Add production macOS signing and notarized releases

[enaboapps]

Closes #552

Summary

• add an Apple Silicon release workflow using an ephemeral GitHub-hosted keychain, Developer ID signing, and App Store Connect API-key notarization
• verify release tag/version consistency, nested signatures, hardened runtime, secure timestamps, architecture, Gatekeeper, and stapled tickets before publishing
• add the production environment and protected release-tag policy while preserving unsigned PR/main CI and the local Accessibility signing identity
• document certificate creation, GitHub secrets, release recovery, and rotation

Validation

• npm run lint
• npm test (40 tests)
• npm run build
• cargo fmt --manifest-path src-tauri/Cargo.toml --check
• cargo clippy --locked --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings
• cargo test --locked --manifest-path src-tauri/Cargo.toml (131 tests)
• unsigned Apple Silicon .app and DMG bundle build
• bash -n scripts/verify-macos-release.sh
• actionlint .github/workflows/release-macos.yml

Account setup status

The GitHub production environment, deployment policies, telemetry endpoint, and release-tag ruleset are configured. Apple still reports the renewed Developer Program membership as expired, so the Developer ID certificate, notarization API key, and remaining environment secrets cannot be provisioned until Apple activates the membership.

[greptile-apps]

This review was skipped because it would exceed your organization's monthly flex usage limit. Raise the limit in billing settings or wait until the next billing period resets limits.

[enaboapps]

Implementation validation is green on the latest head:

• frontend: passed
• native macOS app/DMG: passed
• native Windows UIAccess package: passed
• local Node 24 and Rust 1.97.1 checks: passed
• local unsigned Apple Silicon app/DMG build: passed
• actionlint and release verifier shell syntax: passed

Two external prerequisites remain:

1. Apple Developer currently still reports this team membership as expired and does not load the Certificates controls, so a Developer ID Application certificate and App Store Connect notarization key cannot yet be issued.
2. Greptile skipped its review because the organization monthly flex usage limit is exhausted. A 5/5 score cannot be produced until the limit is raised or resets.

The GitHub production environment, main/v* deployment policies, telemetry endpoint, and protected v* tag ruleset are already configured. No release tag has been created.

[greptile-apps]

Greptile Summary

This change adds a production macOS release path for Apple Silicon builds, Developer ID signing, notarization, release verification, checksums, and GitHub Release publishing. The release checks application version alignment, signing identity, hardened runtime, architecture, Gatekeeper acceptance, and notarization tickets before assets are published.

Confidence Score: 5/5

Safe to merge; no blocking failure remains.

No blocking failure remains.

T-Rex Logs

What T-Rex did

• I examined the macOS release workflow and verification script to trace how app and DMG notarization checks are wired.
• I ran a DMG-only fixture with no app ticket, and verification stopped at the app-ticket validation with exit 65.
• I ran the fixture with an app ticket provided by the build path and with DMG stapling, and both app and DMG validations plus Gatekeeper checks completed successfully.
• I compared fixtures and confirmed that with the app ticket supplied by the build path, the unchanged DMG workflow passes both validations as shown in the after-path log.

_{Ran code and verified through T-Rex}

_{Reviews (2): Last reviewed commit: "security: pin production release actions" | Re-trigger Greptile}

[enaboapps]

@greptileai

[enaboapps]

@greptileai review

[enaboapps]

@greptile-apps please run a full review on latest head 5dbb2ec and update the confidence score.

[enaboapps]

@greptileai review