Release OpenPet v0.1.1

Author: X-T-E-R

.github/workflows/release.yml

@@ -10,18 +10,30 @@ permissions:
 
 jobs:
   build:
-    name: Build ${{ matrix.platform }}
+    name: Build ${{ matrix.name }}
     runs-on: ${{ matrix.platform }}
+    env:
+      MACOS_DISTRIBUTION_READY: ${{ secrets.APPLE_CERTIFICATE != '' && secrets.APPLE_CERTIFICATE_PASSWORD != '' && secrets.KEYCHAIN_PASSWORD != '' && secrets.APPLE_ID != '' && secrets.APPLE_PASSWORD != '' && secrets.APPLE_TEAM_ID != '' }}
     strategy:
       fail-fast: false
       matrix:
         include:
-          - platform: ubuntu-22.04
+          - name: Linux x64
+            platform: ubuntu-22.04
             args: ""
-          - platform: macos-latest
-            args: ""
-          - platform: windows-latest
+            rust_target: ""
+          - name: macOS Apple Silicon
+            platform: macos-latest
+            args: "--target aarch64-apple-darwin"
+            rust_target: aarch64-apple-darwin
+          - name: macOS Intel
+            platform: macos-latest
+            args: "--target x86_64-apple-darwin"
+            rust_target: x86_64-apple-darwin
+          - name: Windows x64
+            platform: windows-latest
             args: ""
+            rust_target: ""
 
     steps:
       - name: Checkout
@@ -53,17 +65,75 @@ jobs:
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@stable
 
+      - name: Add Rust target
+        if: matrix.rust_target != ''
+        run: rustup target add ${{ matrix.rust_target }}
+
+      - name: Import Apple Developer ID certificate
+        if: startsWith(matrix.platform, 'macos') && env.MACOS_DISTRIBUTION_READY == 'true'
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+        run: |
+          echo "$APPLE_CERTIFICATE" | base64 --decode > certificate.p12
+          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
+          security default-keychain -s build.keychain
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
+          security set-keychain-settings -t 3600 -u build.keychain
+          security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
+
+          CERT_INFO=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID Application" | head -n 1 || true)
+          if [ -z "$CERT_INFO" ]; then
+            echo "::error::No Developer ID Application certificate found in the imported keychain."
+            exit 1
+          fi
+
+          CERT_ID=$(echo "$CERT_INFO" | sed -E 's/.*"([^"]+)".*/\1/')
+          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> "$GITHUB_ENV"
+
+      - name: Configure Apple notarization credentials
+        if: startsWith(matrix.platform, 'macos') && env.MACOS_DISTRIBUTION_READY == 'true'
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          {
+            printf 'APPLE_ID=%s\n' "$APPLE_ID"
+            printf 'APPLE_PASSWORD=%s\n' "$APPLE_PASSWORD"
+            printf 'APPLE_TEAM_ID=%s\n' "$APPLE_TEAM_ID"
+          } >> "$GITHUB_ENV"
+
+      - name: Configure ad-hoc macOS signing fallback
+        if: startsWith(matrix.platform, 'macos') && env.MACOS_DISTRIBUTION_READY != 'true'
+        run: |
+          echo "APPLE_SIGNING_IDENTITY=-" >> "$GITHUB_ENV"
+          echo "::warning::macOS Developer ID signing/notarization secrets are incomplete. Building ad-hoc signed CI artifacts that Gatekeeper may block."
+
       - name: Build Tauri bundles
         uses: tauri-apps/tauri-action@v0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         with:
           args: ${{ matrix.args }}
           tagName: ${{ github.ref_name }}
           releaseName: OpenPet ${{ github.ref_name }}
           releaseBody: |
             Download the installer or bundle for your platform from the assets below.
 
-            Development and manual verification currently happen on Windows. macOS and Linux artifacts are built by CI but have not been manually tested by the developer yet.
+            Development and manual verification currently happen on Windows.
+
+            macOS notes:
+            - Normal launch of downloaded macOS apps requires Developer ID signing and Apple notarization.
+            - This workflow produces notarized macOS artifacts only when APPLE_CERTIFICATE, APPLE_CERTIFICATE_PASSWORD, KEYCHAIN_PASSWORD, APPLE_ID, APPLE_PASSWORD, and APPLE_TEAM_ID repository secrets are configured.
+            - If those secrets are missing, macOS artifacts are ad-hoc signed CI test builds and Gatekeeper may report that OpenPet is damaged or cannot be verified.
+            - Apple Silicon and Intel builds are separate assets; download the asset matching your Mac.
+
+            Linux notes:
+            - Linux .deb, .rpm, and AppImage artifacts are built by CI but have not been manually runtime-tested by the developer yet.
           releaseDraft: true
           prerelease: false

.gitignore

@@ -4,6 +4,7 @@ src-tauri/target/
 .agents/
 .codex/
 .trellis/
+.workflow/
 AGENTS.md
 .playwright-mcp/
 codex-pet-runtime-settings-ui*.png

README.md

@@ -12,10 +12,16 @@ GitHub: <https://github.com/X-T-E-R/OpenPet>
 
 ## Quick Start
 
-For most users, install a packaged build for your platform from [GitHub Releases](https://github.com/X-T-E-R/OpenPet/releases) and launch OpenPet. The pet appears on your desktop, can be dragged to the position you want, and can be configured from the pet right-click menu or the app tray/menu.
+For most Windows users, install a packaged build from [GitHub Releases](https://github.com/X-T-E-R/OpenPet/releases) and launch OpenPet. The pet appears on your desktop, can be dragged to the position you want, and can be configured from the pet right-click menu or the app tray/menu.
 
 Release builds are generated for Windows, macOS, and Linux. Development and manual verification currently happen on Windows; macOS and Linux packages are built by CI but have not been manually tested by the developer yet.
 
+### Platform Status
+
+- Windows: primary manually verified platform.
+- macOS: CI builds Apple Silicon and Intel artifacts separately. Normal launch of a downloaded macOS app requires Apple Developer ID signing and notarization; if the release was built without those credentials, Gatekeeper may show that OpenPet is damaged or cannot be verified. Treat unsigned macOS artifacts as tester builds, not production-ready distribution.
+- Linux: CI builds `.deb`, `.rpm`, and `.AppImage` artifacts on Ubuntu, but runtime behavior has not been manually verified yet.
+
 To run from source:
 
 ```powershell
@@ -153,6 +159,8 @@ pnpm release:check
 pnpm release:bundle
 ```
 
+macOS release distribution needs Apple Developer ID signing and notarization. Configure `APPLE_CERTIFICATE`, `APPLE_CERTIFICATE_PASSWORD`, `KEYCHAIN_PASSWORD`, `APPLE_ID`, `APPLE_PASSWORD`, and `APPLE_TEAM_ID` repository secrets before publishing macOS artifacts for normal end users; otherwise the workflow falls back to ad-hoc signed CI artifacts that Gatekeeper may block.
+
 ## Safety And Rights
 
 - The control API defaults to `127.0.0.1` and is intended for tools running on the same machine. Use `0.0.0.0` only for trusted local-network workflows.

README.zh-CN.md

@@ -12,10 +12,16 @@ GitHub：<https://github.com/X-T-E-R/OpenPet>
 
 ## 快速开始
 
-普通用户可以从 [GitHub Releases](https://github.com/X-T-E-R/OpenPet/releases) 下载对应平台的打包版本后直接启动 OpenPet。桌宠会显示在桌面上，可以拖到你想要的位置，设置页可以从桌宠右键菜单或应用托盘 / 菜单打开。
+Windows 普通用户可以从 [GitHub Releases](https://github.com/X-T-E-R/OpenPet/releases) 下载打包版本后直接启动 OpenPet。桌宠会显示在桌面上，可以拖到你想要的位置，设置页可以从桌宠右键菜单或应用托盘 / 菜单打开。
 
 Release 会为 Windows、macOS 和 Linux 生成构建产物。当前开发与手动验证主要在 Windows 环境完成；macOS 和 Linux 包由 CI 构建，但开发者尚未手动测试。
 
+### 平台状态
+
+- Windows：当前主要手动验证平台。
+- macOS：CI 会分别构建 Apple Silicon 和 Intel 产物。macOS 从网络下载的应用要正常打开，需要 Apple Developer ID 签名和 Apple 公证；如果 release 构建时没有这些凭据，Gatekeeper 可能提示 OpenPet 已损坏或无法验证。
+- Linux：CI 会在 Ubuntu 上构建 `.deb`、`.rpm` 和 `.AppImage`，但运行行为尚未由开发者手动验证。
+
 从源码运行：
 
 ```powershell
@@ -153,6 +159,8 @@ pnpm release:check
 pnpm release:bundle
 ```
 
+macOS 正式分发需要 Apple Developer ID 签名和公证。发布面向普通用户的 macOS 产物前，需要在仓库 secrets 配置 `APPLE_CERTIFICATE`、`APPLE_CERTIFICATE_PASSWORD`、`KEYCHAIN_PASSWORD`、`APPLE_ID`、`APPLE_PASSWORD` 和 `APPLE_TEAM_ID`；否则 workflow 会退回到 ad-hoc signed CI 测试产物，Gatekeeper 仍可能拦截。
+
 ## 安全与权利提醒
 
 - 控制 API 默认绑定 `127.0.0.1`，适合由同一台机器上的工具调用。只有受信任的本地网络工作流需要时才使用 `0.0.0.0`。

package.json

@@ -1,6 +1,6 @@
 {
   "name": "openpet",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "private": true,
   "type": "module",
   "description": "OpenPet desktop runtime for Codex-compatible pet companions.",
@@ -19,6 +19,8 @@
   "dependencies": {
     "@tauri-apps/api": "^2.11.0",
     "@tauri-apps/plugin-dialog": "~2.7.1",
+    "@tauri-apps/plugin-process": "^2.3.1",
+    "@tauri-apps/plugin-updater": "^2.10.1",
     "react": "^19.2.5",
     "react-dom": "^19.2.5"
   },