feat: build, sign and notarize macOS app bundle in CI

- new build-macos-app job: Lazarus 4.8 install, make build-macos,
  create-macos-app.sh bundle/sign/notarize, artifact upload
- with MACOS_CODESIGN_IDENTITY + APPLE_NOTARY secrets: full Developer ID
  signing and notarization; without: ad-hoc signed fallback bundle
- signing cert imported into ephemeral keychain, cleaned up after run
- release job attaches the bundle as HeidiSQL-macos-<tag>.zip
- create-macos-app.sh: env-overridable identity/team/notary profile,
  --adhoc flag, executable auto-detection (out/ vs out/macos/),
  tolerant openssl@1.1 install

Co-authored-by: ansgarbecker <ansgarbecker@users.noreply.github.com>

Author: mistral-vibe

.github/workflows/lazarus.yaml

@@ -174,6 +174,89 @@ jobs:
             name: ${{ matrix.operating-system }}
             path: out/macos/heidisql
 
+    build-macos-app:
+      name: macOS App Bundle
+      if: github.repository == 'HeidiSQL/HeidiSQL'
+      runs-on: macos-15
+      env:
+        GITHUB: 1
+      steps:
+      - name: Checkout source code
+        uses: actions/checkout@v4
+
+      - name: Install Lazarus 4.8 (macOS)
+        run: |
+          wget -q "https://sourceforge.net/projects/lazarus/files/Lazarus%20macOS%20x86-64/Lazarus%204.8/fpc-3.2.4rc1a.intelarm64-macosx.dmg" -O "$RUNNER_TEMP/fpc.dmg"
+          wget -q "https://sourceforge.net/projects/lazarus/files/Lazarus%20macOS%20aarch64/Lazarus%204.8/lazarus-darwin-aarch64-4.8.zip" -O "$RUNNER_TEMP/lazarus.zip"
+          sudo hdiutil attach "$RUNNER_TEMP/fpc.dmg"
+          FPC_VOL=$(ls -d /Volumes/fpc* | head -1)
+          FPC_PKG=$(find "$FPC_VOL" -maxdepth 1 -name "*.pkg" | head -1)
+          sudo installer -package "$FPC_PKG" -target /
+          sudo hdiutil detach "$FPC_VOL"
+          xattr -cr "$RUNNER_TEMP/lazarus.zip"
+          unzip -q "$RUNNER_TEMP/lazarus.zip" -d "$RUNNER_TEMP"
+          sed -i '' 's|"/Developer/lazarus/"|"'$RUNNER_TEMP'/lazarus/"|g' "$RUNNER_TEMP/lazarus/config/environmentoptions.xml" 2>/dev/null || true
+          sudo ln -sf "$RUNNER_TEMP/lazarus/lazbuild" /usr/local/bin/lazbuild
+          echo "$RUNNER_TEMP/lazarus" >> $GITHUB_PATH
+
+      - name: Import code signing certificate
+        if: ${{ secrets.MACOS_CERTIFICATE_P12_BASE64 != '' }}
+        env:
+          MACOS_CERTIFICATE_P12_BASE64: ${{ secrets.MACOS_CERTIFICATE_P12_BASE64 }}
+          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
+        run: |
+          KEYCHAIN_PATH="$RUNNER_TEMP/signing.keychain-db"
+          KEYCHAIN_PASSWORD=$(uuidgen)
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security set-keychain-settings "$KEYCHAIN_PATH" -lut 21600
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          echo "$MACOS_CERTIFICATE_P12_BASE64" | base64 --decode > "$RUNNER_TEMP/certificate.p12"
+          security import "$RUNNER_TEMP/certificate.p12" -k "$KEYCHAIN_PATH" -P "$MACOS_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
+          security list-keychain -d user -s "$KEYCHAIN_PATH"
+          security set-key-partition-list -S apple-tool:,apple: -s "$KEYCHAIN_PATH" -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" >/dev/null
+          rm -f "$RUNNER_TEMP/certificate.p12"
+          echo "KEYCHAIN_PATH=$KEYCHAIN_PATH" >> "$GITHUB_ENV"
+
+      - name: Build HeidiSQL (macOS)
+        run: make build-macos
+
+      - name: Create, sign and notarize app bundle
+        env:
+          MACOS_CODESIGN_IDENTITY: ${{ secrets.MACOS_CODESIGN_IDENTITY }}
+          MACOS_TEAM_ID: ${{ secrets.MACOS_TEAM_ID }}
+          APPLE_ID: ${{ secrets.APPLE_NOTARY_APPLE_ID }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_NOTARY_TEAM_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_NOTARY_PASSWORD }}
+        run: |
+          if [ -n "${MACOS_CODESIGN_IDENTITY}" ] && [ -n "${APPLE_ID}" ]; then
+            xcrun notarytool store-credentials notarytool-profile-ci \
+              --apple-id "${APPLE_ID}" \
+              --team-id "${APPLE_TEAM_ID}" \
+              --password "${APPLE_PASSWORD}"
+            export MACOS_NOTARY_PROFILE=notarytool-profile-ci
+            ./create-macos-app.sh --notarize
+          else
+            echo "Signing secrets not available, creating ad-hoc signed bundle"
+            ./create-macos-app.sh --adhoc
+          fi
+
+      - name: Zip app bundle
+        run: |
+          cd "$(pwd)"
+          rm -f heidisql-macos-app.zip
+          /usr/bin/zip -r -y heidisql-macos-app.zip heidisql.app
+
+      - name: Upload app bundle artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: macos-app-bundle
+          path: heidisql-macos-app.zip
+
+      - name: Cleanup keychain
+        if: always() && env.KEYCHAIN_PATH != ''
+        run: |
+          security delete-keychain "$KEYCHAIN_PATH" || true
+
     build-qt6arm:
       name: Linux ARM64 QT6
       runs-on: ubuntu-24.04-arm
@@ -233,7 +316,7 @@ jobs:
 
         name: Create GitHub Release
         runs-on: [ubuntu-latest]
-        needs: [build, build-qt6arm]
+        needs: [build, build-qt6arm, build-macos-app]
 
         steps:
             - name: Checkout source code
@@ -271,6 +354,13 @@ jobs:
               with:
                 name: ubuntu-24.04-arm-QT6
                 path: out/qt6arm
+            - name: Download macOS app bundle
+              uses: actions/download-artifact@v4
+              with:
+                name: macos-app-bundle
+                path: dist
+            - name: Rename macOS app bundle for release
+              run: mv dist/heidisql-macos-app.zip "dist/HeidiSQL-macos-${{ env.tag }}.zip"
 
             - name: List files
               run: |

create-macos-app.sh

@@ -2,10 +2,12 @@
 set -euo pipefail
 
 DO_NOTARIZE=false
+DO_ADHOC=false
 # parse args
 for arg in "$@"; do
   case "$arg" in
     --notarize) DO_NOTARIZE=true ;;
+    --adhoc) DO_ADHOC=true ;;
   esac
 done
 
@@ -18,18 +20,37 @@ APP_DIR="$(pwd)/${BUNDLE_NAME}"
 LPI_FILE="$(pwd)/heidisql.lpi"
 
 # Path to the already built Lazarus executable
-EXECUTABLE_SRC="$(pwd)/out/heidisql"
+if [[ -f "$(pwd)/out/heidisql" ]]; then
+  EXECUTABLE_SRC="$(pwd)/out/heidisql"
+elif [[ -f "$(pwd)/out/macos/heidisql" ]]; then
+  EXECUTABLE_SRC="$(pwd)/out/macos/heidisql"
+else
+  echo "ERROR: No built executable found in out/ or out/macos/" >&2
+  exit 1
+fi
 EXECUTABLE_TRG="${APP_DIR}/Contents/MacOS/${APP_NAME}"
 
 # Homebrew prefix (auto-detected; override if needed)
 BREW_PREFIX="$(brew --prefix 2>/dev/null || echo "/opt/homebrew")"
 
-# Your Developer ID identity, as shown by: security find-identity -v -p codesigning
-TEAM_ID="QBD4CC6FH3"
-CODESIGN_IDENTITY="Developer ID Application: Ansgar Becker (${TEAM_ID})"
+# Developer ID identity, overridable via environment (CI), as shown by: security find-identity -v -p codesigning
+TEAM_ID="${MACOS_TEAM_ID:-QBD4CC6FH3}"
+CODESIGN_IDENTITY="${MACOS_CODESIGN_IDENTITY:-Developer ID Application: Ansgar Becker (${TEAM_ID})}"
+
+# Ad-hoc signing (no Developer ID available, e.g. fork CI builds)
+if $DO_ADHOC; then
+  CODESIGN_IDENTITY="-"
+fi
 
 # Name for notarytool keychain profile (store once with notarytool store-credentials)
-NOTARY_PROFILE="notarytool-profile"
+NOTARY_PROFILE="${MACOS_NOTARY_PROFILE:-notarytool-profile}"
+
+# codesign flags: hardened runtime + secure timestamp only make sense with a real identity
+if $DO_ADHOC; then
+  SIGN_OPTS=()
+else
+  SIGN_OPTS=(--options runtime --timestamp)
+fi
 
 LOCALES_ZIP_URL="https://www.heidisql.com/downloads/locale/HeidiSQL-locale.zip"
 
@@ -74,8 +95,10 @@ brew list sqlite >/dev/null 2>&1 || brew install sqlite
 # MariaDB Connector/C (libmariadb*.dylib)
 brew list mariadb-connector-c >/dev/null 2>&1 || brew install mariadb-connector-c
 
-# OpenSSL 1.1 for TFPHTTPClient
-brew list openssl@1.1 >/dev/null 2>&1 || brew install openssl@1.1
+# OpenSSL 1.1 for TFPHTTPClient (deprecated in Homebrew, may be unavailable on CI runners)
+if ! brew list openssl@1.1 >/dev/null 2>&1; then
+  brew install openssl@1.1 2>/dev/null || echo "WARNING: openssl@1.1 not installable, skipping" >&2
+fi
 
 MYSQL_LIB_DIR="${BREW_PREFIX}/opt/mysql-client/lib"
 PG_LIB_DIR="${BREW_PREFIX}/opt/libpq/lib"
@@ -95,7 +118,7 @@ mkdir -p "${APP_DIR}/Contents/Frameworks"   # where we will put .dylib and .so f
 # Copy main executable
 cp "${EXECUTABLE_SRC}" "${EXECUTABLE_TRG}"
 chmod +x "${EXECUTABLE_TRG}"
-codesign --force --options runtime --timestamp --sign "${CODESIGN_IDENTITY}" "${EXECUTABLE_TRG}"
+codesign --force "${SIGN_OPTS[@]}" --sign "${CODESIGN_IDENTITY}" "${EXECUTABLE_TRG}"
 
 # Minimal Info.plist (adjust identifiers/versions as needed)
 cat > "${APP_DIR}/Contents/Info.plist" <<EOF
@@ -320,18 +343,23 @@ echo "Done. Bundled app is at: ${APP_DIR}"
 echo "Signing embedded libraries..."
 find "${APP_DIR}/Contents" -type f \( -name "*.dylib" -o -name "*.so" \) | while read -r f; do
   echo "  Signing ${f}"
-  codesign --force --options runtime --timestamp --sign "${CODESIGN_IDENTITY}" "${f}"
+  codesign --force "${SIGN_OPTS[@]}" --sign "${CODESIGN_IDENTITY}" "${f}"
 done
 
 echo "Signing main app bundle..."
-codesign --force --options runtime --timestamp --deep --sign "${CODESIGN_IDENTITY}" "${APP_DIR}"
+codesign --force "${SIGN_OPTS[@]}" --deep --sign "${CODESIGN_IDENTITY}" "${APP_DIR}"
 
 echo "Verifying code signature..."
 codesign --verify --deep --strict --verbose=2 "${APP_DIR}"
 
 
 ### ZIP, NOTARIZE, AND STAPLE
 
+if $DO_ADHOC; then
+  echo "Skip notarization (ad-hoc signed bundle cannot be notarized)"
+  exit 0
+fi
+
 if ! $DO_NOTARIZE; then
   echo "Skip notarization (--notarize not given)"
   exit 0