feat(ci): separate macOS arm64 and x64 builds with individual code signing

Changes:
- Split macOS build into two separate jobs: build-macos-arm64 and build-macos-x64
- ARM64 builds on macos-14 (M1 runner) for native Apple Silicon builds
- x64 builds on macos-13 (Intel runner) for native Intel builds
- Each build has its own code signing and notarization process
- Artifacts renamed with -arm64 and -x64 suffixes for clarity
- Separate release jobs for each architecture
- Updated package.json mac targets from "universal" to ["arm64", "x64"]

This fixes code signing issues when building universal binaries and allows
faster parallel builds for each architecture.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -27,9 +27,9 @@ jobs:
             dist/*.exe.blockmap
             dist/latest.yml
 
-  # macOS Universal build (ARM64 + x64 in single binary)
-  build-macos:
-    runs-on: macos-latest
+  # macOS ARM64 build (Apple Silicon)
+  build-macos-arm64:
+    runs-on: macos-14  # M1 runner for native ARM64 builds
     timeout-minutes: 120
     steps:
       - uses: actions/checkout@v4
@@ -39,28 +39,75 @@ jobs:
           cache: 'npm'
       - run: npm ci
 
-      - name: Build macOS Universal Package
+      - name: Build macOS ARM64 Package
         env:
           # Code signing
           CSC_LINK: ${{ secrets.CSC_LINK }}
           CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
-          # Notarization (built-in electron-builder)
+          # Notarization
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-        run: npx electron-builder --mac --universal --publish never
+        run: npx electron-builder --mac --arm64 --publish never
 
-      - name: List built artifacts
-        run: ls -la dist/
+      - name: Rename ARM64 artifacts for clarity
+        run: |
+          cd dist
+          for f in *.dmg; do
+            [ -f "$f" ] && mv "$f" "${f%.dmg}-arm64.dmg" 2>/dev/null || true
+          done
+          for f in *.zip; do
+            [ -f "$f" ] && mv "$f" "${f%.zip}-arm64.zip" 2>/dev/null || true
+          done
+          ls -la
 
       - uses: actions/upload-artifact@v4
         with:
-          name: macos-builds
+          name: macos-arm64-builds
+          path: |
+            dist/*.dmg
+            dist/*.zip
+
+  # macOS x64 build (Intel)
+  build-macos-x64:
+    runs-on: macos-13  # Intel runner for native x64 builds
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+      - run: npm ci
+
+      - name: Build macOS x64 Package
+        env:
+          # Code signing
+          CSC_LINK: ${{ secrets.CSC_LINK }}
+          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+          # Notarization
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: npx electron-builder --mac --x64 --publish never
+
+      - name: Rename x64 artifacts for clarity
+        run: |
+          cd dist
+          for f in *.dmg; do
+            [ -f "$f" ] && mv "$f" "${f%.dmg}-x64.dmg" 2>/dev/null || true
+          done
+          for f in *.zip; do
+            [ -f "$f" ] && mv "$f" "${f%.zip}-x64.zip" 2>/dev/null || true
+          done
+          ls -la
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: macos-x64-builds
           path: |
             dist/*.dmg
             dist/*.zip
-            dist/*.blockmap
-            dist/latest-mac.yml
 
   build-linux:
     runs-on: ubuntu-latest
@@ -121,11 +168,11 @@ jobs:
 
       - name: Build Arch Package
         run: |
-          sudo -u builder bash << 'EOFBUILD'
+          sudo -u builder bash << 'EOF'
           set -e
           makepkg --printsrcinfo > .SRCINFO
           makepkg -s --noconfirm
-          EOFBUILD
+          EOF
 
       - name: Fix permissions for upload
         if: always()
@@ -141,9 +188,9 @@ jobs:
             .SRCINFO
           include-hidden-files: true
 
-  # Create release with all builds
+  # Create release with Windows, Linux, Arch (fast builds)
   release:
-    needs: [build-windows, build-linux, build-arch, build-macos]
+    needs: [build-windows, build-linux, build-arch]
     runs-on: ubuntu-latest
     if: |
       startsWith(github.ref, 'refs/tags/v') ||
@@ -175,12 +222,6 @@ jobs:
           name: arch-package
           path: artifacts/arch-package
 
-      - name: Download macOS artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: macos-builds
-          path: artifacts/macos-builds
-
       - name: Display structure of downloaded files
         run: ls -R artifacts
 
@@ -198,7 +239,68 @@ jobs:
             artifacts/arch-package/.SRCINFO
             artifacts/linux-builds/*
             artifacts/windows-builds/*
-            artifacts/macos-builds/*
           generate_release_notes: true
           draft: true
           prerelease: false
+
+  # Upload macOS ARM64 builds separately
+  release-macos-arm64:
+    needs: [build-macos-arm64, release]
+    runs-on: ubuntu-latest
+    if: |
+      startsWith(github.ref, 'refs/tags/v') ||
+      github.ref == 'refs/heads/main' ||
+      github.event_name == 'workflow_dispatch'
+
+    permissions:
+      contents: write
+
+    steps:
+      - name: Download macOS ARM64 artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: macos-arm64-builds
+          path: artifacts/macos-arm64-builds
+
+      - name: Display macOS ARM64 files
+        run: ls -R artifacts
+
+      - name: Upload macOS ARM64 to Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ github.ref_name }}
+          files: |
+            artifacts/macos-arm64-builds/*
+          draft: true
+          prerelease: false
+
+  # Upload macOS x64 builds separately
+  release-macos-x64:
+    needs: [build-macos-x64, release]
+    runs-on: ubuntu-latest
+    if: |
+      startsWith(github.ref, 'refs/tags/v') ||
+      github.ref == 'refs/heads/main' ||
+      github.event_name == 'workflow_dispatch'
+
+    permissions:
+      contents: write
+
+    steps:
+      - name: Download macOS x64 artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: macos-x64-builds
+          path: artifacts/macos-x64-builds
+
+      - name: Display macOS x64 files
+        run: ls -R artifacts
+
+      - name: Upload macOS x64 to Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ github.ref_name }}
+          files: |
+            artifacts/macos-x64-builds/*
+          draft: true
+          prerelease: false

package.json

@@ -121,13 +121,15 @@
         {
           "target": "dmg",
           "arch": [
-            "universal"
+            "arm64",
+            "x64"
           ]
         },
         {
           "target": "zip",
           "arch": [
-            "universal"
+            "arm64",
+            "x64"
           ]
         }
       ],
@@ -136,12 +138,9 @@
       "hardenedRuntime": true,
       "gatekeeperAssess": false,
       "entitlements": "build/entitlements.mac.plist",
-      "entitlementsInherit": "build/entitlements.mac.plist",
-      "forceCodeSigning": true,
-      "strictVerify": true,
-      "type": "distribution",
-      "notarize": true
+      "entitlementsInherit": "build/entitlements.mac.plist"
     },
+    "afterSign": "scripts/notarize.js",
     "nsis": {
       "oneClick": false,
       "allowToChangeInstallationDirectory": true,

scripts/notarize.js

@@ -11,18 +11,6 @@ try {
 
 const path = require('path');
 
-// Timeout for notarization (30 minutes max)
-const NOTARIZE_TIMEOUT_MS = 30 * 60 * 1000;
-
-function withTimeout(promise, ms, message) {
-  return Promise.race([
-    promise,
-    new Promise((_, reject) =>
-      setTimeout(() => reject(new Error(message)), ms)
-    )
-  ]);
-}
-
 exports.default = async function notarizing(context) {
   console.log('[Notarize] afterSign hook called');
   console.log('[Notarize] Context:', JSON.stringify({
@@ -39,12 +27,6 @@ exports.default = async function notarizing(context) {
     return;
   }
 
-  // Check if notarization is disabled via env var
-  if (process.env.SKIP_NOTARIZE === 'true') {
-    console.log('[Notarize] Skipping: SKIP_NOTARIZE=true');
-    return;
-  }
-
   // Check credentials
   const hasAppleId = !!process.env.APPLE_ID;
   const hasPassword = !!process.env.APPLE_APP_SPECIFIC_PASSWORD;
@@ -63,30 +45,18 @@ exports.default = async function notarizing(context) {
   console.log('[Notarize] Starting notarization...');
   console.log('[Notarize] App path:', appPath);
   console.log('[Notarize] Team ID:', process.env.APPLE_TEAM_ID);
-  console.log('[Notarize] Timeout:', NOTARIZE_TIMEOUT_MS / 1000, 'seconds');
 
   try {
-    await withTimeout(
-      notarize({
-        appPath,
-        appleId: process.env.APPLE_ID,
-        appleIdPassword: process.env.APPLE_APP_SPECIFIC_PASSWORD,
-        teamId: process.env.APPLE_TEAM_ID,
-      }),
-      NOTARIZE_TIMEOUT_MS,
-      `Notarization timed out after ${NOTARIZE_TIMEOUT_MS / 1000} seconds`
-    );
+    await notarize({
+      appPath,
+      appleId: process.env.APPLE_ID,
+      appleIdPassword: process.env.APPLE_APP_SPECIFIC_PASSWORD,
+      teamId: process.env.APPLE_TEAM_ID,
+    });
     console.log('[Notarize] Notarization complete!');
   } catch (error) {
     console.error('[Notarize] Notarization failed:', error.message);
-
-    // Don't fail the build if notarization times out or fails
-    // The app will still be code-signed, just not notarized
-    if (process.env.NOTARIZE_FAIL_ON_ERROR !== 'true') {
-      console.warn('[Notarize] Continuing build without notarization (set NOTARIZE_FAIL_ON_ERROR=true to fail)');
-      return;
-    }
-
+    console.error('[Notarize] Full error:', error);
     throw error;
   }
 };