ci(release): consume thaw-app/org-ci macOS actions

[diazdesandi]

Summary

Move macOS release composite actions out of Thaw and call the public org copies via org-qualified uses: pins (Thaw is not under thaw-app yet).

Scope: replace local .github/actions/* with thaw-app/org-ci/actions/…@d8439b09dfc7dda7323906cd0daeef1752c4bb2a in release/DMG workflows; delete the in-repo action copies.

Closes: N/A

PR Type

Describe what this change does (not the linked issue’s request kind). Bug reports use bug on issues; bug fixes use fix on PRs.

If you tick Feature or Refactor and touch more than ~20 files, please mention why this can’t be split.

• Bug fix
• CI/CD
• Documentation
• Feature
• Enhancement
• Performance improvement
• Refactor
• Test addition or update
• Other (please describe)

Area

Product surfaces (optional when the change is not about the app UI). Path-based labeling also applies.

• Use PR Type for what changed (CI/CD, Documentation, Other / chore, etc.).

• Use ops for where when it is repo operations: CI, release, GitHub hygiene, scripts, lint/sonar config — not a product surface.

• menubar

• icebar

• layout

• appearance

• settings

• onboarding

• permissions

• profiles

• hotkeys

• updates

• ops

Does this PR introduce a breaking change?

• Yes - if yes, please describe the impact and migration path
• No

What is the new behavior?

• release.yml / build-dmg.yml call:
  • thaw-app/org-ci/actions/configure-signing@d8439b09dfc7dda7323906cd0daeef1752c4bb2a
  • thaw-app/org-ci/actions/build@d8439b09dfc7dda7323906cd0daeef1752c4bb2a
  • thaw-app/org-ci/actions/export-and-package@d8439b09dfc7dda7323906cd0daeef1752c4bb2a
  • thaw-app/org-ci/actions/notarize-and-validate@d8439b09dfc7dda7323906cd0daeef1752c4bb2a
  • thaw-app/org-ci/actions/sparkle-release@d8439b09dfc7dda7323906cd0daeef1752c4bb2a (release only)
• Local .github/actions/ composites are removed
• Product-specific inputs (Thaw.xcodeproj, scheme, deployment target, asset-prefix: Thaw) stay in Thaw workflows
• DMG background still comes from public thaw-app/brand-assets (via the org action)

Merge after thaw-app/org-ci#1 (pin points at the latest fix commit on that PR).

PR Checklist

• I've built and run the app locally and verified that it works as expected.
• I've run swiftformat . to keep the code style consistent.
• I've run the smallest relevant test commands (list 1–2 below), e.g. xcodebuild test … or swift test --package-path MenuBarModel.
• I've added tests for new behavior (if applicable).
• I've documented new public APIs / non-obvious helpers.
• I've updated documentation as needed.
• This PR targets the development branch.

Test commands run:

• (CI-only — verify on next build-dmg / release workflow run)

Known limitations / follow-ups

• Re-pin the SHA after org-ci#1 squash-merges to main if desired

Other information

Companion: thaw-app/org-ci#1

Summary by CodeRabbit

• Chores
  • Migrated macOS build, signing, packaging, notarization, and release automation to centrally maintained, version-pinned workflows.
  • Updated release configuration with explicit app build settings and Sparkle metadata.
  • Removed repository-local automation definitions now provided by the shared workflows.

[coderabbitai]

📝 Walkthrough

Walkthrough

The repository-local macOS composite actions were removed. The DMG and release workflows now invoke pinned shared actions for signing, building, packaging, notarization, and Sparkle release generation.

Changes

macOS CI action centralization

Layer / File(s)	Summary
DMG build workflow migration .github/workflows/build-dmg.yml	The DMG workflow replaces local signing, build, export, and notarization actions with pinned shared actions and supplies explicit project, scheme, and deployment-target inputs.
Release workflow migration .github/workflows/release.yml	The release workflow replaces local signing, build, export, notarization, and Sparkle actions with pinned shared actions and adds asset-prefix and appcast-title inputs.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseWorkflow
  participant SharedCI
  participant Xcode
  participant AppleNotary
  ReleaseWorkflow->>SharedCI: Configure signing
  SharedCI->>Xcode: Build and export archive
  Xcode->>SharedCI: Return packaged DMG
  SharedCI->>AppleNotary: Notarize and validate DMG
  AppleNotary->>SharedCI: Return accepted status
  SharedCI->>ReleaseWorkflow: Publish Sparkle ZIP and appcast outputs

Loading

Possibly related PRs

• stonerl/Thaw#530: Directly relates to the local composite action definitions replaced by this change.
• stonerl/Thaw#786: Directly overlaps with the removed Sparkle release action and release workflow wiring.
• stonerl/Thaw#823: Directly relates to the replaced DMG packaging action.

Suggested labels: chore, refactor

Suggested reviewers: stonerl

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	Title clearly states the main change: switching release workflows to shared org-ci macOS actions.
Description check	✅ Passed	Description follows the template and covers summary, PR type, area, breaking change, behavior, checklist, limitations, and other info.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/use-org-ci-actions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}