[df49b9cd]

What changed

A pushed v* tag now produces a production-grade draft release instead of a bare, note-less, Linux-only one:

• Release job (new, tag builds only): gates the tag against the versions in package.json, src-tauri/tauri.conf.json and src-tauri/Cargo.toml (all three must match), collects both platforms' bundles, writes SHA256SUMS, attests every asset's build provenance with Sigstore (actions/attest-build-provenance@v4, verifiable via gh attestation verify <asset>), and opens a draft release with install + GPL §6 source notes plus GitHub's generated changelog. Hyphenated tags (e.g. v0.1.0-rc1) are marked prerelease. Publishing stays a human step. All of the job's scripts were rehearsed locally against the real tree.
• macOS CI (new): check-macos runs scripts/check.sh on macos-26 plus the keychain round-trip (secrets::tests::macos_keychain_roundtrip) against a throwaway keychain, bounded by a 2-minute watchdog (PL-111); bundle-macos builds the .dmg with secret-gated Apple signing (APPLE_CERTIFICATE + APPLE_CERTIFICATE_PASSWORD; notarization with APPLE_ID + APPLE_PASSWORD + APPLE_TEAM_ID, all-or-none) and ad-hoc signed otherwise, then mounts the dmg and asserts the executable links nothing outside Apple's system libraries and the signature verifies.
• macOS static tail (PL-110): scripts/build-media.sh on Darwin also builds OpenSSL 3.6.5, FreeType 2.14.3, FriBidi 1.0.17, HarfBuzz 14.6.0, libunibreak 8.0 (checksum-pinned release tarball), libass 0.17.5, lcms2 2.19.1 and uchardet 0.0.8 statically into third_party/prefix with MACOSX_DEPLOYMENT_TARGET=13.0; src-tauri/build.rs links them statically and drops the Homebrew dylib path. Before this, a downloaded dmg only ran where Homebrew had those dylibs installed.
• Side fix: bundle.macOS.files license texts moved from Contents/ to Contents/Resources/ — codesign treats extension-less files in Contents/ as unsigned code objects and refused to sign the bundle.
• scripts/notices.py now unions the Linux and macOS crate sets (cargo fetch for platform-specific license files) and lists the static-tail libraries; THIRD_PARTY_NOTICES.md regenerated (545 KB). scripts/outdated.sh audits the eight new upstream tags — all current.

Found along the way

• The documented keychain-test recipe was silently broken: libtest --exact needs the full module path (secrets::tests::macos_keychain_roundtrip) — the bare name matched zero tests. Fixed in the doc comment and CI.
• The test's locked-keychain phase pops a real SecurityAgent password dialog on any window-server machine (developer Macs and GitHub runners alike), blocking in mach_msg where tokio's timeout cannot preempt it; one stale dialog wedges every later security call session-wide (stack-sampled). Trimmed the test to the unlocked path — locked-marker classification stays covered by the existing unit test — and filed the async-blocking problem as PL-113.

Verification

• scripts/check.sh green on macOS with the static tail: 89 Rust tests, clippy -D warnings, tsc, 43/43 vitest, notices current.
• Real ad-hoc-signed dmg built locally: otool -L lists Apple frameworks and /usr/lib only, codesign --verify --deep --strict green, hdiutil verify green, keychain round-trip green (0.17 s).
• actionlint clean, cargo fmt clean, scripts/outdated.sh all ok (14 media-engine tags, 8 Actions).

Reviewer notes

• Linux is untouched: the static tail and bundle-macos are Darwin-only; bundle/check run exactly as before apart from the shellcheck-driven mapfile rewrite of the apt install line.
• The release job uses permissions: contents: write, id-token: write, attestations: write — needed for draft creation and Sigstore attestations (repo is public, so the public-good Sigstore instance applies).
• Apple signing secrets are unset for now; the pipeline falls back to ad-hoc signing until you configure APPLE_CERTIFICATE etc.
• WORKLOG has the T-057 card + dated log entry; PL-110/PL-111 are closed in planned, PL-113 filed.

🤖 Generated with Claude Code