fix: notarize macOS binaries via zip archive

Apple's notarytool requires .zip, .pkg, or .dmg files for notarization.
Updated workflow to:
1. Sign binaries with hardened runtime
2. Zip signed binaries
3. Notarize and staple the zips
4. Extract notarized binaries

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: Aleksandr Slapoguzov

.github/workflows/release.yml

@@ -56,20 +56,45 @@ jobs:
         run: |
           ./codesign-client-linux-amd64 -extensions "jsign_replace=true" dist/bin/codex-acp-x64-windows.exe
 
-      - name: Sign, notarize and staple macOS binaries
+      - name: Sign macOS binaries
         env:
           SERVICE_ACCOUNT_NAME: ${{ vars.SERVICE_ACCOUNT_NAME }}
           SERVICE_ACCOUNT_TOKEN: ${{ secrets.SERVICE_ACCOUNT_TOKEN }}
         run: |
           ./codesign-client-linux-amd64 \
             -denoted-content-type="application/x-mac-app-bin" \
-            -extensions "mac_codesign_force=true,mac_codesign_options=runtime,mac_notarize=true,mac_staple=true" \
+            -extensions "mac_codesign_force=true,mac_codesign_options=runtime" \
             dist/bin/codex-acp-x64-darwin
           ./codesign-client-linux-amd64 \
             -denoted-content-type="application/x-mac-app-bin" \
-            -extensions "mac_codesign_force=true,mac_codesign_options=runtime,mac_notarize=true,mac_staple=true" \
+            -extensions "mac_codesign_force=true,mac_codesign_options=runtime" \
             dist/bin/codex-acp-arm64-darwin
 
+      - name: Package macOS binaries for notarization
+        run: |
+          zip -j dist/bin/codex-acp-x64-darwin.zip dist/bin/codex-acp-x64-darwin
+          zip -j dist/bin/codex-acp-arm64-darwin.zip dist/bin/codex-acp-arm64-darwin
+
+      - name: Notarize and staple macOS binaries
+        env:
+          SERVICE_ACCOUNT_NAME: ${{ vars.SERVICE_ACCOUNT_NAME }}
+          SERVICE_ACCOUNT_TOKEN: ${{ secrets.SERVICE_ACCOUNT_TOKEN }}
+        run: |
+          ./codesign-client-linux-amd64 \
+            -denoted-content-type="application/x-mac-app-zip" \
+            -extensions "mac_notarize=true,mac_staple=true" \
+            dist/bin/codex-acp-x64-darwin.zip
+          ./codesign-client-linux-amd64 \
+            -denoted-content-type="application/x-mac-app-zip" \
+            -extensions "mac_notarize=true,mac_staple=true" \
+            dist/bin/codex-acp-arm64-darwin.zip
+
+      - name: Extract notarized macOS binaries
+        run: |
+          unzip -o dist/bin/codex-acp-x64-darwin.zip -d dist/bin/
+          unzip -o dist/bin/codex-acp-arm64-darwin.zip -d dist/bin/
+          rm dist/bin/codex-acp-x64-darwin.zip dist/bin/codex-acp-arm64-darwin.zip
+
       - run: bun run package:all
 
       - name: Create Release