ci: add release-v3.yml workflow for signed v3 binary releases

[leaanthony]

Summary

Adds .github/workflows/release-v3.yml — a GitHub Actions workflow that:

• Triggers on any tag push matching v3.* (and supports workflow_dispatch for dry-run / manual test builds)
• Builds the wails3 CLI binary for all 5 required targets using CGO_ENABLED=0 for portable, statically-linked binaries:
  • linux/amd64 — ubuntu-latest runner
  • linux/arm64 — ubuntu-24.04-arm (native ARM64 runner)
  • darwin/amd64 — macos-latest runner
  • darwin/arm64 — macos-latest runner (GOARCH=arm64)
  • darwin universal — lipo -create merge of the two darwin binaries
  • windows/amd64 — windows-latest runner
• Signs all three macOS binaries with codesign --options=runtime --timestamp
• Notarizes all three macOS binaries via xcrun notarytool submit --wait
• Attaches every binary to the GitHub Release created for the tag

Required GitHub Actions secrets

Configure these in Settings → Secrets and variables → Actions before pushing a v3.* tag:

Secret	Description
APPLE_SIGNING_CERT	Base64-encoded Developer ID Application certificate (.p12)
APPLE_CERT_PASSWORD	Password protecting the .p12 file
APPLE_SIGNING_IDENTITY	Full identity string, e.g. Developer ID Application: Wails (XXXXXXXXXX)
APPLE_TEAM_ID	10-character Apple Developer Team ID
APPLE_NOTARIZE_USER	Apple ID email used for notarization
APPLE_NOTARIZE_PASSWORD	App-specific password for that Apple ID

Notes

• CGO_ENABLED=0 is safe for the CLI: the CGo-gated WebKit detection code in internal/operatingsystem/webkit_linux.go is guarded by //go:build linux && cgo && !gtk4 && !android and is excluded when CGo is disabled. The resulting binary is fully functional.
• The workflow_dispatch trigger accepts a tag input (must already exist) and a pre_release boolean — useful for test builds like v3.0.0-test.1.
• Pre-release status is auto-detected from the tag: any tag containing a - (e.g. v3.0.0-beta.1) is marked as pre-release on GitHub.
• If the release already exists when the job runs (e.g. a re-run), the job uploads binaries with --clobber instead of creating a new release.

Test plan

• Push a test tag v3.0.0-test.1 to verify all 5 build targets compile
• Confirm macOS binaries are signed: codesign -v wails3-darwin-*
• Confirm notarization: spctl -a -v wails3-darwin-universal
• Confirm binaries appear attached to the GitHub Release

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Improved the release automation to build and package binaries for Linux, Windows, and macOS in parallel.
  • Added macOS code signing and notarization steps before publishing artifacts.
  • Automatically creates or updates GitHub releases based on pushed version tags, with support for manual pre-release publishing.
  • Generates release notes and uploads the built distribution files to the release.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 1e6512b4-f5e1-4bba-8a58-d1042d87cb2b

📥 Commits

Reviewing files that changed from the base of the PR and between 687f4d1 and d4ce50b.

📒 Files selected for processing (1)

• .github/workflows/release-v3.yml

---

Walkthrough

A GitHub Actions workflow for Wails v3 is added that triggers on v3.* tag pushes or manual dispatch, builds Linux, Windows, and macOS binaries, signs and notarizes macOS outputs, and creates or updates a GitHub release.

Changes

Wails v3 Release Pipeline

Layer / File(s)	Summary
Workflow triggers and platform builds .github/workflows/release-v3.yml	The workflow adds v3.* tag and manual triggers, then defines Linux matrix builds and a Windows build that check out the requested tag, build static binaries, and upload artifacts.
macOS signing and notarization .github/workflows/release-v3.yml	The macOS job builds amd64 and arm64 binaries, creates a universal binary, imports a signing certificate into a temporary keychain, signs the artifacts, notarizes them, and uploads the signed macOS outputs.
Release assembly and publication .github/workflows/release-v3.yml	The release job resolves the tag and prerelease flag, downloads all artifacts into dist/, verifies the tag exists, and uses gh to create or update the GitHub release with the bundled binaries.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• wailsapp/wails#5270: Also changes GitHub workflow behavior around permissions needed for release-related automation.

Poem

🐰 I hopped through tags on v3 tonight,
Built Linux, Windows, Mac just right.
Signed and notarized with a cheerful grin,
Then sent the release out to begin.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise, specific, and accurately describes the new release workflow for signed v3 binaries.
Description check	✅ Passed	The description is detailed and relevant, covering summary, secrets, notes, and test plan, but it omits the Fixes # reference and some checklist fields.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/engineer-linux/0908911e

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Adds a new GitHub Actions workflow for publishing signed wails3 v3 CLI releases. The workflow fits into the repository’s release automation by building cross-platform binaries, notarizing macOS artifacts, and publishing them to GitHub Releases.

Changes:

• Adds a new tag-triggered/manual release-v3.yml workflow for v3 CLI release builds.
• Builds Linux, Windows, and macOS binaries, including a universal macOS binary.
• Signs and notarizes macOS artifacts, then creates or updates the GitHub Release and uploads all binaries.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/release-v3.yml:
- Around line 24-26: Add an explicit minimal permissions block to each build job
to restrict GITHUB_TOKEN scope: for the jobs build-linux, build-windows, and
build-sign-macos add a permissions stanza under the job definition with at least
"contents: read" and "actions: write" (e.g., permissions: contents: read
actions: write) to allow checkout and artifact upload while limiting other token
privileges.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a4701b0b-e8d0-468a-b002-cd2ef36e8a39

📥 Commits

Reviewing files that changed from the base of the PR and between 1c143ca and 687f4d1.

📒 Files selected for processing (1)

• .github/workflows/release-v3.yml

[leaanthony]

Self-review notes — two showstoppers before this workflow ships:

1. workflow_dispatch builds the wrong commit — All three build jobs use bare actions/checkout@v4 with no ref: parameter. On a manual dispatch, the workflow builds from the current branch tip, not inputs.tag, then uploads those artifacts to the requested release. Fix:

   - uses: actions/checkout@v4
     with:
       ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}

2. base64 --decode fails on macOS — macOS runners use BSD base64 which requires -D, not --decode. The certificate import step will error before signing starts. Fix: use base64 -d (works on both BSD and GNU).

Also worth fixing:

• Each build job should have permissions: contents: read; only the release job needs contents: write. Currently write is inherited everywhere.
• gh release create will create a tag at the wrong commit if inputs.tag doesn't already exist. Add a git fetch --tags && git rev-parse refs/tags/$TAG guard before the release step.

[taliesin-ai]

Addressed the review feedback (thanks @copilot-pull-request-reviewer, CodeQL, @coderabbitai):

• Wrong-commit on manual runs — all three build jobs now check out ref: ${{ inputs.tag || github.ref }}, so workflow_dispatch builds and signs the requested tag (tag-push still uses github.ref). Binaries can no longer be built from the branch tip and published under an unrelated tag.
• macOS base64 — base64 --decode is GNU-only; macos-latest ships BSD base64, so the cert import now uses base64 -D.
• Tag validation — before gh release create we now verify the tag exists via the refs API and fail fast otherwise, so a typo'd dispatch can't create a release at an arbitrary commit.
• Token scope — added a top-level permissions: contents: read default; the release job keeps its contents: write. Resolves the CodeQL findings on the build jobs.

YAML validated. Re-enabling auto-merge.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@taliesin-ai Thanks for the thorough follow-up — those fixes address the concerns I raised, especially the manual-dispatch ref handling and the macOS certificate decode portability.

🐇✨

---

If you found this review helpful, would you consider giving us a shout-out on X?

Thank you for using CodeRabbit!

[taliesin-ai]

Approving. Reviewed the release-workflow fixes: build jobs now check out inputs.tag || github.ref (correct commit on workflow_dispatch), macOS cert import uses BSD base64 -D, a tag-existence guard fails fast before gh release create, and GITHUB_TOKEN defaults to read-only with the release job scoped to write. YAML validated; all review threads resolved.