Try this

Author: blopker

.github/workflows/build.yml

@@ -1,16 +1,74 @@
-name: "publish"
+name: "build"
+
+# Single workflow for both CI builds and releases so the two can't diverge.
+#
+# - `build` job runs on every push that ISN'T a release: build + test the
+#   universal macOS app and upload the artifacts to the workflow run. Unsigned,
+#   and runs with a read-only token (no signing secrets).
+# - `release` job runs ONLY on the `release` branch (created by `make release`):
+#   it gets a `contents: write` token, imports the Apple Developer certificate,
+#   notarizes, and creates a draft GitHub release.
+#
+# The two jobs are mutually exclusive (one runs per push) and share the same
+# setup steps so they stay in sync while keeping least-privilege separation.
 
 on:
   push:
 
+# Least privilege by default; only the release job opts up to contents: write.
+permissions:
+  contents: read
+
 jobs:
   build:
+    if: github.ref != 'refs/heads/release'
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: aarch64-apple-darwin,x86_64-apple-darwin
+
+      - name: Rust cache
+        uses: swatinem/rust-cache@v2
+        with:
+          workspaces: "./src-tauri -> target"
+          cache-on-failure: true
+
+      - name: install frontend dependencies
+        run: bun install --frozen-lockfile
+
+      - name: test cargo build
+        run: cd src-tauri && cargo test
+
+      - name: build universal app (unsigned)
+        uses: tauri-apps/tauri-action@v0.6.2
+        env:
+          # CI=false so tauri's DMG bundler renders the background image correctly
+          # (CI=true causes hdiutil to skip the background/icon layout stage)
+          # See: https://github.com/tauri-apps/tauri-action/issues/740
+          CI: false
+        with:
+          args: --target universal-apple-darwin
+          uploadWorkflowArtifacts: true
+
+  release:
+    if: github.ref == 'refs/heads/release'
     permissions:
       contents: write
-
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - uses: oven-sh/setup-bun@v2
         with:
@@ -19,7 +77,7 @@ jobs:
       - name: install Rust stable
         uses: dtolnay/rust-toolchain@stable
         with:
-          targets: aarch64-apple-darwin
+          targets: aarch64-apple-darwin,x86_64-apple-darwin
 
       - name: Rust cache
         uses: swatinem/rust-cache@v2
@@ -33,14 +91,56 @@ jobs:
       - name: test cargo build
         run: cd src-tauri && cargo test
 
-      - uses: tauri-apps/tauri-action@v0
+      - name: import Apple Developer Certificate
+        # Prevents keychain from locking automatically for 3600 seconds.
         env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+        run: |
+          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
+          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
+          security default-keychain -s build.keychain
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
+          security set-keychain-settings -t 3600 -u build.keychain
+          security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
+          security find-identity -v -p codesigning build.keychain
+
+      - name: verify certificate
+        run: |
+          CERT_INFO=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID Application")
+          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
+          echo "CERT_ID=$CERT_ID" >> $GITHUB_ENV
+          echo "Certificate imported."
+
+      - name: build and publish a draft release
+        uses: tauri-apps/tauri-action@v0.6.2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ env.CERT_ID }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
           # CI=false so tauri's DMG bundler renders the background image correctly
           # (CI=true causes hdiutil to skip the background/icon layout stage)
           # See: https://github.com/tauri-apps/tauri-action/issues/740
           CI: false
         with:
-          args: --target universal-apple-darwin
+          tagName: app-v__VERSION__ # the action automatically replaces __VERSION__ with the app version.
+          releaseName: "App v__VERSION__"
+          releaseBody: |
+            See the assets to download this version and install.
+
+            Use `Alic.Image.Compressor___VERSION___universal.dmg` for both Apple Silicon and Intel Macs.
+
+            [Changelog](https://github.com/blopker/alic/blob/main/CHANGELOG.md)
+          releaseDraft: true
+          prerelease: false
           uploadWorkflowArtifacts: true
+          args: --target universal-apple-darwin