Drops the legacy `--apple-id + app-specific-password` flow in favor of the
modern `--key + --key-id + --issuer` notarytool path:
- No app-specific password rotation
- Scoped to one team via the issuer UUID (less blast radius)
- The .p8 file is short-lived in CI ($RUNNER_TEMP, chmod 600, rm in cleanup)
- Aligns with the local AC_NOTARY keychain profile already stored on dev
Three secrets replace the previous APPLE_ID + APPLE_APP_PASSWORD pair:
APP_STORE_CONNECT_KEY_ID (10-char)
APP_STORE_CONNECT_ISSUER_ID (UUID)
APP_STORE_CONNECT_PRIVATE_KEY (full .p8 contents)
scripts/release-local.sh now takes an optional notary profile name
(defaults to AC_NOTARY) and uses --keychain-profile so it inherits the
locally stored credential rather than requiring env vars.
scripts/SECRETS.md rewritten end-to-end: one-shot p12 extraction recipe
that filters out non-Developer-ID identities (so a leaked p12 cannot be
used to sign with Apple Distribution / Apple Development), and a
ready-to-paste gh CLI block for all six secrets.
Closes the gap behind #86 (current 2.1.0 ships an unverifiable signature):
manual sign+notarize order was wrong, so Gatekeeper rejects on Apple Silicon
with "code or signature have been modified" / "Info.plist=not bound".
.github/workflows/release.yml drives the whole flow on tag push or workflow
dispatch:
archive (universal arm64 + x86_64 in one pass) -> codesign with
Developer ID Application + hardened runtime + timestamp -> create-dmg ->
notarize app zip -> staple .app -> notarize dmg -> staple dmg ->
re-zip stapled .app -> sha256 -> gh release upload -> bump
homebrew/puremac.rb in-repo -> bump tap formula in
momenbasel/homebrew-tap (if HOMEBREW_TAP_TOKEN is set).
scripts/release-local.sh mirrors the workflow for emergency hotfixes off CI.
scripts/SECRETS.md documents the seven required GH secrets and the
extraction commands for the Developer ID p12 + app-specific notarytool
password.
project.yml bumped to 2.2.0 / build 6 to match the upcoming release.
momenbasel