T26: a release's macOS disk image is signed with the owner's Developer ID and notarized: mac-app.sh signs under the hardened runtime and notarizes and staples the image when given an identity and the App Store Connect key; the Release workflow, dispatched by hand, runs it on the macos-signing runner and puts the image on the draft through release-asset.sh

.github/workflows/release.yml

@@ -0,0 +1,33 @@
+name: Release
+
+# Dispatched once the version's draft release holds the Windows and Linux builds.
+on:
+  workflow_dispatch:
+
+jobs:
+  macos:
+    # The owner's login session, whose keychain holds the Developer ID identity.
+    runs-on: macos-signing
+    steps:
+      - uses: actions/checkout@v7
+      # The runner's PATH lacks the host's rustup.
+      - run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+      - run: rustup toolchain install --no-self-update
+      - name: Build, sign and notarize the disk image
+        env:
+          SIGN_IDENTITY: "Developer ID Application: Yang Zhang (9PDD8M2SMS)"
+          NOTARY_KEY: ${{ runner.temp }}/notary.p8
+          NOTARY_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          NOTARY_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+          NOTARY_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
+        run: |
+          trap 'rm -f "$NOTARY_KEY"' EXIT
+          (umask 077 && printf '%s' "$NOTARY_KEY_P8" > "$NOTARY_KEY")
+          scripts/mac-app.sh
+      - name: Put the disk image on the release
+        env:
+          RELEASE_API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+          RELEASE_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          version=$(cargo pkgid)
+          scripts/release-asset.sh "target/release/ELYTerminal-${version##*[#@]}.dmg"