ci(release): optional macOS arm64-only (M-series) workflow dispatch

- configure job builds dynamic matrix; dispatch can target Apple Silicon only
- skip dual-arch YAML merge when only arm64 artifacts exist
- publish GitHub assets with release-assets/* for partial matrices
- docs: M-series dispatch + local bun run dist:desktop:dmg:arm64
- marketing download: label M-series / Apple Silicon

Made-with: Cursor

Author: BunsDev

.github/workflows/release.yml

@@ -10,12 +10,49 @@ on:
         description: "Release version (for example 1.2.3 or v1.2.3)"
         required: true
         type: string
+      mac_arm64_only:
+        description: "Apple Silicon (M-series) Mac only — build and publish only the macOS arm64 DMG (skip Intel Mac, Linux, Windows). Ignored when releasing via tag push."
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   contents: write
   id-token: write
 
 jobs:
+  configure:
+    name: Configure build matrix
+    runs-on: ubuntu-24.04
+    outputs:
+      matrix: ${{ steps.set.outputs.matrix }}
+      mac_arm64_only: ${{ steps.set.outputs.mac_arm64_only }}
+    steps:
+      - id: set
+        name: Select desktop targets
+        shell: bash
+        run: |
+          set -euo pipefail
+          mac_arm64_only="false"
+          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
+            input="${{ github.event.inputs.mac_arm64_only }}"
+            if [[ "$input" == "true" ]]; then
+              mac_arm64_only="true"
+            fi
+          fi
+          echo "mac_arm64_only=$mac_arm64_only" >> "$GITHUB_OUTPUT"
+
+          if [[ "$mac_arm64_only" == "true" ]]; then
+            matrix_json='[{"label":"macOS arm64","runner":"macos-14","platform":"mac","target":"dmg","arch":"arm64"}]'
+          else
+            matrix_json='[{"label":"macOS arm64","runner":"macos-14","platform":"mac","target":"dmg","arch":"arm64"},{"label":"macOS x64","runner":"macos-15-intel","platform":"mac","target":"dmg","arch":"x64"},{"label":"Linux x64","runner":"ubuntu-24.04","platform":"linux","target":"AppImage","arch":"x64"},{"label":"Windows x64","runner":"windows-2022","platform":"win","target":"nsis","arch":"x64"}]'
+          fi
+          {
+            echo "matrix<<MATRIX_JSON_EOF"
+            echo "$matrix_json"
+            echo "MATRIX_JSON_EOF"
+          } >> "$GITHUB_OUTPUT"
+
   preflight:
     name: Preflight
     runs-on: ubuntu-24.04
@@ -79,32 +116,12 @@ jobs:
 
   build:
     name: Build ${{ matrix.label }}
-    needs: preflight
+    needs: [preflight, configure]
     runs-on: ${{ matrix.runner }}
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - label: macOS arm64
-            runner: macos-14
-            platform: mac
-            target: dmg
-            arch: arm64
-          - label: macOS x64
-            runner: macos-15-intel
-            platform: mac
-            target: dmg
-            arch: x64
-          - label: Linux x64
-            runner: ubuntu-24.04
-            platform: linux
-            target: AppImage
-            arch: x64
-          - label: Windows x64
-            runner: windows-2022
-            platform: win
-            target: nsis
-            arch: x64
+        include: ${{ fromJson(needs.configure.outputs.matrix) }}
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -258,7 +275,7 @@ jobs:
 
   release:
     name: Publish GitHub Release
-    needs: [preflight, build, publish_cli]
+    needs: [preflight, build, publish_cli, configure]
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
@@ -280,10 +297,17 @@ jobs:
 
       - name: Merge macOS updater manifests
         run: |
-          node scripts/merge-mac-update-manifests.ts \
-            release-assets/latest-mac.yml \
-            release-assets/latest-mac-x64.yml
-          rm -f release-assets/latest-mac-x64.yml
+          set -euo pipefail
+          if [[ "${{ needs.configure.outputs.mac_arm64_only }}" == "true" ]]; then
+            echo "macOS arm64-only build: using latest-mac.yml from the arm64 builder as-is."
+          elif [[ -f release-assets/latest-mac-x64.yml ]]; then
+            node scripts/merge-mac-update-manifests.ts \
+              release-assets/latest-mac.yml \
+              release-assets/latest-mac-x64.yml
+            rm -f release-assets/latest-mac-x64.yml
+          else
+            echo "No latest-mac-x64.yml present; using latest-mac.yml as-is."
+          fi
 
       - name: Stage documentation for release assets
         env:
@@ -314,16 +338,7 @@ jobs:
           generate_release_notes: true
           prerelease: ${{ needs.preflight.outputs.is_prerelease }}
           make_latest: ${{ needs.preflight.outputs.make_latest }}
-          files: |
-            release-assets/*.dmg
-            release-assets/*.zip
-            release-assets/*.AppImage
-            release-assets/*.exe
-            release-assets/*.blockmap
-            release-assets/latest*.yml
-            release-assets/okcode-CHANGELOG.md
-            release-assets/okcode-RELEASE-NOTES.md
-            release-assets/okcode-ASSETS-MANIFEST.md
+          files: release-assets/*
           fail_on_unmatched_files: true
 
   finalize:

apps/marketing/src/pages/download.astro

@@ -18,7 +18,7 @@ import Layout from "../layouts/Layout.astro";
       </div>
       <div class="download-cards">
         <a class="download-card" data-asset="arm64.dmg" href="#">
-          <span class="card-arch">Apple Silicon (arm64)</span>
+          <span class="card-arch">M-series / Apple Silicon (arm64)</span>
           <span class="card-format">.dmg</span>
         </a>
         <a class="download-card" data-asset="x64.dmg" href="#">

docs/release.md

@@ -127,7 +127,22 @@ Checklist:
 6. Add Azure secrets listed above in GitHub Actions secrets.
 7. Re-run a tag release and confirm Windows installer is signed.
 
-## 4) Ongoing release checklist
+## 4) Apple Silicon (M-series) Mac–only release (manual dispatch)
+
+To ship **only** the macOS **arm64** DMG (M-series / Apple Silicon) and skip Intel Mac, Linux, and Windows builds:
+
+1. Open **Actions → Release Desktop → Run workflow**.
+2. Set **version** to the SemVer you are releasing (for example `0.0.2` or `v0.0.2`).
+3. Enable **mac_arm64_only** (workflow input).
+4. Run the workflow.
+
+Tag pushes always build the **full** matrix (all platforms); the M-series-only option applies only to **workflow_dispatch**.
+
+To build the same arm64 DMG locally on an Apple Silicon Mac:
+
+`bun run dist:desktop:dmg:arm64`
+
+## 5) Ongoing release checklist
 
 1. Ensure `main` is green in CI.
 2. Bump app version as needed (see `scripts/update-release-package-versions.ts` and [CHANGELOG.md](../CHANGELOG.md) / [docs/releases/](releases/README.md) for notes).
@@ -139,7 +154,7 @@ Checklist:
    - release job uploads expected files
 6. Smoke test downloaded artifacts.
 
-## 5) Troubleshooting
+## 6) Troubleshooting
 
 - macOS build unsigned when expected signed:
   - Check all Apple secrets are populated and non-empty.