fix(ci): use APPLE_APP_SPECIFIC_PASSWORD for notarization

- Remove custom afterSign hook (scripts/notarize.js)
- Enable built-in notarization with "notarize": true
- Use APPLE_ID_PASSWORD env var for electron-builder
- Restore full build (dmg + zip) to test blockmap

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -27,9 +27,9 @@ jobs:
             dist/*.exe.blockmap
             dist/latest.yml
 
-  # macOS ARM64 build (Apple Silicon)
-  build-macos-arm64:
-    runs-on: macos-latest  # ARM64 runner for native Apple Silicon builds
+  # macOS Universal build (ARM64 + x64 in single binary)
+  build-macos:
+    runs-on: macos-latest
     timeout-minutes: 120
     steps:
       - uses: actions/checkout@v4
@@ -39,75 +39,28 @@ jobs:
           cache: 'npm'
       - run: npm ci
 
-      - name: Build macOS ARM64 Package
+      - name: Build macOS Universal Package
         env:
           # Code signing
           CSC_LINK: ${{ secrets.CSC_LINK }}
           CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
-          # Notarization
+          # Notarization (built-in electron-builder)
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-        run: npx electron-builder --mac --arm64 --publish never
+        run: npx electron-builder --mac --universal --publish never
 
-      - name: Rename ARM64 artifacts for clarity
-        run: |
-          cd dist
-          for f in *.dmg; do
-            [ -f "$f" ] && mv "$f" "${f%.dmg}-arm64.dmg" 2>/dev/null || true
-          done
-          for f in *.zip; do
-            [ -f "$f" ] && mv "$f" "${f%.zip}-arm64.zip" 2>/dev/null || true
-          done
-          ls -la
+      - name: List built artifacts
+        run: ls -la dist/
 
       - uses: actions/upload-artifact@v4
         with:
-          name: macos-arm64-builds
-          path: |
-            dist/*.dmg
-            dist/*.zip
-
-  # macOS x64 build (Intel)
-  build-macos-x64:
-    runs-on: macos-15-large  # Intel runner for native x64 builds
-    timeout-minutes: 120
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-          cache: 'npm'
-      - run: npm ci
-
-      - name: Build macOS x64 Package
-        env:
-          # Code signing
-          CSC_LINK: ${{ secrets.CSC_LINK }}
-          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
-          # Notarization
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-        run: npx electron-builder --mac --x64 --publish never
-
-      - name: Rename x64 artifacts for clarity
-        run: |
-          cd dist
-          for f in *.dmg; do
-            [ -f "$f" ] && mv "$f" "${f%.dmg}-x64.dmg" 2>/dev/null || true
-          done
-          for f in *.zip; do
-            [ -f "$f" ] && mv "$f" "${f%.zip}-x64.zip" 2>/dev/null || true
-          done
-          ls -la
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: macos-x64-builds
+          name: macos-builds
           path: |
             dist/*.dmg
             dist/*.zip
+            dist/*.blockmap
+            dist/latest-mac.yml
 
   build-linux:
     runs-on: ubuntu-latest
@@ -168,11 +121,11 @@ jobs:
 
       - name: Build Arch Package
         run: |
-          sudo -u builder bash << 'EOF'
+          sudo -u builder bash << 'EOFBUILD'
           set -e
           makepkg --printsrcinfo > .SRCINFO
           makepkg -s --noconfirm
-          EOF
+          EOFBUILD
 
       - name: Fix permissions for upload
         if: always()
@@ -188,9 +141,9 @@ jobs:
             .SRCINFO
           include-hidden-files: true
 
-  # Create release with Windows, Linux, Arch (fast builds)
+  # Create release with all builds
   release:
-    needs: [build-windows, build-linux, build-arch]
+    needs: [build-windows, build-linux, build-arch, build-macos]
     runs-on: ubuntu-latest
     if: |
       startsWith(github.ref, 'refs/tags/v') ||
@@ -222,6 +175,12 @@ jobs:
           name: arch-package
           path: artifacts/arch-package
 
+      - name: Download macOS artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: macos-builds
+          path: artifacts/macos-builds
+
       - name: Display structure of downloaded files
         run: ls -R artifacts
 
@@ -239,68 +198,7 @@ jobs:
             artifacts/arch-package/.SRCINFO
             artifacts/linux-builds/*
             artifacts/windows-builds/*
+            artifacts/macos-builds/*
           generate_release_notes: true
           draft: true
           prerelease: false
-
-  # Upload macOS ARM64 builds separately
-  release-macos-arm64:
-    needs: [build-macos-arm64, release]
-    runs-on: ubuntu-latest
-    if: |
-      startsWith(github.ref, 'refs/tags/v') ||
-      github.ref == 'refs/heads/main' ||
-      github.event_name == 'workflow_dispatch'
-
-    permissions:
-      contents: write
-
-    steps:
-      - name: Download macOS ARM64 artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: macos-arm64-builds
-          path: artifacts/macos-arm64-builds
-
-      - name: Display macOS ARM64 files
-        run: ls -R artifacts
-
-      - name: Upload macOS ARM64 to Release
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: ${{ github.ref_name }}
-          files: |
-            artifacts/macos-arm64-builds/*
-          draft: true
-          prerelease: false
-
-  # Upload macOS x64 builds separately
-  release-macos-x64:
-    needs: [build-macos-x64, release]
-    runs-on: ubuntu-latest
-    if: |
-      startsWith(github.ref, 'refs/tags/v') ||
-      github.ref == 'refs/heads/main' ||
-      github.event_name == 'workflow_dispatch'
-
-    permissions:
-      contents: write
-
-    steps:
-      - name: Download macOS x64 artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: macos-x64-builds
-          path: artifacts/macos-x64-builds
-
-      - name: Display macOS x64 files
-        run: ls -R artifacts
-
-      - name: Upload macOS x64 to Release
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: ${{ github.ref_name }}
-          files: |
-            artifacts/macos-x64-builds/*
-          draft: true
-          prerelease: false

package.json

@@ -121,15 +121,13 @@
         {
           "target": "dmg",
           "arch": [
-            "arm64",
-            "x64"
+            "universal"
           ]
         },
         {
           "target": "zip",
           "arch": [
-            "arm64",
-            "x64"
+            "universal"
           ]
         }
       ],
@@ -142,9 +140,8 @@
       "forceCodeSigning": true,
       "strictVerify": true,
       "type": "distribution",
-      "notarize": false
+      "notarize": true
     },
-    "afterSign": "scripts/notarize.js",
     "nsis": {
       "oneClick": false,
       "allowToChangeInstallationDirectory": true,