chore: add scripts/release-macos.sh for one-shot signed DMG release builds

Builds + signs + verifies both Apple Silicon and Intel DMGs; detaches
stale volumes; signs the Intel app in place inside the DMG (keeps the
drag-to-Applications layout); optional --publish cuts the GitHub release
with notes from CHANGELOG.

Author: Dhanabhon

README.md

@@ -201,6 +201,25 @@ Run `pnpm install` before any build command. `pnpm tauri build` runs the
 frontend build (`tsc -b && vite build`) automatically. Release artifacts are
 generated by Tauri under `target/**/release/bundle/`.
 
+### One-shot macOS release build (recommended)
+
+For a full release, use the release script — it builds **both** the Apple
+Silicon and Intel signed DMGs and verifies them:
+
+```bash
+scripts/release-macos.sh            # build + sign + verify both DMGs
+scripts/release-macos.sh --publish  # also create the GitHub release for v<version>
+```
+
+It handles the manual footguns: detaching a stale `/Volumes/FlowClone` before
+each build (it otherwise collides with `bundle_dmg.sh`), and ad-hoc signing the
+**Intel** app — which, when cross-compiled on Apple Silicon, is *not* signed by
+default and would trip Gatekeeper's "app is damaged" on Intel Macs. The Intel
+app is signed in place inside Tauri's DMG so the drag-to-Applications layout is
+preserved. `--publish` reads the release notes from `CHANGELOG.md` and needs an
+authenticated `gh`. The manual per-target steps below still work if you need one
+specific artifact.
+
 **Bundle the CLI sidecar first.** Image Migration and Restore run the
 `flowclone` CLI for the privileged raw I/O, bundled into the app as a Tauri
 sidecar. Build it for the **same target** you pass to `tauri build`, otherwise

scripts/release-macos.sh

@@ -0,0 +1,152 @@
+#!/usr/bin/env bash
+#
+# Build signed macOS DMGs (Apple Silicon + Intel) for a FlowClone release, and
+# optionally publish them as the GitHub Release for the current version's tag.
+#
+# This scripts the recurring, error-prone manual steps:
+#   - A stale `/Volumes/FlowClone` left mounted from a previous build collides
+#     with tauri's `bundle_dmg.sh` and fails the next DMG build — so we detach it
+#     before each build.
+#   - x86_64 apps cross-compiled on Apple Silicon are NOT code-signed (the arm64
+#     native build is auto ad-hoc signed by the linker; the cross build is not).
+#     An unsigned app inside a DMG triggers Gatekeeper's "app is damaged" on
+#     Intel Macs — so we ad-hoc sign the x86_64 app.
+#   - Re-bundling the x86_64 DMG from scratch (`hdiutil create`) loses tauri's
+#     layout (the drag-to-Applications alias). Instead we sign the app *in place*
+#     inside tauri's own DMG (convert to read-write, mount, sign, convert back),
+#     keeping the layout AND the signature.
+#   - Every DMG is verified (the app inside is actually signed) before we trust it.
+#
+# Usage:
+#   scripts/release-macos.sh              # build + sign + verify both DMGs
+#   scripts/release-macos.sh --publish    # also create the GitHub release for v<version>
+#
+# NEVER run as root. Requires: pnpm, rustup (targets auto-added), the built-in
+# codesign, and — for --publish — an authenticated `gh` CLI. Ad-hoc signing is
+# not a substitute for Apple Developer ID + notarization; users still right-click
+# → Open on first launch.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+VOLUME="FlowClone"
+ARM_TRIPLE="aarch64-apple-darwin"
+INTEL_TRIPLE="x86_64-apple-darwin"
+PUBLISH=false
+[ "${1:-}" = "--publish" ] && PUBLISH=true
+
+if [ "$(id -u)" = "0" ]; then
+  echo "error: do not run the release build as root" >&2
+  exit 1
+fi
+
+VERSION=$(node -p "require('./apps/desktop/src-tauri/tauri.conf.json').version")
+echo "==> FlowClone release build for v$VERSION"
+
+ARM_DMG="target/$ARM_TRIPLE/release/bundle/dmg/FlowClone_${VERSION}_aarch64.dmg"
+INTEL_DMG="target/$INTEL_TRIPLE/release/bundle/dmg/FlowClone_${VERSION}_x64.dmg"
+
+# Detach any leftover mount of our volume (exact name, plus Finder's " 1"/" 2"
+# duplicates) so bundle_dmg.sh can create a fresh one.
+detach_stale_volume() {
+  for vol in "/Volumes/$VOLUME" "/Volumes/$VOLUME 1" "/Volumes/$VOLUME 2"; do
+    [ -d "$vol" ] && hdiutil detach "$vol" -force >/dev/null 2>&1 || true
+  done
+}
+
+# Fail unless the app inside $1 (a .dmg) is code-signed.
+verify_dmg_signed() {
+  local dmg="$1"
+  detach_stale_volume
+  hdiutil attach "$dmg" -nobrowse -readonly >/dev/null 2>&1
+  local sig
+  sig=$(codesign -dv "/Volumes/$VOLUME/FlowClone.app" 2>&1 | grep -E "^Signature=" || true)
+  hdiutil detach "/Volumes/$VOLUME" >/dev/null 2>&1 || true
+  if [ -z "$sig" ]; then
+    echo "    !! app inside $(basename "$dmg") is NOT signed" >&2
+    return 1
+  fi
+  echo "    verified: $(basename "$dmg") — app $sig"
+}
+
+# Ad-hoc sign the app inside $1 (a .dmg) in place, preserving tauri's layout.
+# Converts the read-only DMG to read-write, mounts it, signs the app, then
+# converts back to a compressed read-only DMG, replacing the original.
+sign_dmg_app_in_place() {
+  local dmg="$1"
+  local tmp
+  tmp=$(mktemp -d)
+  detach_stale_volume
+  hdiutil convert "$dmg" -format UDRW -o "$tmp/rw.dmg" >/dev/null
+  hdiutil attach "$tmp/rw.dmg" -nobrowse >/dev/null
+  codesign --force --deep -s - "/Volumes/$VOLUME/FlowClone.app"
+  hdiutil detach "/Volumes/$VOLUME" >/dev/null
+  hdiutil convert "$tmp/rw.dmg" -format UDZO -o "$tmp/final.dmg" >/dev/null
+  mv -f "$tmp/final.dmg" "$dmg"
+  rm -rf "$tmp"
+}
+
+echo "==> building CLI sidecars (both arches)"
+bash scripts/build-sidecar.sh "$ARM_TRIPLE" "$INTEL_TRIPLE"
+
+echo "==> building Apple Silicon DMG ($ARM_TRIPLE)"
+detach_stale_volume
+pnpm tauri build --target "$ARM_TRIPLE" --bundles app,dmg
+# The arm64 app is ad-hoc signed by the linker; just confirm it.
+verify_dmg_signed "$ARM_DMG"
+
+echo "==> building Intel DMG ($INTEL_TRIPLE)"
+detach_stale_volume
+pnpm tauri build --target "$INTEL_TRIPLE" --bundles app,dmg
+# The cross-compiled app is unsigned — sign it in place inside tauri's DMG.
+echo "    signing the Intel app inside the DMG (keeps the drag-to-Applications layout)"
+sign_dmg_app_in_place "$INTEL_DMG"
+verify_dmg_signed "$INTEL_DMG"
+
+echo ""
+echo "==> DMGs ready:"
+echo "    $ARM_DMG"
+echo "    $INTEL_DMG"
+
+if [ "$PUBLISH" = false ]; then
+  echo ""
+  echo "To publish this release, run:"
+  echo "    scripts/release-macos.sh --publish"
+  echo "or manually:"
+  echo "    gh release create v$VERSION \\"
+  echo "      \"$ARM_DMG\" \\"
+  echo "      \"$INTEL_DMG\" --title \"FlowClone $VERSION\" --notes-file <notes>"
+  exit 0
+fi
+
+echo ""
+echo "==> publishing GitHub release v$VERSION"
+if ! git rev-parse "v$VERSION" >/dev/null 2>&1; then
+  echo "error: tag v$VERSION does not exist — create and push it first" >&2
+  exit 1
+fi
+
+# Pull the release notes from this version's CHANGELOG section, if present.
+NOTES_FILE=$(mktemp)
+awk -v ver="## [$VERSION]" '
+  index($0, ver) == 1 { grab = 1; next }
+  grab && /^## \[/ { exit }
+  grab { print }
+' CHANGELOG.md > "$NOTES_FILE"
+if [ ! -s "$NOTES_FILE" ]; then
+  printf '## FlowClone %s\n\nSee CHANGELOG.md for details.\n' "$VERSION" > "$NOTES_FILE"
+fi
+# Append the download key so users pick the right build.
+{
+  echo ""
+  echo "**Download:**"
+  echo "- \`$(basename "$ARM_DMG")\` — Apple Silicon (M1/M2/M3/M4)"
+  echo "- \`$(basename "$INTEL_DMG")\` — Intel Macs"
+} >> "$NOTES_FILE"
+
+gh release create "v$VERSION" \
+  "$ARM_DMG" \
+  "$INTEL_DMG" \
+  --title "FlowClone $VERSION" \
+  --notes-file "$NOTES_FILE"
+rm -f "$NOTES_FILE"
+echo "==> published: $(gh release view "v$VERSION" --json url --jq .url)"