dmgbuild with background art (never Finder AppleScript)
Developer ID sign + notarize + staple of .app / .dmg
artefact upload
Sidecars remain ad-hoc inside the bundle. App signing is a separate gate.
Confirm entitlements: sandbox false.
Do not assume Gitea-hosted macos-latest.
Document secrets: APPLE_DEVELOPER_ID, notary profile, runner labels.
Rewrite invariants
#165 sidecar signature hard gate. #189 dmgbuild. #215 tests in CI. #127 fetch-at-build.
Dependencies
Blocks-on: all v2.0 issues 1–15, 17–31. Does NOT block on 16.
Unblocks: release.
Test
CI/mock: unsigned sidecar fails the job; tests run; dmg produced.
Hardware: Gatekeeper-open the notarized dmg on a clean Mac.
Acceptance criteria
Clean CI produces a signed universal .dmg.
Unsigned sidecar fails the build.
## Summary
Self-hosted Mac runner. Fetch + ad-hoc sidecar sign + universal xcodebuild + dmgbuild + notarize.
## Spec refs
docs/04-argyll-binaries.md §0.6, 05-argyll-fork.md §8–9, 23-assets.md, 24-issues-invariants.md. #165 #189 #215 #127.
## Scope
In: Gitea Actions (self-hosted) + optional GitHub mirror, fetch-argyll, tests, dmgbuild, notarize/staple, gitignore, build docs.
Out: Finder AppleScript DMG, vendored sidecars, linking Argyll.
## Implementation notes
Pipeline:
1. fetch-argyll (Gronod release, marker `instlist`)
2. `codesign -s -` + `codesign -dvv` on every staged Mach-O including universal — hard fail
3. `xcodebuild build test -scheme ICCery ARCHS='arm64 x86_64' ONLY_ACTIVE_ARCH=NO`
4. unit + mock fixtures in CI (#215)
5. dmgbuild with background art (never Finder AppleScript)
6. Developer ID sign + notarize + staple of `.app` / `.dmg`
7. artefact upload
Sidecars remain **ad-hoc** inside the bundle. App signing is a separate gate.
Confirm entitlements: sandbox false.
Do not assume Gitea-hosted `macos-latest`.
Document secrets: `APPLE_DEVELOPER_ID`, notary profile, runner labels.
## Rewrite invariants
#165 sidecar signature hard gate. #189 dmgbuild. #215 tests in CI. #127 fetch-at-build.
## Dependencies
Blocks-on: all v2.0 issues 1–15, 17–31. Does NOT block on 16.
Unblocks: release.
## Test
- CI/mock: unsigned sidecar fails the job; tests run; dmg produced.
- Hardware: Gatekeeper-open the notarized dmg on a clean Mac.
## Acceptance criteria
- [ ] Clean CI produces a signed universal .dmg.
- [ ] Unsigned sidecar fails the build.
gronod
added this to the M6 — Gamut, Stage 0, CGATS, release milestone 2026-09-08 17:44:42 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Self-hosted Mac runner. Fetch + ad-hoc sidecar sign + universal xcodebuild + dmgbuild + notarize.
Spec refs
docs/04-argyll-binaries.md §0.6, 05-argyll-fork.md §8–9, 23-assets.md, 24-issues-invariants.md. #165 #189 #215 #127.
Scope
In: Gitea Actions (self-hosted) + optional GitHub mirror, fetch-argyll, tests, dmgbuild, notarize/staple, gitignore, build docs.
Out: Finder AppleScript DMG, vendored sidecars, linking Argyll.
Implementation notes
Pipeline:
instlist)codesign -s -+codesign -dvvon every staged Mach-O including universal — hard failxcodebuild build test -scheme ICCery ARCHS='arm64 x86_64' ONLY_ACTIVE_ARCH=NO.app/.dmgSidecars remain ad-hoc inside the bundle. App signing is a separate gate.
Confirm entitlements: sandbox false.
Do not assume Gitea-hosted
macos-latest.Document secrets:
APPLE_DEVELOPER_ID, notary profile, runner labels.Rewrite invariants
#165 sidecar signature hard gate. #189 dmgbuild. #215 tests in CI. #127 fetch-at-build.
Dependencies
Blocks-on: all v2.0 issues 1–15, 17–31. Does NOT block on 16.
Unblocks: release.
Test
Acceptance criteria