release: prepare v1.12.1

.github/workflows/release.yml

@@ -371,6 +371,27 @@ jobs:
           security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
           security list-keychain -d user -s $KEYCHAIN_PATH
 
+      - name: Validate macOS notarization prerequisites
+        if: startsWith(matrix.platform, 'macos')
+        shell: bash
+        env:
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          set -euo pipefail
+          missing=()
+          [ -n "${APPLE_SIGNING_IDENTITY:-}" ] || missing+=("APPLE_SIGNING_IDENTITY")
+          [ -n "${APPLE_ID:-}" ] || missing+=("APPLE_ID")
+          [ -n "${APPLE_PASSWORD:-}" ] || missing+=("APPLE_PASSWORD")
+          [ -n "${APPLE_TEAM_ID:-}" ] || missing+=("APPLE_TEAM_ID")
+
+          if [ "${#missing[@]}" -gt 0 ]; then
+            printf 'Missing macOS notarization secrets: %s\n' "${missing[*]}" >&2
+            exit 1
+          fi
+
       - name: Build Tauri app (Windows offline, direct release upload)
         if: matrix.platform == 'windows-2022' && steps.updater_mode.outputs.enabled == 'true'
         uses: tauri-apps/tauri-action@v0
@@ -677,33 +698,17 @@ jobs:
             find "$bundle_dir" -maxdepth 4 -type f | sort
           done
 
-      - name: Build macOS app (fallback without notarization, verbose)
-        id: build_macos_fallback
+      - name: Fail when macOS notarized build is unavailable
         if: startsWith(matrix.platform, 'macos') && steps.build_macos_primary.outcome == 'failure' && steps.build_macos_retry.outcome == 'failure'
         shell: bash
-        env:
-          CARGO_PROFILE_RELEASE_LTO: "off"
-          CARGO_PROFILE_RELEASE_CODEGEN_UNITS: 32
-          CARGO_INCREMENTAL: 0
-          CARGO_TARGET_DIR: src-tauri/target
-          SCCACHE_GHA_ENABLED: "true"
-          RUSTC_WRAPPER: sccache
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
         run: |
-          set -euxo pipefail
-          echo "Fallback macOS target without notarization: ${{ matrix.target }}"
-          pnpm tauri build --target "${{ matrix.target }}"
-
-      - name: Warn on macOS notarization fallback
-        if: startsWith(matrix.platform, 'macos') && steps.build_macos_primary.outcome == 'failure' && steps.build_macos_retry.outcome == 'failure'
-        run: |
-          echo "::warning::macOS notarization failed twice; fallback build skipped notarization and produced a signed-only artifact."
+          set -euo pipefail
+          echo "::error::macOS notarization failed twice. Blocking release instead of publishing a signed-only artifact."
+          exit 1
 
       - name: Resolve macOS bundle dir
         id: resolve_macos_bundle_dir
-        if: startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success' || steps.build_macos_fallback.outcome == 'success')
+        if: startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success')
         shell: bash
         run: |
           set -euo pipefail
@@ -735,6 +740,28 @@ jobs:
           echo "Resolved macOS bundle dir: $bundle_dir"
           echo "bundle_dir=$bundle_dir" >> "$GITHUB_OUTPUT"
 
+      - name: Verify notarized macOS app bundle
+        if: startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success')
+        shell: bash
+        run: |
+          set -euo pipefail
+          BUNDLE_DIR="${{ steps.resolve_macos_bundle_dir.outputs.bundle_dir }}"
+          if [ -z "$BUNDLE_DIR" ] || [ ! -d "$BUNDLE_DIR" ]; then
+            echo "Expected bundle dir missing: $BUNDLE_DIR" >&2
+            exit 1
+          fi
+
+          app_bundle="$(find "$BUNDLE_DIR" -type d -name "*.app" | sort | head -n 1)"
+          if [ -z "$app_bundle" ] || [ ! -d "$app_bundle" ]; then
+            echo "No .app bundle found under $BUNDLE_DIR" >&2
+            find "$BUNDLE_DIR" -maxdepth 4 | sort || true
+            exit 1
+          fi
+
+          echo "Validating notarized app bundle: $app_bundle"
+          spctl -a -vv "$app_bundle"
+          xcrun stapler validate "$app_bundle"
+
       - name: Inspect final macOS outputs
         if: startsWith(matrix.platform, 'macos') && always()
         shell: bash
@@ -753,7 +780,7 @@ jobs:
           fi
 
       - name: Stage macOS release assets
-        if: startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success' || steps.build_macos_fallback.outcome == 'success')
+        if: startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success')
         shell: bash
         run: |
           set -euo pipefail
@@ -792,7 +819,7 @@ jobs:
           find "$STAGING_DIR" -maxdepth 1 -type f | sort
 
       - name: Build lime-cli release binary
-        if: matrix.build_cli && (matrix.platform == 'windows-2022' || matrix.platform == 'ubuntu-22.04' || (startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success' || steps.build_macos_fallback.outcome == 'success')))
+        if: matrix.build_cli && (matrix.platform == 'windows-2022' || matrix.platform == 'ubuntu-22.04' || (startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success')))
         shell: bash
         env:
           CARGO_PROFILE_RELEASE_LTO: "off"
@@ -807,7 +834,7 @@ jobs:
 
       - name: Package lime-cli release asset
         id: package_lime_cli
-        if: matrix.build_cli && (matrix.platform == 'windows-2022' || matrix.platform == 'ubuntu-22.04' || (startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success' || steps.build_macos_fallback.outcome == 'success')))
+        if: matrix.build_cli && (matrix.platform == 'windows-2022' || matrix.platform == 'ubuntu-22.04' || (startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success')))
         shell: bash
         run: |
           set -euxo pipefail
@@ -827,7 +854,7 @@ jobs:
           echo "asset_path=$asset_path" >> "$GITHUB_OUTPUT"
 
       - name: Stage lime-cli release asset
-        if: matrix.build_cli && (matrix.platform == 'windows-2022' || matrix.platform == 'ubuntu-22.04' || (startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success' || steps.build_macos_fallback.outcome == 'success')))
+        if: matrix.build_cli && (matrix.platform == 'windows-2022' || matrix.platform == 'ubuntu-22.04' || (startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success')))
         shell: bash
         run: |
           set -euxo pipefail