fix: don't move cli-bundle, sign entire app bundle together

Problem: Moving cli-bundle out and back broke the signature chain,
causing notarization tickets to be invalid.

Solution:
- Remove the "Ensure all binaries are signed (fallback)" step
- Don't move cli-bundle
- Sign entire app bundle with --deep flag in one step
- Don't re-sign DMG after notarization

This should fix the notarization stapling issue.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: 2 people

.github/workflows/build.yml

@@ -188,91 +188,20 @@ jobs:
           # Notarization will be done manually in a separate step
           SIGNING_IDENTITY: "${{ secrets.APPLE_SIGNING_IDENTITY }}"
 
-      - name: Ensure all binaries are signed (fallback)
-        env:
-          APPLE_SIGNING_IDENTITY: "${{ secrets.APPLE_SIGNING_IDENTITY }}"
-        run: |
-          set -e
-          SIGN_ID="${APPLE_SIGNING_IDENTITY}"
-          APP_BUNDLE="./alloomi/apps/web/src-tauri/target/release/bundle/macos/Alloomi.app"
-
-          echo "🔐 Fallback: Signing all binaries in $APP_BUNDLE"
-          echo "  Using SIGN_ID: $SIGN_ID"
-
-          # Remove extended attributes from all binaries
-          find "$APP_BUNDLE" -type f \( -name "*.node" -o -name "*.dylib" \) -print0 | xargs -0 xattr -cr 2>/dev/null || true
-
-          # Sign all .node files with Developer ID, timestamp, and hardened runtime
-          # But skip cli-bundle/node which is already signed by bundle-runtime.sh
-          echo "  Signing .node files..."
-          find "$APP_BUNDLE" -type f -name "*.node" -not -path "*/cli-bundle/*" -print0 | xargs -0 codesign --force --sign "$SIGN_ID" --options runtime --timestamp || true
-
-          # Sign all .dylib files with Developer ID, timestamp, and hardened runtime
-          echo "  Signing .dylib files..."
-          find "$APP_BUNDLE" -type f -name "*.dylib" -print0 | xargs -0 codesign --force --sign "$SIGN_ID" --options runtime --timestamp || true
-
-          # Sign specific problematic executables with Developer ID, timestamp, and hardened runtime
-          # Skip cli-bundle/* as they are already signed by bundle-runtime.sh
-          echo "  Signing specific executables..."
-          for exe in \
-            "$APP_BUNDLE/Contents/Resources/_up_/cli-bundle/vendor/ripgrep/arm64-darwin/rg" \
-            "$APP_BUNDLE/Contents/Resources/_up_/.next/standalone/apps/web/cli-bundle/vendor/ripgrep/arm64-darwin/rg"
-          do
-            if [ -f "$exe" ]; then
-              echo "    Signing: $exe"
-              xattr -cr "$exe" 2>/dev/null || true
-              codesign --force --sign "$SIGN_ID" --options runtime --timestamp "$exe"
-            fi
-          done
-
-          # Verify signatures
-          echo "  Verifying signatures..."
-          for file in \
-            "$APP_BUNDLE/Contents/Resources/_up_/.next/standalone/apps/web/cli-bundle/vendor/ripgrep/arm64-darwin/rg"
-          do
-            if [ -f "$file" ]; then
-              echo "    Verifying: $file"
-              codesign -dv "$file" 2>&1 | head -10
-            fi
-          done
-
-          echo "✅ Fallback signing complete"
-
-      - name: Sign app bundle with Developer ID (skip cli-bundle)
+      - name: Sign app bundle with Developer ID
         env:
           APPLE_SIGNING_IDENTITY: "${{ secrets.APPLE_SIGNING_IDENTITY }}"
         run: |
           APP_BUNDLE="./alloomi/apps/web/src-tauri/target/release/bundle/macos/Alloomi.app"
           echo "Signing app bundle: $APP_BUNDLE"
 
-          # Move cli-bundle out temporarily
-          mv "$APP_BUNDLE/Contents/Resources/_up_/cli-bundle" /tmp/cli-bundle-backup || true
-
-          # Deep sign the app bundle (without cli-bundle)
+          # Sign the entire app bundle (including cli-bundle) with Developer ID
+          # Don't move cli-bundle - just sign everything together
           codesign --deep --force --sign "$APPLE_SIGNING_IDENTITY" --options runtime --timestamp "$APP_BUNDLE"
 
-          # Move cli-bundle back
-          mv /tmp/cli-bundle-backup "$APP_BUNDLE/Contents/Resources/_up_/cli-bundle" || true
-
-          # Sign Node.js with entitlements to allow execution
-          # This is required for Developer ID signed Node.js to work
-          cat > /tmp/node-entitlements.xml << 'EOF'
-          <?xml version="1.0" encoding="UTF-8"?>
-          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-          <plist version="1.0">
-          <dict>
-            <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
-            <true/>
-            <key>com.apple.security.cs.disable-library-validation</key>
-            <true/>
-          </dict>
-          </plist>
-          EOF
-          codesign --force --sign "$APPLE_SIGNING_IDENTITY" --options runtime --entitlements /tmp/node-entitlements.xml "$APP_BUNDLE/Contents/Resources/_up_/cli-bundle/node"
-
           echo "✅ App bundle signed"
 
-      - name: Create DMG manually from signed app bundle
+      - name: Create DMG
         run: |
           # Remove old DMG
           rm -f ./alloomi/apps/web/src-tauri/target/release/bundle/dmg/Alloomi*.dmg
@@ -301,18 +230,6 @@ jobs:
 
           echo "✅ DMG created from signed app bundle"
 
-      - name: Sign DMG with Developer ID
-        env:
-          APPLE_SIGNING_IDENTITY: "${{ secrets.APPLE_SIGNING_IDENTITY }}"
-        run: |
-          DMG_PATH=$(ls ./alloomi/apps/web/src-tauri/target/release/bundle/dmg/Alloomi*.dmg)
-          echo "Signing DMG with Developer ID: $DMG_PATH"
-          # Re-sign the DMG with Developer ID certificate
-          codesign --force --sign "$APPLE_SIGNING_IDENTITY" --options runtime --timestamp "$DMG_PATH"
-          # Verify the signature
-          codesign -dv "$DMG_PATH" 2>&1 | head -5
-          echo "✅ DMG re-signed"
-
       - name: Notarize DMG
         timeout-minutes: 60
         run: |