feat: enable macOS builds with ad-hoc signing across all CI workflows

Enable macOS builds in CI, release, and nightly workflows using ad-hoc
signing (APPLE_SIGNING_IDENTITY="-") instead of requiring an Apple
Developer ID certificate. This produces unsigned DMGs suitable for
distribution via Homebrew Cask (which handles quarantine removal in
its postflight script). Use macos-13 for Intel builds since macos-15
runners are ARM-based.

Signed-off-by: Claude <noreply@anthropic.com>

https://claude.ai/code/session_01LJRyPkNX753y9Q97ASPoM1
Signed-off-by: Claude <noreply@anthropic.com>

Author: claude

.github/workflows/ci.yml

@@ -189,61 +189,62 @@ jobs:
 
   # ─────────────────────────────────────────────────────────────
   # Build Verification (macOS only - Linux/Windows covered by e2e-desktop)
-  # Disabled until macOS signing key is available
   # ─────────────────────────────────────────────────────────────
-  # build:
-  #   needs: [rust-check, ts-check]
-  #   runs-on: macos-latest
-  #   env:
-  #     MACOSX_DEPLOYMENT_TARGET: '10.13'
-  #   steps:
-  #     - uses: actions/checkout@v4
-  #
-  #     - uses: dtolnay/rust-toolchain@stable
-  #       with:
-  #         targets: aarch64-apple-darwin
-  #
-  #     - uses: Swatinem/rust-cache@v2
-  #       with:
-  #         key: aarch64-apple-darwin
-  #         shared-key: rust-aarch64-apple-darwin
-  #         cache-on-failure: true
-  #
-  #     - uses: pnpm/action-setup@v4
-  #     - uses: actions/setup-node@v4
-  #       with:
-  #         node-version: 20
-  #         cache: 'pnpm'
-  #
-  #     # Cache pnpm store
-  #     - name: Get pnpm store directory
-  #       shell: bash
-  #       run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
-  #
-  #     - name: Cache pnpm store
-  #       uses: actions/cache@v4
-  #       with:
-  #         path: ${{ env.STORE_PATH }}
-  #         key: pnpm-store-${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}
-  #         restore-keys: |
-  #           pnpm-store-${{ runner.os }}-
-  #
-  #     # Cache Tauri CLI binary
-  #     - name: Cache Tauri CLI
-  #       uses: actions/cache@v4
-  #       with:
-  #         path: |
-  #           ~/.cargo/bin/cargo-tauri*
-  #           ~/.cargo/bin/tauri*
-  #         key: tauri-cli-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
-  #         restore-keys: |
-  #           tauri-cli-${{ runner.os }}-
-  #
-  #     - run: pnpm install --frozen-lockfile
-  #     - run: pnpm build
-  #       env:
-  #         TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-  #         TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+  build:
+    needs: [rust-check, ts-check]
+    runs-on: macos-latest
+    env:
+      MACOSX_DEPLOYMENT_TARGET: '10.13'
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: aarch64-apple-darwin
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: aarch64-apple-darwin
+          shared-key: rust-aarch64-apple-darwin
+          cache-on-failure: true
+
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'pnpm'
+
+      # Cache pnpm store
+      - name: Get pnpm store directory
+        shell: bash
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+
+      - name: Cache pnpm store
+        uses: actions/cache@v4
+        with:
+          path: ${{ env.STORE_PATH }}
+          key: pnpm-store-${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            pnpm-store-${{ runner.os }}-
+
+      # Cache Tauri CLI binary
+      - name: Cache Tauri CLI
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin/cargo-tauri*
+            ~/.cargo/bin/tauri*
+          key: tauri-cli-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            tauri-cli-${{ runner.os }}-
+
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm build
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          # Ad-hoc signing (no Apple Developer ID)
+          APPLE_SIGNING_IDENTITY: '-'
 
   # ─────────────────────────────────────────────────────────────
   # Test Results Report (separate checks per test type and OS)

.github/workflows/nightly.yml

@@ -23,9 +23,8 @@ jobs:
             target: x86_64-unknown-linux-gnu
           - os: windows-latest
             target: x86_64-pc-windows-msvc
-          # macOS build disabled until signing key is available
-          # - os: macos-latest
-          #   target: aarch64-apple-darwin
+          - os: macos-latest
+            target: aarch64-apple-darwin
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
@@ -60,6 +59,8 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
           PKG_CONFIG_PATH: /usr/lib/x86_64-linux-gnu/pkgconfig:/usr/lib/pkgconfig:/usr/share/pkgconfig
+          # Ad-hoc signing for macOS (no Apple Developer ID)
+          APPLE_SIGNING_IDENTITY: ${{ matrix.os == 'macos-latest' && '-' || '' }}
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v4

.github/workflows/release.yml

@@ -50,13 +50,12 @@ jobs:
           - os: windows-latest
             target: x86_64-pc-windows-msvc
             artifact: windows
-          # macOS builds disabled until signing key is available
-          # - os: macos-latest
-          #   target: aarch64-apple-darwin
-          #   artifact: macos-arm
-          # - os: macos-15
-          #   target: x86_64-apple-darwin
-          #   artifact: macos-intel
+          - os: macos-latest
+            target: aarch64-apple-darwin
+            artifact: macos-arm
+          - os: macos-13
+            target: x86_64-apple-darwin
+            artifact: macos-intel
 
     runs-on: ${{ matrix.os }}
     permissions: