fix(build): move mac tool signing to beforeSign (#86)

* fix(build): move tool signing to beforeSign

* ci(macos): verify signing and notarization

* fix(build): move signing hook to afterPack

.github/workflows/build.yml

@@ -149,6 +149,7 @@ jobs:
           APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
         run: |
           set -euo pipefail
+          echo "SIGNING_AVAILABLE=false" >> "$GITHUB_ENV"
 
           # Check if all required secrets are present
           if [[ -z "$MAC_CERT_P12_BASE64" ]] || [[ -z "$MAC_CERT_P12_PASSWORD" ]] || \
@@ -177,10 +178,42 @@ jobs:
           echo "APPLE_API_KEY=$API_KEY_PATH" >> "$GITHUB_ENV"
           echo "APPLE_API_KEY_ID=$APPLE_API_KEY_ID" >> "$GITHUB_ENV"
           echo "APPLE_API_ISSUER=$APPLE_API_ISSUER" >> "$GITHUB_ENV"
+          echo "SIGNING_AVAILABLE=true" >> "$GITHUB_ENV"
 
       - name: Build application
         run: ${{ matrix.build_script }}
 
+      - name: Verify macOS codesign and notarization
+        if: matrix.platform == 'macos' && env.SIGNING_AVAILABLE == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          apps_found=0
+          while IFS= read -r app; do
+            apps_found=1
+            echo "Verifying codesign for $app"
+            codesign --verify --deep --strict --verbose=2 "$app"
+            spctl -a -t exec -vv "$app"
+            echo "Validating notarization ticket for $app"
+            xcrun stapler validate "$app"
+          done < <(find dist -type d -name "*.app" -prune -print)
+
+          if [[ "$apps_found" -eq 0 ]]; then
+            echo "::error::No .app bundles found in dist"
+            exit 1
+          fi
+
+          dmgs_found=0
+          while IFS= read -r dmg; do
+            dmgs_found=1
+            echo "Validating notarization ticket for $dmg"
+            xcrun stapler validate "$dmg"
+          done < <(find dist -type f -name "*.dmg" -print)
+
+          if [[ "$dmgs_found" -eq 0 ]]; then
+            echo "::notice::No DMG artifacts found to validate"
+          fi
+
       - name: Upload build artifacts
         if: inputs.upload_artifacts == true
         uses: actions/upload-artifact@v4