fix(release): Developer-ID sign nested computerd bundle before notarization

[cnjack]

问题

上一个 PR (#158) 修复后，bundle 能成功构建，但 Release 的两个 macOS desktop job 在**公证（notarization）**阶段失败（run 29713342361）：

failed to notarize app: ... "Archive contains critical validation errors"
jcode.app/Contents/Resources/jcode-computerd.app/Contents/MacOS/jcode-computerd:
  - The binary is not signed with a valid Developer ID certificate.
  - The signature does not include a secure timestamp.
  - The executable does not have the hardened runtime enabled.

原因

computerd helpers 以嵌套 .app resource（Resources/jcode-computerd.app）形式打进 Tauri app。Tauri 只会用 Developer ID 签外层 app 和 externalBin sidecar，不会重签 resource 里的嵌套 bundle。于是 build_computerd_bundle.sh 打的 ad-hoc 签名被原样带入公证上传，被 Apple 拒绝。（设计文档 computer-helper-design.md §11 预留的 "Release wiring" 正是此处。）

修复

新增 CI 步骤 Sign computerd bundle (Developer ID)，在 pnpm tauri build 之前：

• 把 Developer ID 证书导入一次性 keychain；
• 对嵌套 bundle 的三个二进制（capture / onboarding / daemon）及 bundle 本体用 Developer ID 重签，启用 hardened runtime（--options runtime）+ secure timestamp，沿用共享 identifier 保持单一 TCC 身份；
• codesign --verify --deep --strict 校验。

仅当配置了 APPLE_CERTIFICATE 时执行；未配置签名时 Tauri 既不签名也不公证，ad-hoc bundle 对无签名本地构建仍然可用（早退 exit 0）。

daemon 仅使用 AX + ScreenCaptureKit，hardened runtime 下无需额外 entitlements（已 grep 确认无 DYLD/dlopen/JIT 等敏感用法）。

验证

• actionlint 通过（shellcheck 无告警）。
• YAML 合法（ruby 解析）。
• 脚本 bash 语法检查通过；APPLE_CERTIFICATE 未设置时早退 exit 0 已本地验证。
• 本地 pre-push（go build/vet/lint/test）通过。
• 端到端需下次打 Release tag 由 CI 的 macOS job 确认公证通过。

[coderabbitai]

Warning

Review limit reached

@cnjack, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 22 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 31d7cfd8-48e2-40e6-94de-29f19a393b28

📥 Commits

Reviewing files that changed from the base of the PR and between 7d40f7c and 029e571.

📒 Files selected for processing (1)

• .github/workflows/release.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/release-computerd-codesign

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}