chore: release GoodBuddy 0.11.0

Prepare the approved bilingual 0.11.0 release metadata and synchronize package versions. macOS packaging now signs and notarizes when all Apple credentials are available, emits unsigned packages when none are configured, and rejects partial credential sets so the six-platform release can proceed without silently misrepresenting signing status.

.github/workflows/packages.yml

@@ -115,7 +115,8 @@ jobs:
           name: goodbuddy-production-bundle
           path: out
 
-      - name: Prepare macOS signing credentials
+      - name: Resolve macOS signing mode
+        id: macos-signing
         if: matrix.platform == 'macos'
         shell: bash
         env:
@@ -126,17 +127,51 @@ jobs:
           APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
         run: |
           set -euo pipefail
-          test -n "$MACOS_CERTIFICATE_BASE64"
-          test -n "$MACOS_CERTIFICATE_PASSWORD"
-          test -n "$APPLE_API_KEY_BASE64"
-          test -n "$APPLE_API_KEY_ID"
-          test -n "$APPLE_API_ISSUER"
+          names=(
+            MACOS_CERTIFICATE_BASE64
+            MACOS_CERTIFICATE_PASSWORD
+            APPLE_API_KEY_BASE64
+            APPLE_API_KEY_ID
+            APPLE_API_ISSUER
+          )
+          configured=0
+          missing=()
+          for name in "${names[@]}"; do
+            if [[ -n "${!name}" ]]; then
+              configured=$((configured + 1))
+            else
+              missing+=("$name")
+            fi
+          done
+          if [[ "$configured" -eq 0 ]]; then
+            echo "enabled=false" >> "$GITHUB_OUTPUT"
+            echo "::warning title=Unsigned macOS packages::Apple signing credentials are not configured. The macOS DMG and ZIP will be unsigned and unnotarized."
+            {
+              echo "### macOS signing"
+              echo
+              echo "Apple signing credentials are not configured. This target produces unsigned and unnotarized packages that Gatekeeper may block on first launch."
+            } >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          if [[ "$configured" -ne "${#names[@]}" ]]; then
+            missing_names="$(IFS=,; echo "${missing[*]}")"
+            echo "::error title=Incomplete macOS signing credentials::Missing: $missing_names"
+            exit 1
+          fi
+          echo "enabled=true" >> "$GITHUB_OUTPUT"
           printf '%s' "$MACOS_CERTIFICATE_BASE64" | base64 -D > "$RUNNER_TEMP/goodbuddy-developer-id.p12"
           printf '%s' "$APPLE_API_KEY_BASE64" | base64 -D > "$RUNNER_TEMP/AuthKey.p8"
+          test -s "$RUNNER_TEMP/goodbuddy-developer-id.p12"
+          test -s "$RUNNER_TEMP/AuthKey.p8"
           chmod 600 "$RUNNER_TEMP/goodbuddy-developer-id.p12" "$RUNNER_TEMP/AuthKey.p8"
+          {
+            echo "### macOS signing"
+            echo
+            echo "Complete Apple signing credentials were detected. This target will be signed, notarized, and verified."
+          } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Build, sign and notarize macOS release packages
-        if: matrix.platform == 'macos'
+        if: matrix.platform == 'macos' && steps.macos-signing.outputs.enabled == 'true'
         run: npm run release:package -- --platform ${{ matrix.platform }} --arch ${{ matrix.arch }} --skip-build
         env:
           ELECTRON_CACHE: ${{ runner.temp }}/electron
@@ -148,8 +183,16 @@ jobs:
           APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
           APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
 
+      - name: Build unsigned macOS release packages
+        if: matrix.platform == 'macos' && steps.macos-signing.outputs.enabled == 'false'
+        run: npm run release:package -- --platform ${{ matrix.platform }} --arch ${{ matrix.arch }} --skip-build --unsigned
+        env:
+          ELECTRON_CACHE: ${{ runner.temp }}/electron
+          ELECTRON_BUILDER_CACHE: ${{ runner.temp }}/electron-builder
+          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
+
       - name: Verify macOS signature and notarization ticket
-        if: matrix.platform == 'macos'
+        if: matrix.platform == 'macos' && steps.macos-signing.outputs.enabled == 'true'
         shell: bash
         run: |
           set -euo pipefail