ci(inso): add native arm64 macOS build to remove Rosetta dependency

## Background

The macOS inso binary is packaged with @yao-pkg/pkg using `--targets host`
on the Intel runner (macos-15-large), producing an x86_64-only Mach-O.
Apple Silicon users without Rosetta 2 cannot run it:
`zsh: Bad CPU type in executable`.

Merging x64 + arm64 pkg binaries into a universal binary with lipo is not
possible: pkg locates its payload by byte offset and the merged binary
fails in readPrelude (vercel/pkg#1597, verified locally).

## Changes

- release-build.yml: add `package-inso-macos-arm64` job on the arm64
  `macos-15` runner producing a native arm64 inso binary, code-signed and
  notarized, with artifacts `inso-macos-arm64-<version>.zip` and
  `inso-macos-arm64-<version>.pkg`.
- test-cli.yml: add `Package-macOS` job so PR CI builds the arm64 binary,
  runs the packaged-binary e2e tests and uploads the artifact for download.

The existing x64 build chain and the `inso-macos-<version>.zip` asset name
consumed by updates.insomnia.rest are unchanged.

.github/workflows/release-build.yml

@@ -376,6 +376,116 @@ jobs:
             packages/insomnia/build/**/*.map
             !packages/insomnia/build/yarn-standalone.js
 
+  package-inso-macos-arm64:
+    if: startsWith(github.ref_name, 'release/')
+    timeout-minutes: ${{ fromJSON(vars.GHA_DEFAULT_TIMEOUT) }}
+    runs-on: macos-15
+    permissions:
+      contents: read
+      packages: read
+    env:
+      INSO_PACKAGE_NAME: insomnia-inso
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout branch
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Setup Node
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+          cache-dependency-path: package-lock.json
+          registry-url: 'https://npm.pkg.github.com'
+          scope: '@kong'
+
+      - name: Install packages
+        run: npm ci
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1'
+
+      - name: Setup Inso CLI version env var
+        shell: bash
+        run: |
+          echo "INSO_VERSION=$(jq .version ./packages/${{ env.INSO_PACKAGE_NAME }}/package.json -rj)" >> $GITHUB_ENV
+
+      # The x64 macOS inso binary is built in build-and-upload-release-artifacts.
+      # This job produces the native arm64 build so Apple Silicon users do not need Rosetta.
+      - name: Package inso
+        run: |
+          npm run install-libcurl-node
+          npm run build:production -w insomnia-inso
+          npm run package -w insomnia-inso
+        env:
+          VERSION: ${{ env.INSO_VERSION }}
+
+      - name: Code-sign & create Inso CLI installer (macOS ARM64)
+        run: ./src/scripts/macos-pkg.sh
+        shell: bash
+        working-directory: ./packages/${{ env.INSO_PACKAGE_NAME }}
+        continue-on-error: false
+        env:
+          MACOS_CERTIFICATE: ${{ secrets.DESIGNER_MAC_CSC_LINK }}
+          MACOS_CERTIFICATE_PWD: ${{ secrets.DESIGNER_MAC_CSC_KEY_PASSWORD }}
+          PKG_NAME: inso-macos-arm64-${{ env.INSO_VERSION }}
+          BUNDLE_ID: com.insomnia.inso
+          VERSION: ${{ env.INSO_VERSION }}
+
+      - name: Notarize Inso CLI installer (macOS ARM64)
+        env:
+          APPLE_ID: ${{ secrets.DESIGNER_APPLE_ID }}
+          APPLE_ID_PASSWORD: ${{ secrets.DESIGNER_APPLE_ID_PASSWORD }}
+        run: |
+          xcrun notarytool submit \
+            "./packages/${{ env.INSO_PACKAGE_NAME }}/artifacts/inso-macos-arm64-${{ env.INSO_VERSION }}.pkg" \
+            --apple-id "$APPLE_ID" \
+            --password "$APPLE_ID_PASSWORD" \
+            --team-id FX44YY62GV \
+            --verbose \
+            --wait
+
+      - name: Staple Inso CLI installer (macOS ARM64)
+        run: |
+          xcrun stapler staple \
+            "./packages/${{ env.INSO_PACKAGE_NAME }}/artifacts/inso-macos-arm64-${{ env.INSO_VERSION }}.pkg"
+
+      - name: Notarize Inso CLI binary (macOS ARM64)
+        env:
+          APPLE_ID: ${{ secrets.DESIGNER_APPLE_ID }}
+          APPLE_ID_PASSWORD: ${{ secrets.DESIGNER_APPLE_ID_PASSWORD }}
+        # notarytool requires the binary to be packaged in a zip, dmg, or pkg.
+        run: |
+          BIN_PATH="./packages/${{ env.INSO_PACKAGE_NAME }}/binaries/inso"
+          ZIP_PATH="$(mktemp -d)/inso.zip"
+          ditto -c -k --keepParent "$BIN_PATH" "$ZIP_PATH"
+          xcrun notarytool submit "$ZIP_PATH" \
+            --apple-id "$APPLE_ID" \
+            --password "$APPLE_ID_PASSWORD" \
+            --team-id FX44YY62GV \
+            --wait
+
+      - name: Create Inso ARM64 zip artifact
+        run: |
+          mkdir -p ./packages/${{ env.INSO_PACKAGE_NAME }}/artifacts
+          ditto -c -k \
+            "./packages/${{ env.INSO_PACKAGE_NAME }}/binaries/inso" \
+            "./packages/${{ env.INSO_PACKAGE_NAME }}/artifacts/inso-macos-arm64-${{ env.INSO_VERSION }}.zip"
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          if-no-files-found: ignore
+          name: ${{ runner.os }}-${{ runner.arch }}-artifacts
+          path: |
+            packages/insomnia-inso/artifacts/*
+
   update-pull-request:
     if: startsWith(github.ref_name, 'release/')
     timeout-minutes: ${{ fromJSON(vars.GHA_DEFAULT_TIMEOUT) }}

.github/workflows/release-publish.yml

@@ -161,7 +161,9 @@ jobs:
         with:
           release_id: ${{ steps.core_tag_and_release.outputs.id }}
           tag_name: ${{ env.RELEASE_CORE_TAG }}
-          file: './artifacts/*-artifacts/insomnia/dist/Insomnia.*;./artifacts/*-artifacts/insomnia/dist/{alpha,beta,latest}.yml;./artifacts/*-artifacts/insomnia/dist/squirrel-windows/*;./artifacts/*-artifacts/insomnia-inso/artifacts/inso-*;./artifacts/**/*sbom.{spdx,cyclonedx}.json'
+          # `*-artifacts/inso-*` covers artifacts uploaded at the artifact root (LCA of a single
+          # search path), e.g. the arm64 inso job; matrix jobs nest under insomnia-inso/artifacts
+          file: './artifacts/*-artifacts/insomnia/dist/Insomnia.*;./artifacts/*-artifacts/insomnia/dist/{alpha,beta,latest}.yml;./artifacts/*-artifacts/insomnia/dist/squirrel-windows/*;./artifacts/*-artifacts/insomnia-inso/artifacts/inso-*;./artifacts/*-artifacts/inso-*;./artifacts/**/*sbom.{spdx,cyclonedx}.json'
           prerelease: ${{ env.IS_PRERELEASE }}
           draft: false
           overwrite: true

.github/workflows/test-cli.yml

@@ -95,3 +95,76 @@ jobs:
           if-no-files-found: ignore
           name: ${{ steps.inso-variables.outputs.pkg-name }}
           path: packages/insomnia-inso/artifacts
+
+  Package-macOS:
+    timeout-minutes: 30
+    runs-on: macos-15
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout branch
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Setup Node
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+          cache-dependency-path: package-lock.json
+          registry-url: 'https://npm.pkg.github.com'
+          scope: '@kong'
+
+      - name: Install packages
+        run: npm ci
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1'
+
+      - name: Install node version of node-libcurl for inso tests
+        run: npm run install-libcurl-node
+
+      - name: Set Inso CLI variables
+        id: inso-variables-macos
+        shell: bash
+        run: |
+          INSO_VERSION="$(jq .version packages/insomnia-inso/package.json -rj)-run.${{ github.run_number }}"
+          PKG_NAME="inso-macos-arm64-$INSO_VERSION"
+          echo "pkg-name=$PKG_NAME" >> $GITHUB_OUTPUT
+          echo "inso-version=$INSO_VERSION" >> $GITHUB_OUTPUT
+
+      - name: Package Inso CLI binary
+        run: |
+          npm run build -w insomnia-inso
+          npm run package -w insomnia-inso
+        env:
+          VERSION: ${{ steps.inso-variables-macos.outputs.inso-version }}
+
+      - name: Start test server
+        run: npm run serve -w insomnia-smoke-test & npx -y wait-on http://localhost:4010
+
+      - name: Run Inso binary e2e tests
+        run: npm run test:binary -w insomnia-inso
+
+      # artifacts.ts emits inso-macos-<version>.zip (the x64 release asset name),
+      # so the arm64 zip is created explicitly with the arm64 marker
+      - name: Create Inso ARM64 zip artifact
+        run: |
+          mkdir -p packages/insomnia-inso/artifacts
+          ditto -c -k \
+            packages/insomnia-inso/binaries/inso \
+            "packages/insomnia-inso/artifacts/inso-macos-arm64-${{ steps.inso-variables-macos.outputs.inso-version }}.zip"
+
+      - name: Upload Inso CLI artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          if-no-files-found: ignore
+          name: ${{ steps.inso-variables-macos.outputs.pkg-name }}
+          path: packages/insomnia-inso/artifacts