build(dmg): package the self-contained companion

[LMLiam]

Summary

• Build one universal app, extension, CLI, and helper package.
• Create a verified DMG with the app and an Applications link.
• Upload the DMG and its SHA-256 file after release-please creates a release.

Issues

Closes #6.

Behaviour and security

• The package script verifies the app layout, versions, architectures, and nested signatures.
• The DMG contains only Clamshell.app and an Applications link.
• The release job has write access to repository contents only when it uploads release assets.
• The DMG uses ad-hoc signatures. Gatekeeper rejects it until the user approves the app.

Verification

• ./scripts/check.sh
• bash scripts/package-dmg.sh 0.1.0 .build/releases
• hdiutil verify .build/releases/clamshellctl-v0.1.0.dmg
• shasum -c .build/releases/clamshellctl-v0.1.0.dmg.sha256

Screenshots

Not applicable.

Checklist

• scripts/check.sh passes.
• User and contributor documentation matches the change.
• Documentation uses ASD-STE100 Simplified Technical English.
• Every commit uses verb(area): description.
• Privileged behaviour is covered by safe tests rather than live system mutation.

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

The project adds reproducible macOS DMG packaging with universal binaries, nested ad-hoc signing, bundle validation, checksum generation, automated tests, dynamic version metadata, and conditional release asset uploads.

DMG release packaging

Layer / File(s)	Summary
Dynamic bundle version metadata App/ClamshellApp/Info.plist, App/ClamshellControl/Info.plist, project.yml	Bundle versions now resolve from MARKETING_VERSION and CURRENT_PROJECT_VERSION.
App and DMG validation scripts/lib/dmg-packaging.sh	Shared helpers validate architectures, signatures, bundle versions, DMG structure, output paths, and checksums while creating the DMG.
Release app assembly scripts/package-dmg.sh, scripts/embed-command-products.sh	Universal Swift products and the Xcode app are built, embedded, signed, verified, and packaged into the release DMG.
DMG packaging test coverage Tests/Scripts/run-dmg-packaging-tests.sh	Fixture-based tests cover invalid inputs, architectures, signatures, DMG contents, checksums, and unnotarised Gatekeeper behaviour.
CI and release asset integration .github/workflows/ci.yml, .github/workflows/release.yml, scripts/check.sh	Packaging tests run in checks and CI; release-created outputs drive DMG packaging and GitHub release asset uploads without cancelling concurrent runs.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The DMG scripts, tests, release job, and versioning changes satisfy the packaging, signing, checksum, and gated upload requirements in #6.
Out of Scope Changes check	✅ Passed	The changes stay focused on DMG packaging, testing, release upload, and version metadata, with no clear unrelated additions.
Description check	✅ Passed	The pull request description follows the required template and includes all key sections with relevant, specific content.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/issue-6-self-contained-dmg

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 0000cd44-b4ae-4c49-8108-5fd2f33d9684

📥 Commits

Reviewing files that changed from the base of the PR and between a561652 and 6c6549f.

📒 Files selected for processing (10)

• .github/workflows/ci.yml
• .github/workflows/release.yml
• App/ClamshellApp/Info.plist
• App/ClamshellControl/Info.plist
• Tests/Scripts/run-dmg-packaging-tests.sh
• project.yml
• scripts/check.sh
• scripts/embed-command-products.sh
• scripts/lib/dmg-packaging.sh
• scripts/package-dmg.sh