[codex] Fix native macOS release signing

.github/workflows/native-macos-release.yml

@@ -0,0 +1,80 @@
+name: Native macOS Release
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    runs-on: macos-15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Import Developer ID certificate
+        env:
+          APPLE_CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+        run: |
+          set -euo pipefail
+          : "${APPLE_CERTIFICATE_BASE64:?Missing APPLE_CERTIFICATE_BASE64 secret}"
+          : "${APPLE_CERTIFICATE_PASSWORD:?Missing APPLE_CERTIFICATE_PASSWORD secret}"
+          : "${KEYCHAIN_PASSWORD:?Missing KEYCHAIN_PASSWORD secret}"
+
+          CERT_PATH="$RUNNER_TEMP/developer-id.p12"
+          KEYCHAIN_PATH="$RUNNER_TEMP/release-signing.keychain-db"
+
+          echo "$APPLE_CERTIFICATE_BASE64" | base64 -d > "$CERT_PATH"
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security import "$CERT_PATH" \
+            -P "$APPLE_CERTIFICATE_PASSWORD" \
+            -A \
+            -t cert \
+            -f pkcs12 \
+            -k "$KEYCHAIN_PATH"
+          security list-keychains -d user -s "$KEYCHAIN_PATH"
+          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security find-identity -v -p codesigning "$KEYCHAIN_PATH"
+
+      - name: Build, sign, and notarize DMG
+        env:
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          CODESIGN_IDENTITY: ${{ secrets.CODESIGN_IDENTITY }}
+        run: |
+          set -euo pipefail
+          : "${APPLE_APP_SPECIFIC_PASSWORD:?Missing APPLE_APP_SPECIFIC_PASSWORD secret}"
+          : "${APPLE_ID:?Missing APPLE_ID secret}"
+          : "${APPLE_TEAM_ID:?Missing APPLE_TEAM_ID secret}"
+          : "${CODESIGN_IDENTITY:?Missing CODESIGN_IDENTITY secret}"
+
+          RELEASE=1 NOTARIZE=1 native-macos/scripts/build-app.sh
+
+      - name: Upload workflow artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: StandForge-Native-macOS
+          path: native-macos/.build/dmg/StandForge-Native-0.1.0-arm64.dmg
+
+      - name: Upload release asset
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1 || \
+            gh release create "$GITHUB_REF_NAME" \
+              --title "StandForge $GITHUB_REF_NAME" \
+              --notes "Native macOS release."
+          gh release upload "$GITHUB_REF_NAME" \
+            native-macos/.build/dmg/StandForge-Native-0.1.0-arm64.dmg \
+            --clobber

native-macos/README.md

@@ -12,18 +12,37 @@ It lives next to the Tauri app so the project can keep two frontends:
 swift run --package-path native-macos StandForgeMac
 ```
 
-## Build a `.app`
+## Build a `.app` and `.dmg`
 
 ```bash
 native-macos/scripts/build-app.sh
 ```
 
-The app bundle is written to:
+The script writes a signed app bundle and a disk image to:
 
 ```text
 native-macos/.build/app/StandForge Native.app
+native-macos/.build/dmg/StandForge-Native-0.1.1-arm64.dmg
 ```
 
+By default the app is signed with an ad hoc signature so local builds can be
+verified with `codesign --verify`. Ad hoc signatures are not accepted by
+Gatekeeper for downloaded GitHub release assets.
+
+For a public GitHub release, build with a Developer ID Application certificate
+and notarize the DMG:
+
+```bash
+RELEASE=1 \
+CODESIGN_IDENTITY="Developer ID Application: Example Name (TEAMID)" \
+NOTARIZE=1 \
+NOTARY_KEYCHAIN_PROFILE="standforge-notary" \
+native-macos/scripts/build-app.sh
+```
+
+Alternatively, omit `NOTARY_KEYCHAIN_PROFILE` and provide `APPLE_ID`,
+`APPLE_TEAM_ID`, and `APPLE_APP_SPECIFIC_PASSWORD`.
+
 ## Liquid Glass behavior
 
 The SwiftUI version uses `GlassEffectContainer`, `glassEffect(_:in:)`, and the