From 6333406149474186d7172805b7fe25dd080bf134 Mon Sep 17 00:00:00 2001
From: EMRG Evolution <emrg@argszero.dev>
Date: Thu, 6 Aug 2026 10:46:41 +0800
Subject: [PATCH 1/2] =?UTF-8?q?emrg:=20macOS=20pkg=20=E5=85=AC=E8=AF=81=20?=
 =?UTF-8?q?=E2=80=94=20notarytool=20submit=20+=20stapler=20staple=EF=BC=88?=
 =?UTF-8?q?#441=20P2=20=E5=90=8E=E5=8D=8A=EF=BC=8Crant=2010:06:55=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/build-release.yml | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index fbd36293..923d9169 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -42,6 +42,10 @@ jobs:
       MACOS_SIGNING_P12_BASE64: ${{ secrets.MACOS_SIGNING_P12_BASE64 }}
       MACOS_SIGNING_P12_PASSWORD: ${{ secrets.MACOS_SIGNING_P12_PASSWORD }}
       MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }}
+      # 公证（P2 后半，rant 2026-08-06T10:06:55）：APPLE_ID 等 Secret 未配则跳过降级
+      APPLE_ID: ${{ secrets.APPLE_ID }}
+      MACOS_NOTARY_APP_PASSWORD: ${{ secrets.MACOS_NOTARY_APP_PASSWORD }}
+      MACOS_NOTARY_TEAM_ID: ${{ secrets.MACOS_NOTARY_TEAM_ID }}
     steps:
       - uses: actions/checkout@v5
 
@@ -133,6 +137,29 @@ jobs:
           mv "${PKG}.signed" "$PKG"
           pkgutil --check-signature "$PKG" || true
 
+      # ── pkg 公证（macOS only，P2 后半；Secret 未配则跳过降级）──
+      # notarytool submit --wait：轮询直至 Accepted/Invalid，失败即非零退出 → CI 失败
+      - name: Notarize pkg (macOS only)
+        if: runner.os == 'macOS' && env.APPLE_ID != '' && env.MACOS_NOTARY_APP_PASSWORD != '' && env.MACOS_NOTARY_TEAM_ID != ''
+        shell: bash
+        run: |
+          PKG="$(ls dist/artifacts/EMRG-*-macos-*.pkg | head -1)"
+          if [ -z "$PKG" ]; then echo "no pkg found, skipping"; exit 0; fi
+          xcrun notarytool submit "$PKG" \
+            --apple-id "$APPLE_ID" \
+            --password "$MACOS_NOTARY_APP_PASSWORD" \
+            --team-id "$MACOS_NOTARY_TEAM_ID" \
+            --wait --output-format json
+
+      - name: Staple pkg (macOS only)
+        if: runner.os == 'macOS' && env.APPLE_ID != '' && env.MACOS_NOTARY_APP_PASSWORD != '' && env.MACOS_NOTARY_TEAM_ID != ''
+        shell: bash
+        run: |
+          PKG="$(ls dist/artifacts/EMRG-*-macos-*.pkg | head -1)"
+          if [ -z "$PKG" ]; then echo "no pkg found, skipping"; exit 0; fi
+          xcrun stapler staple "$PKG"
+          xcrun stapler validate "$PKG"
+
       # ── 冒烟（§12，临时 HOME + 无 Python runner）────────────
       - name: Smoke test (R42 temp HOME)
         shell: bash

From 356091748189841498b411679c33b35163db4e10 Mon Sep 17 00:00:00 2001
From: EMRG Evolution <emrg@argszero.dev>
Date: Thu, 6 Aug 2026 10:49:28 +0800
Subject: [PATCH 2/2] =?UTF-8?q?emrg:=20=E4=BF=AE=E5=A4=8D=20SC2012=20?=
 =?UTF-8?q?=E2=80=94=20Notarize/Staple=20pkg=20=E5=AE=9A=E4=BD=8D=E6=94=B9?=
 =?UTF-8?q?=E7=94=A8=20find=EF=BC=88#445=20review=20=E6=84=8F=E8=A7=81?=
 =?UTF-8?q?=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/build-release.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 923d9169..d046447c 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -143,7 +143,7 @@ jobs:
         if: runner.os == 'macOS' && env.APPLE_ID != '' && env.MACOS_NOTARY_APP_PASSWORD != '' && env.MACOS_NOTARY_TEAM_ID != ''
         shell: bash
         run: |
-          PKG="$(ls dist/artifacts/EMRG-*-macos-*.pkg | head -1)"
+          PKG="$(find dist/artifacts -maxdepth 1 -name 'EMRG-*-macos-*.pkg' | head -1)"
           if [ -z "$PKG" ]; then echo "no pkg found, skipping"; exit 0; fi
           xcrun notarytool submit "$PKG" \
             --apple-id "$APPLE_ID" \
@@ -155,7 +155,7 @@ jobs:
         if: runner.os == 'macOS' && env.APPLE_ID != '' && env.MACOS_NOTARY_APP_PASSWORD != '' && env.MACOS_NOTARY_TEAM_ID != ''
         shell: bash
         run: |
-          PKG="$(ls dist/artifacts/EMRG-*-macos-*.pkg | head -1)"
+          PKG="$(find dist/artifacts -maxdepth 1 -name 'EMRG-*-macos-*.pkg' | head -1)"
           if [ -z "$PKG" ]; then echo "no pkg found, skipping"; exit 0; fi
           xcrun stapler staple "$PKG"
           xcrun stapler validate "$PKG"