Bump version to 0.4.0 and add macOS code signing to release workflow

.github/workflows/build-mac.yml

@@ -14,6 +14,8 @@ jobs:
     runs-on: macos-latest
     permissions:
       contents: read
+    env:
+      HAS_APPLE_CERT: ${{ secrets.APPLE_CERTIFICATE_BASE64 != '' }}
 
     steps:
       - name: Checkout repository
@@ -43,6 +45,34 @@ jobs:
             app/modules/backend -> target
             rust-mod -> target
 
+      # Code signing (optional, requires APPLE_CERTIFICATE_BASE64 and related secrets)
+      - name: Import Apple signing certificate
+        if: env.HAS_APPLE_CERT == 'true'
+        env:
+          APPLE_CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+        run: |
+          CERT_PATH=$RUNNER_TEMP/cert.p12
+          KEYCHAIN_PATH=$RUNNER_TEMP/signing.keychain-db
+
+          echo -n "$APPLE_CERTIFICATE_BASE64" | base64 --decode -o "$CERT_PATH"
+
+          security create-keychain -p "" "$KEYCHAIN_PATH"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
+          security unlock-keychain -p "" "$KEYCHAIN_PATH"
+
+          security import "$CERT_PATH" -P "$APPLE_CERTIFICATE_PASSWORD" \
+            -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
+          security set-key-partition-list -S apple-tool:,apple: -k "" "$KEYCHAIN_PATH"
+          security list-keychain -d user -s "$KEYCHAIN_PATH" login.keychain-db
+
+          IDENTITY=$(security find-identity -v -p codesigning "$KEYCHAIN_PATH" \
+            | grep "Developer ID Application" | head -1 | awk -F'"' '{print $2}')
+          echo "APPLE_SIGNING_IDENTITY=$IDENTITY" >> "$GITHUB_ENV"
+          echo "Signing identity: $IDENTITY"
+
+          rm "$CERT_PATH"
+
       - name: Build universal mod library
         run: pnpm build:mod:mac-universal
 
@@ -53,8 +83,16 @@ jobs:
         run: pnpm test:app:backend
 
       - name: Build universal macOS app
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
         run: pnpm build:tauri:mac-universal
 
+      - name: Clean up signing keychain
+        if: always() && env.HAS_APPLE_CERT == 'true'
+        run: security delete-keychain $RUNNER_TEMP/signing.keychain-db
+
       - name: Upload .dmg
         uses: actions/upload-artifact@v7
         with:

.github/workflows/release.yml

@@ -14,6 +14,7 @@ jobs:
     uses: ./.github/workflows/build-mac.yml
     permissions:
       contents: read
+    secrets: inherit
 
   build-windows:
     name: Windows Build

app/modules/backend/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "daystrom"
-version = "0.3.0"
+version = "0.4.0"
 edition = "2021"
 
 [lib]

package.json

@@ -1,7 +1,7 @@
 {
   "name": "daystrom-workspace",
   "type": "module",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "private": true,
   "packageManager": "pnpm@10.33.0+sha512.10568bb4a6afb58c9eb3630da90cc9516417abebd3fabbe6739f0ae795728da1491e9db5a544c76ad8eb7570f5c4bb3d6c637b2cb41bfdcdb47fa823c8649319",
   "engines": {

rust-mod/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "stfc-mod"
-version = "0.3.0"
+version = "0.4.0"
 edition = "2024"
 
 [lib]