From c001809e866812272f4703f784363b18c0dff049 Mon Sep 17 00:00:00 2001
From: Kayshen-X <kayshen_xu@163.com>
Date: Thu, 9 Jul 2026 23:23:55 +0800
Subject: [PATCH] fix(release): stop publishing unsigned macOS desktop tarball

---
 .github/workflows/rust-release.yml      |  5 ++--
 RELEASE_NOTES/v0.8.0.md                 |  2 +-
 crates/op-host-web/tests/ci_workflow.rs | 34 +++++++++++++++++++++++++
 3 files changed, 38 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/rust-release.yml b/.github/workflows/rust-release.yml
index f3fe79543..2bbc399ca 100644
--- a/.github/workflows/rust-release.yml
+++ b/.github/workflows/rust-release.yml
@@ -16,7 +16,6 @@ name: Rust release artifacts
 #                                                Contents/MacOS; Developer ID
 #                                                signed/notarized when secrets
 #                                                exist, ad-hoc signed locally)
-#           openpencil-desktop-<label>.tar.gz    raw binary (kept)
 #           op-cli-<label>.tar.gz                standalone CLI
 #   Windows OpenPencil-<v>-<arch>-win-setup.exe  NSIS installer (Start-Menu +
 #                                                desktop shortcuts, HKCR
@@ -171,7 +170,9 @@ jobs:
         shell: bash
         run: |
           cd target/${{ matrix.target }}/release
-          tar czf ../../../openpencil-desktop-${{ matrix.label }}.tar.gz openpencil-desktop
+          if [ "$RUNNER_OS" != "macOS" ]; then
+            tar czf ../../../openpencil-desktop-${{ matrix.label }}.tar.gz openpencil-desktop
+          fi
           tar czf ../../../op-cli-${{ matrix.label }}.tar.gz op
       - name: Package archives (windows)
         if: matrix.archive == 'zip'
diff --git a/RELEASE_NOTES/v0.8.0.md b/RELEASE_NOTES/v0.8.0.md
index d0453cbce..6f7a65c4d 100644
--- a/RELEASE_NOTES/v0.8.0.md
+++ b/RELEASE_NOTES/v0.8.0.md
@@ -100,7 +100,7 @@ The release also partially covers several open issues, but they should stay open
 
 ## Release Artifacts
 
-- macOS: `OpenPencil-0.8.0-<arch>-mac.dmg`, plus raw desktop and `op` CLI archives.
+- macOS: notarized `OpenPencil-0.8.0-<arch>-mac.dmg` for the desktop app, plus standalone `op` CLI archives.
 - Windows: `OpenPencil-0.8.0-<arch>-win-setup.exe`, plus portable desktop and `op` CLI archives.
 - Linux: `OpenPencil-0.8.0-<arch>-linux.AppImage`, `OpenPencil-0.8.0-<arch>-linux.deb`, plus raw desktop and `op` CLI archives.
 - Web SDK: published npm packages and attached npm tarballs for the base SDK, React adapter, and Vue adapter.
diff --git a/crates/op-host-web/tests/ci_workflow.rs b/crates/op-host-web/tests/ci_workflow.rs
index 070803eae..b8d79ad26 100644
--- a/crates/op-host-web/tests/ci_workflow.rs
+++ b/crates/op-host-web/tests/ci_workflow.rs
@@ -143,6 +143,40 @@ fn release_workflow_notarizes_macos_app_before_packaging_dmg() {
     );
 }
 
+#[test]
+fn release_workflow_does_not_publish_unsigned_macos_desktop_tarball() {
+    let workflow = std::fs::read_to_string(concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/../../.github/workflows/rust-release.yml"
+    ))
+    .expect("rust-release workflow is readable");
+
+    assert!(
+        workflow.contains("if [ \"$RUNNER_OS\" != \"macOS\" ]; then\n            tar czf ../../../openpencil-desktop-${{ matrix.label }}.tar.gz openpencil-desktop"),
+        "macOS release artifacts should not include the raw desktop binary tarball because the signed/notarized desktop artifact is the DMG"
+    );
+    assert!(
+        workflow.contains("tar czf ../../../op-cli-${{ matrix.label }}.tar.gz op"),
+        "macOS and Linux release artifacts should keep publishing standalone op CLI archives"
+    );
+
+    let macos_block_start = workflow
+        .find("#   macOS")
+        .expect("workflow should document macOS artifacts");
+    let windows_block_start = workflow
+        .find("#   Windows")
+        .expect("workflow should document Windows artifacts");
+    let macos_block = &workflow[macos_block_start..windows_block_start];
+    assert!(
+        !macos_block.contains("openpencil-desktop-<label>.tar.gz"),
+        "release workflow comments should not document a macOS raw desktop tarball"
+    );
+    assert!(
+        macos_block.contains("op-cli-<label>.tar.gz"),
+        "release workflow comments should still document the macOS CLI archive"
+    );
+}
+
 #[test]
 fn macos_bundle_signing_uses_hardened_runtime_for_developer_id() {
     let script = std::fs::read_to_string(concat!(