From 90daa8c4435092bb3ad2646f0b578b74989d6904 Mon Sep 17 00:00:00 2001 From: omercelikdev Date: Mon, 13 Jul 2026 12:07:25 +0300 Subject: [PATCH] ci: notarize + staple the macOS .dmg wrapper MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit tauri-action notarizes+staples the .app but leaves the .dmg unstapled, so `spctl -t install` on the disk image reports "Unnotarized Developer ID". Added a post-build step that submits the .dmg (contents already notarized, so Apple clears it fast) and staples the ticket, so the .dmg passes Gatekeeper too — not just the .app inside. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/release.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9c78ab3..ca57cc1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -51,6 +51,25 @@ jobs: with: args: --target universal-apple-darwin + # tauri-action notarizes + staples the .app but not the .dmg wrapper, so + # `spctl -t install` on the .dmg reports "Unnotarized". Submit the .dmg + # itself (its contents are already notarized, so Apple clears it fast) + # and staple the ticket, so the disk image passes Gatekeeper too. + - name: Notarize & staple the DMG + env: + APPLE_ID: ${{ secrets.APPLE_ID }} + APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }} + APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} + run: | + set -euo pipefail + DMG=$(find src-tauri/target/universal-apple-darwin/release/bundle/dmg -name '*.dmg' | head -1) + echo "Notarizing $DMG" + xcrun notarytool submit "$DMG" \ + --apple-id "$APPLE_ID" --password "$APPLE_PASSWORD" --team-id "$APPLE_TEAM_ID" --wait + xcrun stapler staple "$DMG" + xcrun stapler validate "$DMG" + spctl -a -vvv -t install "$DMG" || true + - name: Upload macOS artifacts uses: actions/upload-artifact@v4 with: