fix(release): sign and verify macOS binaries

.changeset/brave-macos-signatures.md

@@ -0,0 +1,5 @@
+---
+"worktree-kit": patch
+---
+
+Ad-hoc sign and verify both macOS release binaries before publishing.

.github/workflows/release.yml

@@ -24,7 +24,10 @@ permissions:
 
 jobs:
   release:
-    runs-on: ubuntu-latest
+    # Darwin artifacts are ad-hoc signed and verified on the native arm64 runner
+    # before the draft release is created. A Linux cross-build cannot repair or
+    # validate the embedded Mach-O signatures produced by Bun.
+    runs-on: macos-15
     steps:
       - uses: actions/checkout@v6
         with:
@@ -42,7 +45,7 @@ jobs:
       # build-release.sh compiles the binaries with `bun build --compile`; bun must be on PATH.
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: 1.3.14
 
       - run: pnpm install --frozen-lockfile
 

scripts/build-release.sh

@@ -22,5 +22,16 @@ for entry in "${targets[@]}"; do
   bun build ./src/index.ts --compile --target="$target" --outfile "$DIST/$output"
 done
 
+# Bun cross-compilation can leave an invalid embedded Mach-O signature. Sign only
+# after every artifact's final bytes have been written. The release workflow runs
+# this script on macOS; non-macOS local builds remain useful for compilation checks
+# but are deliberately not publishable (release-publish.sh enforces verification).
+if [ "$(uname -s)" = "Darwin" ]; then
+  for artifact in "$DIST/wt-darwin-arm64" "$DIST/wt-darwin-x64"; do
+    echo "Ad-hoc signing $artifact..."
+    codesign --force --sign - "$artifact"
+  done
+fi
+
 echo "Built binaries for v$VERSION:"
 ls -la "$DIST"

scripts/release-publish.sh

@@ -62,6 +62,12 @@ rm -f "$view_err"
 echo "==> Building release binaries for $tag..."
 bash scripts/build-release.sh
 
+# This must complete before even the draft/tag is created. Both Darwin assets are
+# verified, then the one matching this macOS runner is executed natively. Keeping
+# this gate here (rather than after upload) makes an invalid or non-launching binary
+# incapable of reaching the final `--draft=false` transition.
+bash scripts/verify-release.sh
+
 # Confirm the build actually produced the platform binaries before creating a release around them;
 # otherwise `gh release upload dist/wt-*` would pass an unexpanded glob straight to the API.
 shopt -s nullglob

scripts/verify-release.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+DIST="${1:-dist}"
+
+if [ "$(uname -s)" != "Darwin" ]; then
+  echo "ERROR: release verification requires macOS so codesign and a native Darwin smoke test can run." >&2
+  exit 1
+fi
+
+for artifact in "$DIST/wt-darwin-arm64" "$DIST/wt-darwin-x64"; do
+  [ -f "$artifact" ] || { echo "ERROR: missing release artifact: $artifact" >&2; exit 1; }
+  echo "Verifying signature: $artifact"
+  codesign --verify --strict --verbose=4 "$artifact"
+done
+
+case "$(uname -m)" in
+  arm64) native="$DIST/wt-darwin-arm64" ;;
+  x86_64) native="$DIST/wt-darwin-x64" ;;
+  *)
+    echo "ERROR: unsupported macOS runner architecture: $(uname -m)" >&2
+    exit 1
+    ;;
+esac
+
+echo "Smoke testing native artifact: $native"
+"$native" --version
+"$native" --help >/dev/null