🤖 Add macOS notarization support

- Configure electron-builder to notarize DMGs when credentials provided
- Add environment variables for APPLE_ID, APPLE_APP_SPECIFIC_PASSWORD, APPLE_TEAM_ID
- Notarization is optional - builds will succeed without credentials but skip notarization

_Generated with `cmux`_

Author: ammario

.github/workflows/build.yml

@@ -34,6 +34,17 @@ jobs:
             export CSC_LINK="/tmp/certificate.p12"
             export CSC_KEY_PASSWORD="${{ secrets.MACOS_CERTIFICATE_PWD }}"
           fi
+          
+          # Notarization credentials (optional - will skip if not provided)
+          if [ -n "${{ secrets.APPLE_ID }}" ]; then
+            export APPLE_ID="${{ secrets.APPLE_ID }}"
+            export APPLE_APP_SPECIFIC_PASSWORD="${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}"
+            export APPLE_TEAM_ID="${{ secrets.APPLE_TEAM_ID }}"
+            echo "✅ Notarization credentials found - will notarize"
+          else
+            echo "⚠️  No notarization credentials - skipping notarization"
+          fi
+          
           bun run dist:mac
 
       - name: Upload macOS DMG (x64)

package.json

@@ -116,7 +116,10 @@
       "hardenedRuntime": true,
       "gatekeeperAssess": false,
       "entitlements": "build/entitlements.mac.plist",
-      "entitlementsInherit": "build/entitlements.mac.plist"
+      "entitlementsInherit": "build/entitlements.mac.plist",
+      "notarize": {
+        "teamId": "4399GN35BJ"
+      }
     },
     "linux": {
       "target": "AppImage",