Sign and notarize macOS releases

[amalshaji]

Summary

• pass the Developer ID certificate to Tauri for stable and canary macOS builds
• pass Apple notarization credentials alongside the existing updater-signing key
• require the same Apple secrets when the stable publisher is invoked as a reusable workflow

Why

The current release workflows only sign Tauri updater artifacts. macOS distribution also needs Developer ID code signing and Apple notarization so downloaded builds can pass Gatekeeper normally.

Repository setup

• APPLE_CERTIFICATE: configured
• APPLE_CERTIFICATE_PASSWORD: configured
• APPLE_ID: configured
• APPLE_PASSWORD: configured with a dedicated app-specific password
• APPLE_TEAM_ID: configured

Validation

• actionlint .github/workflows/publish.yml
• actionlint .github/workflows/test.yml
• git diff --check origin/main...HEAD
• both commits verified with git verify-commit
• GitHub integration test, Tasuku Review, and Workers Builds checks passed

Repository-wide actionlint still reports the pre-existing SC2129 style warning in .github/workflows/tag-on-merge.yml; this change does not touch that workflow.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	dbcooper	72ae6df	Commit Preview URL Branch Preview URL	Aug 12 2026, 02:50 PM