feat: add macOS notarization to electron-builder pipeline

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: JoeCowles

.github/workflows/electron-build.yml

@@ -91,6 +91,9 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CSC_LINK: ${{ secrets.MAC_CERT_P12_BASE64 }}
           CSC_KEY_PASSWORD: ${{ secrets.MAC_CERT_PASSWORD }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
 
       - name: Build installer — local artifact only
         if: "!startsWith(github.ref, 'refs/tags/') && inputs.publish != 'true'"
@@ -99,6 +102,9 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CSC_LINK: ${{ secrets.MAC_CERT_P12_BASE64 }}
           CSC_KEY_PASSWORD: ${{ secrets.MAC_CERT_PASSWORD }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
 
       # ── Upload build artifacts ─────────────────────────────────────────────
       - name: Upload installer artifact

electron-builder.config.js

@@ -6,6 +6,7 @@ module.exports = {
   appId: 'com.podcommentators.app',
   productName: 'Podcommentators',
   copyright: 'Copyright © 2025 Podcommentators',
+  afterSign: 'electron/notarize.js',
 
   // Where electron-builder looks for the compiled main process JS
   directories: {

electron/notarize.js

@@ -0,0 +1,25 @@
+const { notarize } = require('@electron/notarize');
+
+exports.default = async function notarizing(context) {
+  const { electronPlatformName, appOutDir } = context;
+  if (electronPlatformName !== 'darwin') return;
+
+  if (!process.env.APPLE_ID || !process.env.APPLE_ID_PASSWORD || !process.env.APPLE_TEAM_ID) {
+    console.log('Skipping notarization — APPLE_ID, APPLE_ID_PASSWORD, or APPLE_TEAM_ID not set');
+    return;
+  }
+
+  const appName = context.packager.appInfo.productFilename;
+
+  console.log(`Notarizing ${appName}...`);
+
+  await notarize({
+    appBundleId: 'com.podcommentators.app',
+    appPath: `${appOutDir}/${appName}.app`,
+    appleId: process.env.APPLE_ID,
+    appleIdPassword: process.env.APPLE_ID_PASSWORD,
+    teamId: process.env.APPLE_TEAM_ID,
+  });
+
+  console.log('Notarization complete');
+};