fix(release): use PragSys signing identity

[WellDunDun]

Fix the two blockers exposed by the v0.3.1 release candidate.

• Pin macOS release trust and signing to the installed PragSys Collaborative LLC Developer ID certificate for Apple team 6SFRTR9AK6.
• Resolve DuckDB packages through Bun and stage the native runtime in the self-host image.
• Add a patch changeset for v0.3.2.

Verified with focused release and Desktop tests, Desktop and self-host typechecks, self-host tests, lint/format, a compiled self-host readiness proof, and a local package run that selected the PragSys Developer ID identity.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d87b6ad2-0f9f-42ff-9f57-aa35bce94c57

📥 Commits

Reviewing files that changed from the base of the PR and between e471a63 and 71d63e7.

📒 Files selected for processing (8)

• .changeset/pragsys-signed-release.md
• .github/workflows/desktop.yml
• apps/desktop/scripts/build-sidecar.ts
• apps/desktop/src/main/desktop-builder-config.test.ts
• apps/desktop/src/main/desktop-protocol.test.ts
• apps/desktop/src/main/desktop-protocol.ts
• apps/selfhost/Dockerfile
• tests/scripts/release-workflows.test.ts

---

📝 Walkthrough

Summary by CodeRabbit

• New Features

  • Added signed macOS release support using the PragSys Collaborative LLC Developer ID.
  • Self-hosted deployments now include the DuckDB native runtime and support both AMD64 and ARM64 architectures.

• Bug Fixes

  • Improved DuckDB runtime resolution for desktop builds.
  • Strengthened macOS release trust validation and rejected mismatched signing identities.

• Tests

  • Expanded release workflow coverage for signing, architecture support, and self-hosted runtime packaging.

Walkthrough

The PR updates macOS signing validation to PragSys Collaborative LLC, resolves DuckDB native packages with Bun, and packages architecture-specific desktop sidecars and resources in the self-host image.

Changes

Release packaging updates

Layer / File(s)	Summary
PragSys macOS signing trust .github/workflows/desktop.yml, apps/desktop/src/main/desktop-protocol.ts, apps/desktop/src/main/desktop-builder-config.test.ts, apps/desktop/src/main/desktop-protocol.test.ts	macOS signing configuration and trust tests now require the PragSys Collaborative LLC Developer ID identity. Tests reject the former authority and mismatched team identifiers.
DuckDB native package resolution apps/desktop/scripts/build-sidecar.ts, tests/scripts/release-workflows.test.ts	The sidecar resolves DuckDB API and target-specific native packages with Bun.resolveSync. Release tests verify these paths.
Self-host image packaging apps/selfhost/Dockerfile, tests/scripts/release-workflows.test.ts, .changeset/pragsys-signed-release.md	The Docker build selects amd64 or arm64 Bun targets, copies desktop dependencies into the runtime image, sets SELFTUNE_DESKTOP_RESOURCE_DIR=/app, and records the patch release changes.

Estimated code review effort: 2 (Simple) | ~15 minutes

Sequence Diagram(s)

sequenceDiagram
  participant DockerBuild
  participant BuildSidecar
  participant RuntimeImage
  DockerBuild->>BuildSidecar: Pass architecture-specific Bun target
  BuildSidecar->>DockerBuild: Build desktop sidecar and resources
  DockerBuild->>RuntimeImage: Copy desktop node_modules and resources
  RuntimeImage->>RuntimeImage: Set SELFTUNE_DESKTOP_RESOURCE_DIR=/app

Loading

Possibly related PRs

• selftune-dev/selftune#143: Both PRs update macOS signing identity handling and related release workflow tests.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title uses the required conventional commit format and accurately describes the signing identity change.
Description check	✅ Passed	The description clearly explains the macOS signing, DuckDB runtime, self-host image, and changeset updates.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/v0.3.2-macos-certificate-authority

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}