macOS release
Read docs/RELEASE.md, VERSION, Package.swift, Makefile, bundle/release scripts, disabled workflow examples, and references/release-checklist.md. Load ../apple-project-workflows/SKILL.md when configuration changes.
Preflight
- Confirm that direct Developer ID distribution is the requested channel; this repository does not implement App Store or TestFlight delivery.
- Confirm product and bundle IDs,
VERSION, build number policy, macOS minimum, category, icon, privacy metadata, and entitlements.
- For GitHub release, require a semantic
v… tag whose text after v exactly matches VERSION.
- Run clean validation, lint, SwiftPM tests, release compilation, and real app-bundle assembly on macOS.
- Inspect the signed product's nested code, entitlements, plist, architecture, and signature identity.
- Keep certificates, passwords, API keys, profiles, and keychains outside Git and logs.
Direct release
- Build the SwiftPM executable in release mode and assemble the
.app.
- Preserve a private UUID-matched dSYM, strip debug/local/Swift nlist symbols from the distributed executable, and verify the result before signing.
- Sign the complete bundle with hardened runtime, a secure timestamp, and a Developer ID Application identity.
- Verify the signature before notarisation.
- Create a temporary zip, submit with
notarytool, wait for acceptance, then staple and validate.
- Run Gatekeeper assessment.
- Create a new distribution zip only after stapling; write and verify its checksum.
- Extract and launch the final archive on another Mac outside the build tree.
Treat stripping and symbol redaction as cost-raising measures, not a secrecy boundary. Do not remove Swift reflection/runtime metadata blindly, publish the private dSYM, embed credentials, or move authoritative security decisions into the client.
Local setup stores an Apple ID notary profile through make notary-setup. The disabled GitHub Actions example creates an ephemeral profile from App Store Connect API-key secrets. Do not describe the two credential routes as interchangeable or imply that the example is active.
Reporting
Report the source tag/commit, artifact path, version/build, identity class, notarisation submission/result, staple and Gatekeeper results, checksum, tested macOS/hardware, and commands run. If host capabilities or credentials are unavailable, list the unverified steps and stop. Never fabricate a release result.
1---2name: apple-release3description: Prepare, validate, sign, notarise, package, and report this macOS application's direct Developer ID release without exposing credentials or claiming checks that were not run.4license: MIT5---67# macOS release89Read `docs/RELEASE.md`, `VERSION`, `Package.swift`, `Makefile`, bundle/release scripts, disabled workflow examples, and `references/release-checklist.md`. Load `../apple-project-workflows/SKILL.md` when configuration changes.1011## Preflight12131. Confirm that direct Developer ID distribution is the requested channel; this repository does not implement App Store or TestFlight delivery.142. Confirm product and bundle IDs, `VERSION`, build number policy, macOS minimum, category, icon, privacy metadata, and entitlements.153. For GitHub release, require a semantic `v…` tag whose text after `v` exactly matches `VERSION`.164. Run clean validation, lint, SwiftPM tests, release compilation, and real app-bundle assembly on macOS.175. Inspect the signed product's nested code, entitlements, plist, architecture, and signature identity.186. Keep certificates, passwords, API keys, profiles, and keychains outside Git and logs.1920## Direct release2122- Build the SwiftPM executable in release mode and assemble the `.app`.23- Preserve a private UUID-matched dSYM, strip debug/local/Swift nlist symbols from the distributed executable, and verify the result before signing.24- Sign the complete bundle with hardened runtime, a secure timestamp, and a Developer ID Application identity.25- Verify the signature before notarisation.26- Create a temporary zip, submit with `notarytool`, wait for acceptance, then staple and validate.27- Run Gatekeeper assessment.28- Create a new distribution zip only after stapling; write and verify its checksum.29- Extract and launch the final archive on another Mac outside the build tree.3031Treat stripping and symbol redaction as cost-raising measures, not a secrecy boundary. Do not remove Swift reflection/runtime metadata blindly, publish the private dSYM, embed credentials, or move authoritative security decisions into the client.3233Local setup stores an Apple ID notary profile through `make notary-setup`. The disabled GitHub Actions example creates an ephemeral profile from App Store Connect API-key secrets. Do not describe the two credential routes as interchangeable or imply that the example is active.3435## Reporting3637Report the source tag/commit, artifact path, version/build, identity class, notarisation submission/result, staple and Gatekeeper results, checksum, tested macOS/hardware, and commands run. If host capabilities or credentials are unavailable, list the unverified steps and stop. Never fabricate a release result.
rcarmo