From 6bb46f959367f15b2da6f13cf0b9520c638a3bf4 Mon Sep 17 00:00:00 2001
From: tukuyomil032 <yinkom0708@gmail.com>
Date: Fri, 5 Jun 2026 15:59:25 +0900
Subject: [PATCH 1/2] fix: remove broken ad-hoc codesign, derive arm64 from
 universal, add DerivedData cache

- Remove codesign --force --deep from Create DMGs: was creating invalid signature causing 'damaged' Gatekeeper error on macOS Sequoia even after quarantine removal
- Remove separate arm64 xcodebuild archive: derive arm64 via lipo -thin from universal instead (same approach as x86_64), halving total compile time ~12min -> ~6min
- Add DerivedData cache for Release builds (separate key from Debug CI)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 42 +++++++++++++++--------------------
 1 file changed, 18 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d7d8932..7526f9c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,6 +24,14 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Cache DerivedData (Release)
+        uses: actions/cache@v4
+        with:
+          path: ~/Library/Developer/Xcode/DerivedData
+          key: ${{ runner.os }}-derived-data-release-${{ hashFiles('perch.xcodeproj/project.pbxproj') }}
+          restore-keys: |
+            ${{ runner.os }}-derived-data-release-
+
       - name: Resolve version
         id: version
         run: |
@@ -47,24 +55,6 @@ jobs:
           echo "is_beta=$IS_BETA"           >> "$GITHUB_OUTPUT"
           echo "bundle_name=$BUNDLE_NAME"   >> "$GITHUB_OUTPUT"
 
-      - name: Build arm64 archive
-        run: |
-          set -o pipefail
-          xcodebuild archive \
-            -scheme "$SCHEME" \
-            -configuration Release \
-            -archivePath build/$APP_NAME-arm64.xcarchive \
-            -destination 'generic/platform=macOS' \
-            -skipPackagePluginValidation \
-            -skipMacroValidation \
-            ARCHS=arm64 \
-            ONLY_ACTIVE_ARCH=NO \
-            CODE_SIGN_IDENTITY="-" \
-            CODE_SIGNING_REQUIRED=NO \
-            CODE_SIGNING_ALLOWED=NO \
-            MARKETING_VERSION="${{ steps.version.outputs.base_version }}" \
-            SKIP_INSTALL=NO 2>&1 | tail -100
-
       - name: Build universal archive
         run: |
           set -o pipefail
@@ -83,6 +73,16 @@ jobs:
             MARKETING_VERSION="${{ steps.version.outputs.base_version }}" \
             SKIP_INSTALL=NO 2>&1 | tail -100
 
+      - name: Create arm64 archive from universal (lipo thin)
+        run: |
+          cp -Rp "build/$APP_NAME-universal.xcarchive" "build/$APP_NAME-arm64.xcarchive"
+          find "build/$APP_NAME-arm64.xcarchive/Products" -type f | while read f; do
+            if file "$f" | grep -q "Mach-O universal binary"; then
+              lipo "$f" -thin arm64 -output "$f"
+            fi
+          done
+          echo "Created arm64 archive from universal via lipo"
+
       - name: Create x86_64 archive from universal (lipo thin)
         run: |
           cp -Rp "build/$APP_NAME-universal.xcarchive" "build/$APP_NAME-x86_64.xcarchive"
@@ -116,12 +116,6 @@ jobs:
             mkdir -p "$STAGING"
             cp -R "$APP" "$STAGING/${BUNDLE_NAME}.app"
 
-            codesign --force --deep --sign - --timestamp=none "$STAGING/${BUNDLE_NAME}.app"
-            codesign --verify --deep --strict --verbose=4 "$STAGING/${BUNDLE_NAME}.app"
-            if ! spctl --assess --type execute --verbose=4 "$STAGING/${BUNDLE_NAME}.app"; then
-              echo "::warning::spctl rejected ad-hoc signed app for ${ARCH}; continuing."
-            fi
-
             hdiutil create \
               -volname "Perch" \
               -srcfolder "$STAGING" \

From 67f97c4f3727d8f9250b30f754c9c370be3f1f44 Mon Sep 17 00:00:00 2001
From: tukuyomi032 <118542180+tukuyomil032@users.noreply.github.com>
Date: Fri, 5 Jun 2026 16:14:37 +0900
Subject: [PATCH 2/2] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7526f9c..39dfbd0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -75,9 +75,9 @@ jobs:
 
       - name: Create arm64 archive from universal (lipo thin)
         run: |
+          set -euo pipefail
           cp -Rp "build/$APP_NAME-universal.xcarchive" "build/$APP_NAME-arm64.xcarchive"
           find "build/$APP_NAME-arm64.xcarchive/Products" -type f | while read f; do
-            if file "$f" | grep -q "Mach-O universal binary"; then
               lipo "$f" -thin arm64 -output "$f"
             fi
           done