Release: notarize standalone macOS CLI zip artifact

Author: crisdosaygo

.github/workflows/release.yml

@@ -237,6 +237,9 @@ jobs:
           codesign --force --timestamp --identifier "$MACOS_BUNDLE_ID" \
             --options runtime --sign "$IDENTITY" "$BINARY"
 
+          # Package standalone CLI binary for direct download.
+          ditto -c -k --sequesterRsrc --keepParent "$BINARY" "$DIST/fips-pad-macos-universal.zip"
+
           # Create .app bundle
           APP_DIR="$DIST/FIPSPad.app/Contents"
           mkdir -p "$APP_DIR/MacOS" "$APP_DIR/Resources"
@@ -295,6 +298,14 @@ jobs:
           # Notarize
           if [ -n "${NOTARY_API_KEY_P8_B64:-}" ]; then
             echo "$NOTARY_API_KEY_P8_B64" | base64 --decode > "$RUNNER_TEMP/authkey.p8"
+
+            # Notarize standalone CLI binary distribution zip.
+            xcrun notarytool submit "$DIST/fips-pad-macos-universal.zip" \
+              --key "$RUNNER_TEMP/authkey.p8" \
+              --key-id "$NOTARY_API_KEY_ID" \
+              --issuer "$NOTARY_API_KEY_ISSUER" \
+              --wait
+
             xcrun notarytool submit "$DIST/fipspad_darwin_universal.pkg" \
               --key "$RUNNER_TEMP/authkey.p8" \
               --key-id "$NOTARY_API_KEY_ID" \
@@ -305,14 +316,15 @@ jobs:
 
           # Checksums
           cp "$BINARY" "$DIST/fips-pad"
-          (cd "$DIST" && shasum -a 256 "fips-pad" "fipspad_darwin_universal.pkg" > "SHA256SUMS_darwin_universal.txt")
+          (cd "$DIST" && shasum -a 256 "fips-pad" "fips-pad-macos-universal.zip" "fipspad_darwin_universal.pkg" > "SHA256SUMS_darwin_universal.txt")
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with:
           name: macos-universal
           path: |
             dist/fips-pad
+            dist/fips-pad-macos-universal.zip
             dist/fipspad_darwin_universal.pkg
             dist/SHA256SUMS_darwin_universal.txt
 
@@ -457,7 +469,8 @@ jobs:
 
           Attached artifacts:
 
-          - `fips-pad` — Raw macOS universal CLI binary (Developer ID signed when credentials are configured; ad-hoc signed otherwise).
+          - `fips-pad` — Raw macOS universal CLI binary (signed).
+          - `fips-pad-macos-universal.zip` — Standalone macOS binary package submitted to Apple notarization when credentials are configured.
           - `fipspad_darwin_universal.pkg` — macOS installer package (signed/notarized when credentials are configured).
           - `fipspad_linux_amd64` — Linux amd64 binary.
           - `fipspad_windows_amd64.exe` — Windows amd64 executable (signed when credentials are configured).