[peterjthomson]

The optional detached notarization helper updates an artifact's files[] checksum after stapling but can leave the top-level legacy sha512 stale when path names the same artifact. Refresh both digests, preserve the legacy ZIP digest when refreshing a different DMG, and cover both cases in the existing Vitest suite.

Release guidance now describes Oh My Marktext's own build and native document-save checks. Remove the helper comments that require synchronization with other repositories.

The existing build commands, electron-builder notarization, DMG hook, post-build refresh step, signing documentation and conditional macOS release CI are unchanged from main.

Validation:

• Reproduced the stale legacy digest with the main-branch helper; the revised helper updates it.
• 19 focused Vitest tests pass, including the two new cases and existing brand, native-package and update-info checks.
• pnpm omm:deltas --check passes.
• No application code or release artifacts changed.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0b03602. Configure here.}

[cursor]

DMG mount point is never created

Medium Severity

DMG verification calls hdiutil attach -mountpoint on work/mount without creating that directory. Apple documents -mountpoint as requiring an existing empty path, so attach can fail with no such file or directory and the DMG half of the release gate never runs.

 

^{Reviewed by Cursor Bugbot for commit 0b03602. Configure here.}

[github-actions]

Build artifacts for PR #17:

Run: https://github.com/peterjthomson/marktext/actions/runs/36123241538

Artifact	Size	Link
oh-my-marktext-windows-arm64	281.7 MB	Download
oh-my-marktext-macos-x64	299.1 MB	Download
oh-my-marktext-macos-arm64	288.8 MB	Download
oh-my-marktext-linux	639.7 MB	Download
oh-my-marktext-windows-x64	289.9 MB	Download