fix(release): publish unsigned macOS DMG fallback

Root cause: the macOS Tauri build already generated bundle/dmg/CCSwitchMulti_*_universal.dmg without Apple signing secrets, but Prepare macOS Assets exited as soon as APPLE_SIGNING_IDENTITY was empty. That made the release succeed while omitting the macOS DMG asset.

Fix: when Apple signing is unavailable, locate the Tauri-generated DMG, copy it to release-assets with the standard macOS DMG release filename, and fail the macOS job if no unsigned DMG exists. Signed Apple releases still use the create-dmg plus notarization path.

Release: bump CCSwitchMulti to v3.16.4-10, add Chinese release notes, update the GitHub release body to disclose unsigned DMG behavior, and record the invariant in project memory.

Validation: pnpm exec prettier --check release workflow/version docs/memory; pnpm typecheck; cargo metadata reports 3.16.4-10; pnpm dlx js-yaml parses release.yml; git diff --cached --check passed. actionlint is not installed on this host and Go is unavailable for go-run actionlint.

Author: BigStrongSun

.github/workflows/release.yml

@@ -391,16 +391,32 @@ jobs:
           ditto -c -k --sequesterRsrc --keepParent "$APP_PATH" "release-assets/$NEW_ZIP"
           echo "macOS zip ready: $NEW_ZIP"
 
-          # 3) Create styled DMG only when signing identity is available.
-          # Fork repos often lack Apple signing secrets; in that case still ship
-          # the updater tarball and zip instead of failing the whole release.
+          # 3) 收集 DMG。没有 Apple 签名时，发布 Tauri 已生成的未签名 DMG，
+          # 避免工作流成功但 Release 静默缺少 macOS DMG。
+          NEW_DMG="CC-Switch-${VERSION}-macOS.dmg"
           if [ -z "${APPLE_SIGNING_IDENTITY:-}" ]; then
-            echo "⚠️ APPLE_SIGNING_IDENTITY is missing; skipping macOS DMG packaging and notarization"
+            DMG_PATH=""
+            for path in \
+              "src-tauri/target/universal-apple-darwin/release/bundle/dmg" \
+              "src-tauri/target/aarch64-apple-darwin/release/bundle/dmg" \
+              "src-tauri/target/x86_64-apple-darwin/release/bundle/dmg" \
+              "src-tauri/target/release/bundle/dmg"; do
+              if [ -d "$path" ]; then
+                [ -z "$DMG_PATH" ] && DMG_PATH=$(find "$path" -maxdepth 1 -name "*.dmg" -type f | head -1 || true)
+              fi
+            done
+
+            if [ -z "$DMG_PATH" ]; then
+              echo "❌ APPLE_SIGNING_IDENTITY is missing and no unsigned macOS .dmg artifact was found" >&2
+              exit 1
+            fi
+
+            cp "$DMG_PATH" "release-assets/$NEW_DMG"
+            echo "⚠️ APPLE_SIGNING_IDENTITY is missing; publishing unsigned macOS DMG: $NEW_DMG"
             exit 0
           fi
 
           HOMEBREW_NO_AUTO_UPDATE=1 brew install create-dmg
-          NEW_DMG="CC-Switch-${VERSION}-macOS.dmg"
           DMG_STAGE_DIR="$RUNNER_TEMP/dmg-stage"
           rm -rf "$DMG_STAGE_DIR"
           mkdir -p "$DMG_STAGE_DIR"
@@ -720,7 +736,7 @@ jobs:
 
             ### 下载
 
-            - **macOS**: `CC-Switch-${{ github.ref_name }}-macOS.dmg`（推荐）或 `CC-Switch-${{ github.ref_name }}-macOS.zip`（解压即用）
+            - **macOS**: `CC-Switch-${{ github.ref_name }}-macOS.dmg`（未配置 Apple 签名时为未签名版）或 `CC-Switch-${{ github.ref_name }}-macOS.zip`（解压即用）
             - **Windows (x86_64)**: `CC-Switch-${{ github.ref_name }}-Windows-Setup.exe`（安装版）或 `CC-Switch-${{ github.ref_name }}-Windows-Portable.zip`（绿色版）
             - **Windows (ARM64)**: `CC-Switch-${{ github.ref_name }}-Windows-arm64-Setup.exe`（安装版）或 `CC-Switch-${{ github.ref_name }}-Windows-arm64-Portable.zip`（绿色版）
             - **Linux (x86_64)**: `CC-Switch-${{ github.ref_name }}-Linux-x86_64.AppImage` / `.deb` / `.rpm`
@@ -729,7 +745,7 @@ jobs:
             > `.tar.gz` 为 Tauri updater 自动更新专用，无需手动下载。
 
             ---
-            macOS DMG 仅在仓库配置 Apple 签名和公证密钥时生成；未配置时发布 updater tarball 和 app zip。
+            macOS DMG 在仓库配置 Apple 签名和公证密钥时会签名并公证；未配置时发布 Tauri 生成的未签名 DMG、updater tarball 和 app zip。
           files: release-assets/*
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

docs/release-notes/v3.16.4-10-zh.md

@@ -0,0 +1,14 @@
+# CCSwitchMulti v3.16.4-10 发布说明
+
+本版本继续补齐 GitHub Release 的 macOS 资产发布链路。
+
+## 修复
+
+- macOS Release 在没有 Apple Developer ID 签名和公证凭据时，也会上传 Tauri 已生成的未签名 DMG：`CC-Switch-v3.16.4-10-macOS.dmg`。
+- 无签名路径不再静默跳过 DMG。如果 Tauri 没有生成 `.dmg`，macOS job 会直接失败，避免出现 GitHub Release 成功但缺少 macOS DMG 的状态。
+- GitHub Release 下载说明同步标注：macOS DMG 在缺少 Apple 签名配置时是未签名版本；后续补齐 Apple secrets 后会自动切换为签名和公证版本。
+
+## 验证
+
+- `v3.16.4-9` 已验证 Linux、Windows x64、Windows ARM64、macOS universal build、正式 Release 和 `latest.json` 全链路成功。
+- 本版本用于验证 macOS 未签名 DMG 也能进入 Release 资产列表，同时保留 updater 使用的 universal `macOS.tar.gz`。

memory.md

@@ -1,5 +1,12 @@
 # CC Switch Repository Memory
 
+## 2026-07-03 macOS Unsigned DMG Release Fallback
+
+- `v3.16.4-9` 的 GitHub macOS job 已证明 Tauri 会在 `pnpm tauri build --target universal-apple-darwin` 阶段生成 `src-tauri/target/universal-apple-darwin/release/bundle/dmg/CCSwitchMulti_*_universal.dmg`，即使仓库缺少 Apple 签名和公证 secrets。
+- 真实缺口在 `Prepare macOS Assets`：旧逻辑在 `APPLE_SIGNING_IDENTITY` 为空时只上传 updater tarball 和 app zip，然后 `exit 0`，导致 Release 成功但没有 macOS DMG。
+- 修复边界：无 Apple 签名时也必须把 Tauri 生成的 unsigned DMG 复制为 `CC-Switch-${tag}-macOS.dmg` 并上传；如果无签名且找不到 `.dmg`，macOS job 应失败而不是静默缺资产。Apple secrets 齐全时仍走 `create-dmg` 的签名/公证路径。
+- Release 文案必须明确：缺 Apple 签名配置时 macOS DMG 是未签名版本；补齐 Apple Developer ID 证书和 notarization secrets 后，同一 workflow 会自动发布签名并公证的 DMG。
+
 ## 2026-07-03 CCSwitchMulti v3.16.4-9 GitHub Release Verification
 
 - `v3.16.4-9` 已推到 `BigStrongSun/ccswitchmulti` 并通过 GitHub Actions release run `28610511658`，head sha 为 `0e8b25cdd0cbfe8e2bff054b46850ce1c5215c0e`。该 run 覆盖 Linux x64、Linux ARM64、Windows x64、Windows ARM64、macOS universal、Publish GitHub Release 和 Assemble `latest.json`，全部成功。

package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-switch-multi",
-  "version": "3.16.4-9",
+  "version": "3.16.4-10",
   "description": "All-in-One Assistant for Claude Code, Codex & Gemini CLI",
   "type": "module",
   "scripts": {

src-tauri/Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "cc-switch"
-version = "3.16.4-9"
+version = "3.16.4-10"
 description = "All-in-One Assistant for Claude Code, Codex & Gemini CLI"
 authors = ["Jason Young"]
 license = "MIT"

src-tauri/Cargo.toml

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "CCSwitchMulti",
-  "version": "3.16.4-9",
+  "version": "3.16.4-10",
   "identifier": "com.ccswitchmulti.desktop",
   "build": {
     "frontendDist": "../dist",