ci: macOS .dmg release pipeline (arm64 + Intel) + README polish#3
Merged
Conversation
GitHub Actions release pipeline (push tag v* or workflow_dispatch):
- macOS arm64 (macos-14) + Intel x64 (macos-15-intel): cargo tauri build
app,dmg, then productbuild a .pkg from the bundled .app
- Windows x64: NSIS .exe
Signing: macOS uses ad-hoc identity by default (APPLE_SIGNING_IDENTITY="-")
so the .app/.dmg/.pkg are openable via right-click — a fully unsigned .app is
rejected outright by Gatekeeper on macOS 15+ ("damaged"). Optional Apple
Developer ID + notarization kicks in automatically if the APPLE_* secrets are
configured. Windows .exe is unsigned (SmartScreen warning, still usable).
Each platform verifies its artifacts before upload (codesign --verify --deep
--strict, hdiutil verify, pkg payload check, PE32 + size for .exe), ships a
.sha256 sidecar, and uploads to a draft release. Locally validated the full
macOS chain (build -> ad-hoc sign -> dmg -> productbuild pkg -> verify).
README: document the release assets, the ad-hoc Gatekeeper right-click-open
caveat, the Windows SmartScreen / macOS-only-runtime notes, and SHA256 verify.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 68db0d8af2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
Drop the .pkg productbuild step and the Windows .exe job for the first release — keep it to the locally-validated macOS dmg path (arm64 + Intel). The Windows build is untested and, since `release` needs all build jobs, a Windows failure would block the whole release; .pkg / Windows can be re-added later. README download section trimmed to the two macOS .dmg assets.
Cmochance
changed the title
Cmochance
added a commit
that referenced
this pull request
Jun 1, 2026
…#4) Pass github.event.inputs.version / steps.ver.outputs.version through env vars instead of interpolating ${{ }} directly into run: shell blocks (CWE-78). A workflow_dispatch version like $(...) would otherwise be evaluated by the shell. matrix.* / with: usages are repo-controlled or not shell-evaluated and unchanged. Addresses devin-ai-integration PR #3 review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概述
参考 codex-app-transfer,新增 GitHub Actions 自动打包 pipeline。第一版聚焦 macOS
.app+.dmg(arm64 + Intel),重点把签名做对避免"打包出来不可用"。(.pkg/ Windows.exe已在本地验证可行,但 Windows 未真机回归且会因release的needs: build阻塞发布,故第一版先不启用,后续再加。)触发
push tag
v*(如v0.1.0)或手动workflow_dispatch(填 version);校验 tag 版本 ==tauri.conf.json(现 0.1.0)。签名(重点)
APPLE_SIGNING_IDENTITY="-"):完全未签的 .app 在 macOS 15+ 被 Gatekeeper 报"已损坏";ad-hoc 签后可"右键→打开"。本地真打验证:Signature=adhoc、codesign --verify --deep --strict通过、.dmg(13.95MB)hdiutil verifyVALID。APPLE_*secrets → 自动真签名 + 公证(双击即用)。.sha256;发 draft release。README
.dmg资产 + ad-hoc 右键打开说明 + SHA256 校验合并后
gh workflow run release.yml -f version=0.1.0即可真打 arm64 + Intel 两个 dmg,出 draft release 验证。