spb/metrika Public

1#!/bin/bash2#3#  release.sh — Metrika4#  Author:  Simon-Pierre Boucher5#  Contact: contact@spboucher.ai6#  Copyright © 2026 Simon-Pierre Boucher. All rights reserved.7#8#  Release pipeline (CLAUDE.md §10): archive → export → verify → DMG →9#  sign → notarize → staple. The team ID and keychain-profile NAME are10#  configuration, not credentials — the actual Apple ID and app-specific11#  password live only in the login keychain (stored once via12#  `xcrun notarytool store-credentials "MacLustr-Notarize"`).13#14set -euo pipefail1516APP="Metrika"17SCHEME="Metrika"18BUILD_DIR="build"19DMG="${APP}.dmg"20TEAM_ID="3YM54G49SN"21NOTARY_PROFILE="MacLustr-Notarize"22SIGN_IDENTITY="Developer ID Application: Simon-Pierre Boucher (${TEAM_ID})"2324cd "$(dirname "$0")/.."25rm -rf "$BUILD_DIR" "$DMG"2627# 0. Regenerate the Xcode project and the icon from their sources.28xcodegen generate29./scripts/make_icns.sh3031# 1. Archive (Developer ID signing; mlx-swift needs the plugin skip).32xcodebuild -project "$APP.xcodeproj" -scheme "$SCHEME" \33  -configuration Release -arch arm64 \34  -archivePath "$BUILD_DIR/$APP.xcarchive" \35  -skipPackagePluginValidation \36  DEVELOPMENT_TEAM="$TEAM_ID" \37  CODE_SIGN_IDENTITY="$SIGN_IDENTITY" \38  CODE_SIGN_STYLE=Manual \39  OTHER_CODE_SIGN_FLAGS="--timestamp --options runtime" \40  archive4142# 2. Export with Developer ID43xcodebuild -exportArchive \44  -archivePath "$BUILD_DIR/$APP.xcarchive" \45  -exportOptionsPlist scripts/ExportOptions.plist \46  -exportPath "$BUILD_DIR/export"4748# 3. Verify hardened runtime + entitlements49codesign -dv --verbose=4 "$BUILD_DIR/export/$APP.app"50codesign --verify --deep --strict "$BUILD_DIR/export/$APP.app"5152# 4. Build DMG (create-dmg, background art in Assets/DMG/). Stage only53#    the .app — the export folder also contains packaging logs that must54#    not ship inside the image.55STAGE="$BUILD_DIR/dmg-stage"56rm -rf "$STAGE" && mkdir -p "$STAGE"57cp -R "$BUILD_DIR/export/$APP.app" "$STAGE/"58create-dmg \59  --volname "$APP" \60  --window-size 540 380 \61  --icon-size 128 \62  --icon "$APP.app" 130 190 \63  --app-drop-link 400 190 \64  --background "Assets/DMG/background.png" \65  --no-internet-enable \66  "$DMG" "$STAGE/"6768# 5. Sign the DMG itself69codesign --sign "$SIGN_IDENTITY" --timestamp "$DMG"7071# 6. Notarize & wait72xcrun notarytool submit "$DMG" \73  --keychain-profile "$NOTARY_PROFILE" \74  --wait7576# 7. Staple77xcrun stapler staple "$DMG"78xcrun stapler validate "$DMG"7980echo "✅ $DMG notarized and stapled."81