@ -96,7 +96,10 @@ echo "APPL????" > "dist/${APP_NAME}.app/Contents/PkgInfo"
 
 if [ -n "$APPLE_PERSONALID" ]; then
     echo "Signing app with identity: $APPLE_PERSONALID"
-    codesign --deep --force --sign "$APPLE_PERSONALID" "dist/${APP_NAME}.app"
+    # Hardened runtime is required for notarization prechecks on macOS.
+    # The Tauri bundle still embeds PyInstaller-built helpers from dist/activitywatch/,
+    # so keep the existing entitlements that those binaries need under hardened runtime.
+    codesign --deep --force --options runtime --entitlements scripts/package/entitlements.plist --sign "$APPLE_PERSONALID" "dist/${APP_NAME}.app"
     echo "App signing complete."
 else
     echo "APPLE_PERSONALID not set. Skipping code signing."