Sign and notarize macOS releases; prepare v0.8.11

[qwrobins]

Summary

• Require Developer ID signing, hardened runtime, and accepted Apple notarization for both standalone macOS binaries; fail closed without signing secrets.
• Verify strict signatures and online notarization, then execute quarantined assets on fresh native macOS runners before publishing.
• Preserve the exact-commit validation pipeline and atomic installer, remove quarantine bypass, and document secrets/local repair/online-first-launch policy.
• Prepare v0.8.11; merging the version bump triggers the existing auto-tag/release workflow.

Closes #177.

Validation

• Full test suite, typecheck, generated-artifact drift check
• Unix installer regression suite, both build modes, compiled binary smoke test
• actionlint and git diff --check
• Apple credentials configured; real signing/notarization is validated in the gated release jobs.

Greptile Summary

This PR prepares v0.8.11 and adds a fail-closed macOS release trust pipeline.

• Signs both native macOS binaries with a Developer ID identity and hardened runtime entitlements.
• Submits each signed executable for notarization and requires an explicit accepted result.
• Re-verifies signatures, online notarization, quarantine behavior, and execution on fresh native runners before publication.
• Preserves quarantine in the Unix installer and documents online first-launch and local-build repair behavior.
• Updates release documentation, tests, changelog entries, and version references consistently.

Confidence Score: 5/5

The PR appears safe to merge; the macOS publication path fails closed and is gated on native clean-runner verification for both release architectures.

No actionable correctness, security, workflow, versioning, installer, or repository-rule issue remained after checking the changed release path and its tests.

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Adds native macOS signing and clean-runner verification jobs and makes both successful verifications prerequisites for publication.
scripts/sign-macos-release.sh	Implements temporary-keychain Developer ID signing, explicit notarization acceptance, strict verification, and fail-closed cleanup.
scripts/verify-macos-release.sh	Applies quarantine and verifies signature, online notarization, Gatekeeper state, and clean-environment native execution.
tests/release/macos-signing.test.ts	Covers signing-stage ordering, missing credentials, failure propagation, cleanup, notarization verdicts, quarantine, and workflow gating.
install.sh	Stops removing macOS quarantine so downloaded releases retain the supported Gatekeeper trust path.
scripts/macos-entitlements.plist	Grants the JIT and unsigned executable-memory permissions required by the compiled Bun runtime under hardened runtime.
package.json	Advances the package version to 0.8.11 consistently with release documentation and automation.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Resolve release tag to exact commit] --> B[Run validation pipeline]
  A --> C[Build platform binaries]
  C --> D1[Sign and notarize macOS x64]
  C --> D2[Sign and notarize macOS arm64]
  D1 --> E1[Upload signed x64 artifact]
  D2 --> E2[Upload signed arm64 artifact]
  E1 --> F1[Fresh Intel runner: quarantine, verify, execute]
  E2 --> F2[Fresh arm64 runner: quarantine, verify, execute]
  B --> G{All required jobs succeeded?}
  C --> G
  F1 --> G
  F2 --> G
  G -->|Yes| H[Create checksums and publish release]
  G -->|No| I[Block publication]

Loading

_{Reviews (1): Last reviewed commit: "chore: prepare v0.8.11 release" | Re-trigger Greptile}