# Apple Release

> Prepare, validate, sign, notarise, package, and report this macOS application's direct Developer ID release without exposing credentials or claiming checks that were not run.

- Skill: `rcarmo/apple-release` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add rcarmo/apple-release`
- Raw SKILL.md: https://api.skillmd.com/api/skills/rcarmo/apple-release/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Docs & Writing
- License: MIT
- Author: rcarmo (https://skillmd.com/u/rcarmo)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/rcarmo/apple-release

---


# macOS release

Read `docs/RELEASE.md`, `VERSION`, `Package.swift`, `Makefile`, bundle/release scripts, disabled workflow examples, and `references/release-checklist.md`. Load `../apple-project-workflows/SKILL.md` when configuration changes.

## Preflight

1. Confirm that direct Developer ID distribution is the requested channel; this repository does not implement App Store or TestFlight delivery.
2. Confirm product and bundle IDs, `VERSION`, build number policy, macOS minimum, category, icon, privacy metadata, and entitlements.
3. For GitHub release, require a semantic `v…` tag whose text after `v` exactly matches `VERSION`.
4. Run clean validation, lint, SwiftPM tests, release compilation, and real app-bundle assembly on macOS.
5. Inspect the signed product's nested code, entitlements, plist, architecture, and signature identity.
6. Keep certificates, passwords, API keys, profiles, and keychains outside Git and logs.

## Direct release

- Build the SwiftPM executable in release mode and assemble the `.app`.
- Preserve a private UUID-matched dSYM, strip debug/local/Swift nlist symbols from the distributed executable, and verify the result before signing.
- Sign the complete bundle with hardened runtime, a secure timestamp, and a Developer ID Application identity.
- Verify the signature before notarisation.
- Create a temporary zip, submit with `notarytool`, wait for acceptance, then staple and validate.
- Run Gatekeeper assessment.
- Create a new distribution zip only after stapling; write and verify its checksum.
- Extract and launch the final archive on another Mac outside the build tree.

Treat stripping and symbol redaction as cost-raising measures, not a secrecy boundary. Do not remove Swift reflection/runtime metadata blindly, publish the private dSYM, embed credentials, or move authoritative security decisions into the client.

Local setup stores an Apple ID notary profile through `make notary-setup`. The disabled GitHub Actions example creates an ephemeral profile from App Store Connect API-key secrets. Do not describe the two credential routes as interchangeable or imply that the example is active.

## Reporting

Report the source tag/commit, artifact path, version/build, identity class, notarisation submission/result, staple and Gatekeeper results, checksum, tested macOS/hardware, and commands run. If host capabilities or credentials are unavailable, list the unverified steps and stop. Never fabricate a release result.