fix: harden macOS 1.78 release quality

.github/workflows/ci.yml

@@ -18,7 +18,7 @@ jobs:
         include:
           - platform: 'ubuntu-22.04'
           - platform: 'windows-latest'
-          - platform: 'macos-latest'
+          - platform: 'macos-26'
 
     runs-on: ${{ matrix.platform }}
     defaults:
@@ -37,7 +37,7 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
 
       - name: Install Rust targets (macOS universal)
-        if: matrix.platform == 'macos-latest'
+        if: matrix.platform == 'macos-26'
         run: rustup target add aarch64-apple-darwin x86_64-apple-darwin
 
       - name: Install dependencies (Ubuntu only)
@@ -47,7 +47,13 @@ jobs:
           sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
 
       - name: Install frontend dependencies
-        run: npm install
+        run: npm ci
+
+      - name: Run quality regression tests
+        run: npm run test:quality
+
+      - name: Prepare native runtime
+        run: npm run prepare:native-runtime
 
       - name: Run unit tests
         run: npm run test:unit
@@ -76,7 +82,7 @@ jobs:
           cp target/release/pdfium-worker open-pdf-studio/src-tauri/binaries/pdfium-worker-x86_64-unknown-linux-gnu
 
       - name: Build pdfium-worker sidecar (macOS universal)
-        if: matrix.platform == 'macos-latest'
+        if: matrix.platform == 'macos-26'
         working-directory: .
         run: |
           cargo build --release -p pdfium-worker --target aarch64-apple-darwin
@@ -90,13 +96,19 @@ jobs:
             target/aarch64-apple-darwin/release/pdfium-worker \
             target/x86_64-apple-darwin/release/pdfium-worker
 
-      - name: Fetch libpdfium.dylib (macOS)
-        if: matrix.platform == 'macos-latest'
-        run: |
-          mkdir -p src-tauri/binaries/macos-universal
-          curl -L "https://github.com/bblanchon/pdfium-binaries/releases/download/chromium%2F7834/pdfium-mac-univ.tgz" -o /tmp/pdfium-mac.tgz
-          tar xzf /tmp/pdfium-mac.tgz -C /tmp lib/libpdfium.dylib
-          cp /tmp/lib/libpdfium.dylib src-tauri/binaries/macos-universal/libpdfium.dylib
-
       - name: Build Tauri app
+        if: matrix.platform != 'macos-26'
         run: npm run tauri build -- --no-bundle
+
+      - name: Build ad-hoc signed macOS app
+        if: matrix.platform == 'macos-26'
+        env:
+          APPLE_SIGNING_IDENTITY: '-'
+        run: npm run tauri build -- --target universal-apple-darwin --bundles app --config '{"bundle":{"createUpdaterArtifacts":false}}'
+
+      - name: Verify and launch macOS app
+        if: matrix.platform == 'macos-26'
+        run: |
+          APP_PATH="../target/universal-apple-darwin/release/bundle/macos/Open PDF Studio.app"
+          codesign --verify --deep --strict --verbose=2 "$APP_PATH"
+          bash scripts/macos-startup-smoke.sh "$APP_PATH"

.github/workflows/nightly.yml

@@ -92,7 +92,7 @@ jobs:
           - platform: 'ubuntu-22.04'
             args: ''
             target: 'linux'
-          - platform: 'macos-latest'
+          - platform: 'macos-26'
             args: '--target universal-apple-darwin'
             target: 'macos'
           - platform: 'windows-latest'
@@ -136,7 +136,7 @@ jobs:
           sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
 
       - name: Install frontend dependencies
-        run: npm install
+        run: npm ci
 
       # The PDFium worker pool runs as a Tauri sidecar (bundle.externalBin).
       # Tauri requires binaries/pdfium-worker-<target-triple> to exist at build
@@ -199,14 +199,9 @@ jobs:
       # verwijst naar binaries/macos-universal/libpdfium.dylib. Universal
       # (arm64+x86_64) via bblanchon/pdfium-binaries (zelfde chromium-release als
       # Linux/Windows), met SHA-256-verificatie.
-      - name: Fetch libpdfium.dylib (macOS)
+      - name: Prepare libpdfium.dylib (macOS)
         if: matrix.target == 'macos'
-        run: |
-          mkdir -p src-tauri/binaries/macos-universal
-          curl -L "https://github.com/bblanchon/pdfium-binaries/releases/download/chromium%2F7834/pdfium-mac-univ.tgz" -o /tmp/pdfium-mac.tgz
-          echo "659e2f647ffd667b36487375165563e58f961db9cf75a45104dc59b9407ccbdf  /tmp/pdfium-mac.tgz" | shasum -a 256 -c -
-          tar xzf /tmp/pdfium-mac.tgz -C /tmp lib/libpdfium.dylib
-          cp /tmp/lib/libpdfium.dylib src-tauri/binaries/macos-universal/libpdfium.dylib
+        run: npm run prepare:native-runtime
 
       - name: Build Tauri app
         if: matrix.target != 'windows-user'
@@ -227,6 +222,18 @@ jobs:
           releaseId: ${{ needs.prepare-release.outputs.release_id }}
           includeUpdaterJson: false
 
+      - name: Verify macOS signature and notarization
+        if: matrix.target == 'macos'
+        run: |
+          APP_PATH="../target/universal-apple-darwin/release/bundle/macos/Open PDF Studio.app"
+          DMG_PATH="$(find ../target/universal-apple-darwin/release/bundle/dmg -name '*.dmg' -print -quit)"
+          test -n "$DMG_PATH"
+          codesign --verify --deep --strict --verbose=2 "$APP_PATH"
+          spctl --assess --type execute --verbose=4 "$APP_PATH"
+          xcrun stapler validate "$APP_PATH"
+          xcrun stapler validate "$DMG_PATH"
+          bash scripts/macos-startup-smoke.sh "$APP_PATH"
+
       - name: Build Tauri app (Windows user installer)
         if: matrix.target == 'windows-user'
         uses: tauri-apps/tauri-action@action-v0.6.1

.github/workflows/release.yml

@@ -9,7 +9,7 @@ on:
       version:
         description: 'Version tag (e.g., v1.0.0)'
         required: true
-        default: 'v1.71.0'
+        default: 'v1.78.0'
 
 jobs:
   create-release:
@@ -64,7 +64,7 @@ jobs:
           - platform: 'ubuntu-22.04'
             args: ''
             target: 'linux'
-          - platform: 'macos-latest'
+          - platform: 'macos-26'
             args: '--target universal-apple-darwin'
             target: 'macos'
           - platform: 'windows-latest'
@@ -104,7 +104,7 @@ jobs:
           sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
 
       - name: Install frontend dependencies
-        run: npm install
+        run: npm ci
 
       # The PDFium worker pool runs as a Tauri sidecar (bundle.externalBin).
       # Tauri requires binaries/pdfium-worker-<target-triple> to exist at
@@ -181,14 +181,9 @@ jobs:
       # via bblanchon/pdfium-binaries (zelfde chromium-release als de Linux-
       # .so en de win-x64 pdfium.dll), met SHA-256-verificatie zodat een
       # gewijzigde upstream-asset de build laat falen i.p.v. stil door te gaan.
-      - name: Fetch libpdfium.dylib (macOS)
+      - name: Prepare libpdfium.dylib (macOS)
         if: matrix.target == 'macos'
-        run: |
-          mkdir -p src-tauri/binaries/macos-universal
-          curl -L "https://github.com/bblanchon/pdfium-binaries/releases/download/chromium%2F7834/pdfium-mac-univ.tgz" -o /tmp/pdfium-mac.tgz
-          echo "659e2f647ffd667b36487375165563e58f961db9cf75a45104dc59b9407ccbdf  /tmp/pdfium-mac.tgz" | shasum -a 256 -c -
-          tar xzf /tmp/pdfium-mac.tgz -C /tmp lib/libpdfium.dylib
-          cp /tmp/lib/libpdfium.dylib src-tauri/binaries/macos-universal/libpdfium.dylib
+        run: npm run prepare:native-runtime
 
       - name: Set user install mode
         if: matrix.target == 'windows-user'
@@ -232,6 +227,18 @@ jobs:
           releaseId: ${{ needs.create-release.outputs.release_id }}
           includeUpdaterJson: true
 
+      - name: Verify macOS signature and notarization
+        if: matrix.target == 'macos'
+        run: |
+          APP_PATH="../target/universal-apple-darwin/release/bundle/macos/Open PDF Studio.app"
+          DMG_PATH="$(find ../target/universal-apple-darwin/release/bundle/dmg -name '*.dmg' -print -quit)"
+          test -n "$DMG_PATH"
+          codesign --verify --deep --strict --verbose=2 "$APP_PATH"
+          spctl --assess --type execute --verbose=4 "$APP_PATH"
+          xcrun stapler validate "$APP_PATH"
+          xcrun stapler validate "$DMG_PATH"
+          bash scripts/macos-startup-smoke.sh "$APP_PATH"
+
       - name: Build Tauri app (user installer)
         if: matrix.target == 'windows-user'
         uses: tauri-apps/tauri-action@action-v0.6.1