release(feat): notarise the menu-bar DMG and attach it to releases by Ducksss · Pull Request #89 · Ducksss/codex-profiles

Ducksss · 2026-10-12T17:06:24Z

Summary

Ships the menu-bar app as a notarised download from the Release workflow. Because GitHub Releases here are immutable, the DMG has to be attached when the release is created, so this adds a macOS job that runs before anything is published.

New menu-dmg job (macOS, contents: read, release environment): checks out the verified commit and runs scripts/release/build-menu-dmg.sh. That script imports the Developer ID .p12 into a temporary keychain, requires exactly one Developer ID Application identity, notarises with an App Store Connect API key, checks the DMG version matches the release, and deletes the keychain and key file on exit.
publish now needs [verify, menu-dmg]. It downloads the artifact before tagging, and publish-github.sh attaches the DMG and .sha256 to gh release create. After publication it verifies each asset's state, size and digest.
New menu_dmg input, default true. Dry runs sign and notarise too, so they prove the Apple credentials. Setting it to false releases without a DMG, and that version can never gain one.
scripts/macos/build-menu-dmg.sh accepts MENU_APP_NOTARY_KEY / _KEY_ID / _ISSUER as an alternative to a Keychain profile.
macos/README.md "Publish a signed download" is now the maintainer setup: enrol, export the .p12, create the API key, and set five release environment secrets.

Secrets reach only the build step. The workflow contract test checks this, along with the job permissions, the input default and the step ordering.

Not in this PR

The Homebrew cask can only be added after the first release carries a DMG. It's recorded in macos/README.md.
The 1.3.1 version bump is a separate draft PR stacked on this one.

Test plan

make check (includes the new test/release/menu-dmg-test.sh, extended github-test.sh, menu-release-test.sh and workflow-contract-test.mjs)
DMG tests also pass under macOS's Bash 3.2
Mutation checks: removing the asset arguments or the digest comparison fails github-test.sh
Release dry run once the five MENU_APP_* secrets exist (needs the maintainer's Apple Developer account)

🤖 Generated with Claude Code

Summary by CodeRabbit

New Features
- macOS releases can include a signed and notarized menu-bar DMG and its checksum as downloadable release assets. DMG publishing is enabled by default and can be turned off for a release.
- Notarization can use either a Keychain profile or App Store Connect API key credentials.
Documentation
- Updated release and macOS setup guides with instructions for configuring and publishing DMG releases.

Add a macOS job to the Release workflow that builds the menu-bar DMG, signs it with a Developer ID certificate held in a temporary keychain, notarises it with an App Store Connect API key, and hands the DMG and its checksum to the publish job. publish-github.sh attaches both when it creates the release and verifies their size and digest afterwards, because immutable releases cannot gain assets later. The new menu_dmg input defaults to true. Dry runs sign and notarise too, so they prove the Apple credentials before a live release. The local builder also accepts an API key instead of a Keychain profile. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

coderabbitai · 2026-10-12T17:06:42Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 6a265104-266c-41d4-ac48-ebd46aeb04db

📥 Commits

Reviewing files that changed from the base of the PR and between b489df6 and 65f8cc5.

📒 Files selected for processing (11)

.github/workflows/release.yml
CHANGELOG.md
CONTRIBUTING.md
macos/README.md
scripts/macos/build-menu-dmg.sh
scripts/release/build-menu-dmg.sh
scripts/release/publish-github.sh
test/macos/menu-release-test.sh
test/release/github-test.sh
test/release/menu-dmg-test.sh
test/release/workflow-contract-test.mjs

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

📝 Walkthrough

Walkthrough

The release workflow now builds, signs, notarises, and attaches a menu-bar DMG and checksum when enabled. The workflow can use either a Keychain notarisation profile or App Store Connect API key credentials. It verifies release assets after upload.

Changes

Menu-bar DMG release

Layer / File(s)	Summary
Notarisation and release DMG build `scripts/macos/build-menu-dmg.sh`, `scripts/release/build-menu-dmg.sh`, `test/macos/menu-release-test.sh`, `test/release/menu-dmg-test.sh`	The macOS builder accepts Keychain profile or API key credentials. The release script configures a temporary keychain, builds and checks the DMG and checksum, and cleans up temporary resources. Tests cover credentials, artifact creation, failure cases, and cleanup.
Workflow build and artifact handoff `.github/workflows/release.yml`, `test/release/workflow-contract-test.mjs`, `CHANGELOG.md`, `CONTRIBUTING.md`, `macos/README.md`	The workflow adds the default-on `menu_dmg` input and a macOS build job. For enabled live releases, it downloads the build artifact and passes its directory to release creation and verification. The documentation and contract tests describe and check this flow.
GitHub Release asset publishing and verification `scripts/release/publish-github.sh`, `test/release/github-test.sh`	The publish script validates and attaches the DMG and checksum when `MENU_DMG_DIR` is set. Verification checks asset presence, upload state, size, and any digest provided by GitHub. Tests cover valid and invalid asset cases.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseWorkflow as Release workflow
  participant BuildScript as build-menu-dmg.sh
  participant DMGBuilder as macOS DMG builder
  participant PublishScript as publish-github.sh
  ReleaseWorkflow->>BuildScript: Start DMG build for verified commit
  BuildScript->>DMGBuilder: Build and notarise DMG
  DMGBuilder-->>BuildScript: Return DMG and checksum
  BuildScript-->>ReleaseWorkflow: Provide build output
  ReleaseWorkflow->>PublishScript: Pass downloaded artifact directory
  PublishScript->>PublishScript: Attach and verify release assets

Merge Risk: ⚪ Minimal · up to 65f8c

The release workflow gains a notarised menu-bar DMG that is attached and verified at release creation. No concrete merge-blocking risk was identified. A dry run with the maintainer's Apple credentials is still advisable before the first live release.

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 7 files. (4 skipped: 4 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: notarising the menu-bar DMG and attaching it to releases.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 7 files. (4 skipped: 4 unsupported.)

Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Ducksss · 2026-10-12T17:53:17Z

Parked: the maintainer has no Apple Developer membership for now, so there is no Developer ID certificate or notarisation key. Don't merge as is: menu_dmg defaults to true, so every release would fail without the five MENU_APP_* secrets. Pick this up after enrolling, then redo the version prep (see #90).

Copilot AI balanced review requested due to automatic review settings October 12, 2026 17:06

Copilot AI reviewed Oct 12, 2026

Ducksss mentioned this pull request Oct 12, 2026

release(chore): prepare 1.3.1 with the notarised menu-bar DMG #90

Closed

1 of 2 tasks

Ducksss marked this pull request as draft October 12, 2026 17:53

Navigation Menu

Repository navigation

release(feat): notarise the menu-bar DMG and attach it to releases - #89

release(feat): notarise the menu-bar DMG and attach it to releases#89
Ducksss wants to merge 1 commit into
mainfrom
claude/menu-dmg-release

Ducksss commented Oct 12, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

coderabbitai Bot commented Oct 12, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

Ducksss commented Oct 12, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Ducksss commented Oct 12, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Not in this PR

Test plan

Summary by CodeRabbit

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

Ducksss commented Oct 12, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Ducksss commented Oct 12, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 12, 2026 •

edited

Loading