ci: Developer ID sign and notarize the macOS release binary

[ArtemisMucaj]

Signs the macos-aarch64 release asset with Developer ID + hardened runtime and notarizes it via notarytool, so it runs without a Gatekeeper exception.

A bare Mach-O can't be stapled, but notarization registers it with Apple so first run passes. Signing happens in the build job before upload-artifact, so the release checksum covers the signed bytes. The step is gated if: runner.os == 'macOS', so Linux/Windows legs are untouched.

Secrets required (set in this repo)

MACOS_CERT_P12, MACOS_CERT_PASSWORD, NOTARY_KEY_P8, NOTARY_KEY_ID, NOTARY_ISSUER_ID.

Summary by CodeRabbit

• New Features
  • Added macOS release signing and Apple notarization.
  • macOS binaries are now verified and securely packaged for distribution.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5d7d7bff-241d-42e9-bf85-5e0f506fd36f

📥 Commits

Reviewing files that changed from the base of the PR and between e874184 and 41e245f.

📒 Files selected for processing (1)

• .github/workflows/release.yml

---

📝 Walkthrough

Walkthrough

The release workflow adds macOS-specific Developer ID signing and Apple notarization. It creates a temporary keychain, verifies the signed binary, uploads the notarized artifact, and removes temporary credentials and keychain data.

Changes

macOS Release Packaging

Layer / File(s)	Summary
Sign and notarize macOS binaries .github/workflows/release.yml	The workflow imports the Developer ID certificate into an ephemeral keychain, signs and verifies the binary, submits a ZIP to Apple, waits for notarization, uploads the signed binary, and cleans up temporary artifacts.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant EphemeralKeychain
  participant codesign
  participant AppleNotaryService
  GitHubActions->>EphemeralKeychain: Import Developer ID certificate
  GitHubActions->>codesign: Sign and verify binary
  GitHubActions->>AppleNotaryService: Submit ZIP for notarization
  AppleNotaryService-->>GitHubActions: Return notarization result
  GitHubActions->>EphemeralKeychain: Remove temporary credentials

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: signing and notarizing the macOS release binary in CI.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/notarize-macos

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}