fix: disable auto-notarization and manually sign all binaries

- Add APPLE_NOTARIZE: false to disable Tauri's auto-notarization
- Deep sign all .node, .dylib, and executable files recursively
- Sign specific problematic binaries (node, ripgrep) in nested directories
- Re-sign entire app bundle with Developer ID certificate
- Rebuild DMG after signing to include signed binaries
- Manually notarize the DMG using xcrun notarytool

This fixes the notarization failure caused by unsigned binaries in the app bundle.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: 2 people

.github/workflows/build.yml

@@ -131,7 +131,7 @@ jobs:
           # List keychains to ensure system can access certificates
           security list-keychain -d user -s $KEYCHAIN_PATH
 
-      - name: Build Tauri app (Apple Silicon)
+      - name: Build Tauri app (Apple Silicon) without notarization
         working-directory: ./lumis/apps/web
         run: pnpm tauri:build
         env:
@@ -141,12 +141,71 @@ jobs:
           APPLE_ID: "${{ secrets.APPLE_ID }}"
           APPLE_PASSWORD: "${{ secrets.APPLE_PASSWORD }}"
           APPLE_TEAM_ID: "${{ secrets.APPLE_TEAM_ID }}"
+          APPLE_NOTARIZE: false
 
-      - name: Sign native modules in bundle
+      - name: Deep sign all binaries in bundle
         working-directory: ./lumis/apps/web/src-tauri/target/release/bundle/macos/Lumis.app
         run: |
-          # Sign all executable files, .node files, and dylib to fix notarization issues
-          find . -type f \( -name "*.node" -o -name "*.dylib" -o -perm +111 \) -exec codesign --force --sign "${{ secrets.APPLE_SIGNING_IDENTITY }}" --options runtime {} \;
+          # Sign all executable files, .node files, and dylib recursively
+          echo "Signing all .node files..."
+          find . -type f -name "*.node" -print0 | xargs -0 codesign --force --sign "${{ secrets.APPLE_SIGNING_IDENTITY }}" --options runtime --timestamp || true
+
+          echo "Signing all .dylib files..."
+          find . -type f -name "*.dylib" -print0 | xargs -0 codesign --force --sign "${{ secrets.APPLE_SIGNING_IDENTITY }}" --options runtime --timestamp || true
+
+          echo "Signing all executable files..."
+          find . -type f -perm +111 -print0 | xargs -0 codesign --force --sign "${{ secrets.APPLE_SIGNING_IDENTITY }}" --options runtime --timestamp || true
+
+      - name: Sign specific problematic binaries
+        working-directory: ./lumis/apps/web/src-tauri/target/release/bundle/macos/Lumis.app
+        run: |
+          # Sign all known problematic binaries in nested directories
+          BINARY_PATHS=(
+            "./Contents/Resources/_up_/cli-bundle/node"
+            "./Contents/Resources/_up_/cli-bundle/vendor/ripgrep/arm64-darwin/rg"
+            "./Contents/Resources/_up_/cli-bundle/vendor/ripgrep/arm64-darwin/ripgrep.node"
+            "./Contents/Resources/_up_/.next/standalone/apps/web/cli-bundle/node"
+            "./Contents/Resources/_up_/.next/standalone/apps/web/cli-bundle/vendor/ripgrep/arm64-darwin/rg"
+            "./Contents/Resources/_up_/.next/standalone/apps/web/cli-bundle/vendor/ripgrep/arm64-darwin/ripgrep.node"
+          )
+
+          for BINARY in "${BINARY_PATHS[@]}"; do
+            if [ -f "$BINARY" ]; then
+              echo "Signing: $BINARY"
+              xattr -cr "$BINARY" 2>/dev/null || true
+              codesign --force --sign "${{ secrets.APPLE_SIGNING_IDENTITY }}" --options runtime --timestamp "$BINARY"
+            else
+              echo "File not found: $BINARY"
+            fi
+          done
+
+      - name: Re-sign entire app bundle
+        working-directory: ./lumis/apps/web/src-tauri/target/release/bundle/macos/Lumis.app
+        run: |
+          # Finally re-sign the entire app bundle
+          echo "Re-signing entire app bundle..."
+          xattr -cr . 2>/dev/null || true
+          codesign --force --sign "${{ secrets.APPLE_SIGNING_IDENTITY }}" --options runtime --timestamp .
+
+      - name: Rebuild DMG after signing
+        working-directory: ./lumis/apps/web/src-tauri/target/release/bundle/macos
+        run: |
+          # Remove old DMG and rebuild with signed app
+          rm -f dmg/*.dmg
+          # Get app version from package.json
+          VERSION=$(cat ../../../../../package.json | jq -r '.version')
+          # Create new DMG with signed app
+          hdiutil create -volname "Lumis" -srcfolder "Lumis.app" -ov -format UDZO "dmg/Lumis_${VERSION}_aarch64.dmg"
+
+      - name: Notarize DMG
+        run: |
+          DMG_PATH=$(ls ./lumis/apps/web/src-tauri/target/release/bundle/dmg/Lumis*.dmg)
+          echo "Notarizing: $DMG_PATH"
+          xcrun notarytool submit "$DMG_PATH" \
+            --apple-id "${{ secrets.APPLE_ID }}" \
+            --password "${{ secrets.APPLE_PASSWORD }}" \
+            --team-id "${{ secrets.APPLE_TEAM_ID }}" \
+            --wait
 
       - name: Find DMG file
         id: dmg