feat(desktop): automatic release pipeline (#1006)

* feat(desktop): automatic release pipeline * refactor(desktop-release): remove build number infer since we won't release locally * fix(desktop): correct MAS TestFlight release config
2026-07-30 17:46:14 -04:00 · 2026-06-23 11:38:11 +02:00
parent 3f48e935f5
commit cd90abd3fe
13 changed files with 718 additions and 10 deletions
--- a/.github/workflows/desktop-release.yml
+++ b/.github/workflows/desktop-release.yml
@@ -0,0 +1,125 @@
+name: Desktop Release
+
+on:
+  workflow_call:
+    inputs:
+      release_tag:
+        required: true
+        type: string
+      publish_testflight:
+        required: false
+        type: boolean
+        default: false
+      upload_github_release:
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  testflight:
+    if: inputs.publish_testflight
+    environment: release
+    timeout-minutes: 30
+    runs-on: macos-15
+    permissions:
+      contents: read
+    env:
+      APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
+      APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
+      APP_STORE_CONNECT_API_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_KEY_BASE64 }}
+      CSC_LINK: ${{ secrets.CSC_LINK }}
+      CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+      ZEROBYTE_DESKTOP_VERSION: ${{ inputs.release_tag }}
+      ZEROBYTE_EXPORT_COMPLIANCE_CODE: ${{ secrets.ZEROBYTE_EXPORT_COMPLIANCE_CODE }}
+      ZEROBYTE_MAS_PROVISIONING_PROFILE_BASE64: ${{ secrets.ZEROBYTE_MAS_PROVISIONING_PROFILE_BASE64 }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 0
+          ref: ${{ github.ref }}
+
+      - name: Install dependencies
+        uses: "./.github/actions/install-dependencies"
+
+      - name: Install Fastlane dependencies
+        working-directory: apps/desktop
+        run: bundle install
+
+      - name: Write MAS provisioning profile
+        run: |
+          : "${ZEROBYTE_MAS_PROVISIONING_PROFILE_BASE64:?Set ZEROBYTE_MAS_PROVISIONING_PROFILE_BASE64 secret}"
+          profile_path="$RUNNER_TEMP/mac-app-store.provisionprofile"
+          echo "ZEROBYTE_MAS_PROVISIONING_PROFILE=$profile_path" >> "$GITHUB_ENV"
+          printf '%s' "$ZEROBYTE_MAS_PROVISIONING_PROFILE_BASE64" | base64 --decode > "$profile_path"
+          chmod 600 "$profile_path"
+
+      - name: Build and upload to TestFlight
+        working-directory: apps/desktop
+        env:
+          FASTLANE_HIDE_CHANGELOG: "true"
+          FASTLANE_SKIP_UPDATE_CHECK: "true"
+        run: bundle exec fastlane mac beta
+
+      - name: Clean TestFlight release secrets
+        if: always()
+        run: |
+          if [ -n "${ZEROBYTE_MAS_PROVISIONING_PROFILE:-}" ]; then
+            rm -f "$ZEROBYTE_MAS_PROVISIONING_PROFILE"
+          fi
+          rm -rf apps/desktop/dist/mas-arm64
+
+  github-release:
+    if: inputs.upload_github_release
+    environment: release
+    timeout-minutes: 30
+    runs-on: macos-15
+    permissions:
+      contents: read
+    env:
+      APP_STORE_CONNECT_API_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_KEY_BASE64 }}
+      APPLE_API_KEY: ${{ runner.temp }}/AuthKey.p8
+      APPLE_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
+      APPLE_API_ISSUER: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
+      CSC_LINK: ${{ secrets.CSC_LINK }}
+      CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+      ZEROBYTE_DESKTOP_VERSION: ${{ inputs.release_tag }}
+      ZEROBYTE_EXPORT_COMPLIANCE_CODE: ${{ secrets.ZEROBYTE_EXPORT_COMPLIANCE_CODE }}
+      ZEROBYTE_MAC_SIGN: "true"
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 0
+          ref: ${{ github.ref }}
+
+      - name: Install dependencies
+        uses: "./.github/actions/install-dependencies"
+
+      - name: Write App Store Connect API key
+        run: |
+          printf '%s' "$APP_STORE_CONNECT_API_KEY_BASE64" | base64 --decode > "$APPLE_API_KEY"
+          chmod 600 "$APPLE_API_KEY"
+
+      - name: Build DMG
+        working-directory: apps/desktop
+        run: bun run make
+
+      - name: Upload DMG artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: desktop-github-release
+          path: |
+            apps/desktop/dist/*.dmg
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0
+
+      - name: Clean GitHub release secrets
+        if: always()
+        run: |
+          rm -f "$APPLE_API_KEY"
+          rm -rf apps/desktop/dist
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -107,6 +107,16 @@ jobs:
          build-args: |
            APP_VERSION=${{ needs.determine-release-type.outputs.tagname }}

+  publish-desktop-testflight:
+    needs: [determine-release-type, checks, e2e-tests, integration-tests]
+    uses: ./.github/workflows/desktop-release.yml
+    permissions:
+      contents: read
+    with:
+      release_tag: ${{ needs.determine-release-type.outputs.tagname }}
+      publish_testflight: true
+    secrets: inherit
+
  publish-release:
    runs-on: ubuntu-latest
    needs: [build-images, determine-release-type]
--- a/apps/desktop/.gitignore
+++ b/apps/desktop/.gitignore
@@ -2,3 +2,12 @@
 .runtime
 out
 dist
+profiles/*.provisionprofile
+fastlane/.env
+fastlane/.env.*
+!fastlane/.env.example
+fastlane/AuthKey_*.p8
+fastlane/report.xml
+fastlane/Preview.html
+fastlane/screenshots
+fastlane/test_output
--- a/apps/desktop/Gemfile
+++ b/apps/desktop/Gemfile
@@ -0,0 +1,3 @@
+source "https://rubygems.org"
+
+gem "fastlane", "~> 2.236"
--- a/apps/desktop/Gemfile.lock
+++ b/apps/desktop/Gemfile.lock
@@ -0,0 +1,341 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    CFPropertyList (3.0.8)
+    abbrev (0.1.2)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
+    artifactory (3.0.17)
+    atomos (0.1.3)
+    aws-eventstream (1.4.0)
+    aws-partitions (1.1261.0)
+    aws-sdk-core (3.252.0)
+      aws-eventstream (~> 1, >= 1.3.0)
+      aws-partitions (~> 1, >= 1.992.0)
+      aws-sigv4 (~> 1.9)
+      base64
+      bigdecimal
+      jmespath (~> 1, >= 1.6.1)
+      logger
+    aws-sdk-kms (1.129.0)
+      aws-sdk-core (~> 3, >= 3.248.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-s3 (1.226.0)
+      aws-sdk-core (~> 3, >= 3.248.0)
+      aws-sdk-kms (~> 1)
+      aws-sigv4 (~> 1.5)
+    aws-sigv4 (1.12.1)
+      aws-eventstream (~> 1, >= 1.0.2)
+    babosa (1.0.4)
+    base64 (0.3.0)
+    benchmark (0.5.0)
+    bigdecimal (4.1.2)
+    claide (1.1.0)
+    colored (1.2)
+    colored2 (3.1.2)
+    commander (4.6.0)
+      highline (~> 2.0.0)
+    csv (3.3.5)
+    declarative (0.0.20)
+    digest-crc (0.7.0)
+      rake (>= 12.0.0, < 14.0.0)
+    domain_name (0.6.20240107)
+    dotenv (2.8.1)
+    emoji_regex (3.2.3)
+    excon (0.112.0)
+    faraday (1.10.5)
+      faraday-em_http (~> 1.0)
+      faraday-em_synchrony (~> 1.0)
+      faraday-excon (~> 1.1)
+      faraday-httpclient (~> 1.0)
+      faraday-multipart (~> 1.0)
+      faraday-net_http (~> 1.0)
+      faraday-net_http_persistent (~> 1.0)
+      faraday-patron (~> 1.0)
+      faraday-rack (~> 1.0)
+      faraday-retry (~> 1.0)
+      ruby2_keywords (>= 0.0.4)
+    faraday-cookie_jar (0.0.8)
+      faraday (>= 0.8.0)
+      http-cookie (>= 1.0.0)
+    faraday-em_http (1.0.0)
+    faraday-em_synchrony (1.0.1)
+    faraday-excon (1.1.0)
+    faraday-httpclient (1.0.1)
+    faraday-multipart (1.2.0)
+      multipart-post (~> 2.0)
+    faraday-net_http (1.0.2)
+    faraday-net_http_persistent (1.2.0)
+    faraday-patron (1.0.0)
+    faraday-rack (1.0.0)
+    faraday-retry (1.0.4)
+    faraday_middleware (1.2.1)
+      faraday (~> 1.0)
+    fastimage (2.4.1)
+    fastlane (2.236.1)
+      CFPropertyList (>= 2.3, < 5.0.0)
+      abbrev (~> 0.1)
+      addressable (>= 2.8, < 3.0.0)
+      artifactory (~> 3.0)
+      aws-sdk-s3 (~> 1.197)
+      babosa (>= 1.0.3, < 2.0.0)
+      base64 (~> 0.2)
+      benchmark (>= 0.1.0)
+      bundler (>= 2.4.0, < 5.0.0)
+      colored (~> 1.2)
+      commander (~> 4.6)
+      csv (~> 3.3)
+      dotenv (>= 2.1.1, < 3.0.0)
+      emoji_regex (>= 0.1, < 4.0)
+      excon (>= 0.71.0, < 1.0.0)
+      faraday (~> 1.0)
+      faraday-cookie_jar (~> 0.0.6)
+      faraday_middleware (~> 1.0)
+      fastimage (>= 2.1.0, < 3.0.0)
+      fastlane-sirp (>= 1.1.0)
+      gh_inspector (>= 1.1.2, < 2.0.0)
+      google-apis-androidpublisher_v3 (~> 0.3)
+      google-apis-playcustomapp_v1 (~> 0.1)
+      google-cloud-env (>= 1.6.0, < 2.3.0)
+      google-cloud-storage (~> 1.31)
+      highline (~> 2.0)
+      http-cookie (~> 1.0.5)
+      json (< 3.0.0)
+      jwt (>= 2.10.3, < 4)
+      logger (>= 1.6, < 2.0)
+      mini_magick (>= 4.9.4, < 5.0.0)
+      multi_json (~> 1.12)
+      multipart-post (>= 2.0.0, < 3.0.0)
+      mutex_m (~> 0.3)
+      naturally (~> 2.2)
+      nkf (~> 0.2)
+      optparse (>= 0.1.1, < 1.0.0)
+      ostruct (>= 0.1.0)
+      plist (>= 3.1.0, < 4.0.0)
+      rubyzip (>= 2.0.0, < 3.0.0)
+      security (= 0.1.5)
+      simctl (~> 1.6.3)
+      terminal-notifier (>= 2.0.0, < 3.0.0)
+      terminal-table (~> 3)
+      tty-screen (>= 0.6.3, < 1.0.0)
+      tty-spinner (>= 0.8.0, < 1.0.0)
+      word_wrap (~> 1.0.0)
+      xcodeproj (>= 1.13.0, < 2.0.0)
+      xcpretty (~> 0.4.1)
+      xcpretty-travis-formatter (>= 0.0.3, < 2.0.0)
+    fastlane-sirp (1.1.0)
+    gh_inspector (1.1.3)
+    google-apis-androidpublisher_v3 (0.102.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-apis-core (0.18.0)
+      addressable (~> 2.5, >= 2.5.1)
+      googleauth (~> 1.9)
+      httpclient (>= 2.8.3, < 3.a)
+      mini_mime (~> 1.0)
+      mutex_m
+      representable (~> 3.0)
+      retriable (>= 2.0, < 4.a)
+    google-apis-iamcredentials_v1 (0.27.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-apis-playcustomapp_v1 (0.17.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-apis-storage_v1 (0.63.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-cloud-core (1.9.0)
+      google-cloud-env (>= 1.0, < 3.a)
+      google-cloud-errors (~> 1.0)
+    google-cloud-env (2.2.2)
+      base64 (~> 0.2)
+      faraday (>= 1.0, < 3.a)
+    google-cloud-errors (1.6.0)
+    google-cloud-storage (1.61.0)
+      addressable (~> 2.8)
+      digest-crc (~> 0.4)
+      google-apis-core (>= 0.18, < 2)
+      google-apis-iamcredentials_v1 (~> 0.18)
+      google-apis-storage_v1 (>= 0.42)
+      google-cloud-core (~> 1.6)
+      googleauth (~> 1.9)
+      mini_mime (~> 1.0)
+    google-logging-utils (0.2.0)
+    googleauth (1.17.1)
+      faraday (>= 1.0, < 3.a)
+      google-cloud-env (~> 2.2)
+      google-logging-utils (~> 0.1)
+      jwt (>= 1.4, < 4.0)
+      os (>= 0.9, < 2.0)
+      pstore (~> 0.1)
+      signet (>= 0.16, < 2.a)
+    highline (2.0.3)
+    http-cookie (1.0.8)
+      domain_name (~> 0.5)
+    httpclient (2.9.0)
+      mutex_m
+    jmespath (1.6.2)
+    json (2.19.9)
+    jwt (3.2.0)
+      base64
+    logger (1.7.0)
+    mini_magick (4.13.2)
+    mini_mime (1.1.5)
+    multi_json (1.21.1)
+    multipart-post (2.4.1)
+    mutex_m (0.3.0)
+    nanaimo (0.4.0)
+    naturally (2.3.0)
+    nkf (0.3.0)
+    optparse (0.8.1)
+    os (1.1.4)
+    ostruct (0.6.3)
+    plist (3.7.2)
+    pstore (0.2.1)
+    public_suffix (7.0.5)
+    rake (13.4.2)
+    representable (3.2.0)
+      declarative (< 0.1.0)
+      trailblazer-option (>= 0.1.1, < 0.2.0)
+      uber (< 0.2.0)
+    retriable (3.8.0)
+    rexml (3.4.4)
+    rouge (3.28.0)
+    ruby2_keywords (0.0.5)
+    rubyzip (2.4.1)
+    security (0.1.5)
+    signet (0.22.0)
+      addressable (~> 2.8)
+      faraday (>= 0.17.5, < 3.a)
+      jwt (>= 1.5, < 4.0)
+    simctl (1.6.10)
+      CFPropertyList
+      naturally
+    terminal-notifier (2.0.0)
+    terminal-table (3.0.2)
+      unicode-display_width (>= 1.1.1, < 3)
+    trailblazer-option (0.1.2)
+    tty-cursor (0.7.1)
+    tty-screen (0.8.2)
+    tty-spinner (0.9.3)
+      tty-cursor (~> 0.7)
+    uber (0.1.0)
+    unicode-display_width (2.6.0)
+    word_wrap (1.0.0)
+    xcodeproj (1.27.0)
+      CFPropertyList (>= 2.3.3, < 4.0)
+      atomos (~> 0.1.3)
+      claide (>= 1.0.2, < 2.0)
+      colored2 (~> 3.1)
+      nanaimo (~> 0.4.0)
+      rexml (>= 3.3.6, < 4.0)
+    xcpretty (0.4.1)
+      rouge (~> 3.28.0)
+    xcpretty-travis-formatter (1.0.1)
+      xcpretty (~> 0.2, >= 0.0.7)
+
+PLATFORMS
+  arm64-darwin-25
+  ruby
+
+DEPENDENCIES
+  fastlane (~> 2.236)
+
+CHECKSUMS
+  CFPropertyList (3.0.8) sha256=2c99d0d980536d3d7ab252f7bd59ac8be50fbdd1ff487c98c949bb66bb114261
+  abbrev (0.1.2) sha256=ad1b4eaaaed4cb722d5684d63949e4bde1d34f2a95e20db93aecfe7cbac74242
+  addressable (2.9.0) sha256=7fdf6ac3660f7f4e867a0838be3f6cf722ace541dd97767fa42bc6cfa980c7af
+  artifactory (3.0.17) sha256=3023d5c964c31674090d655a516f38ca75665c15084140c08b7f2841131af263
+  atomos (0.1.3) sha256=7d43b22f2454a36bace5532d30785b06de3711399cb1c6bf932573eda536789f
+  aws-eventstream (1.4.0) sha256=116bf85c436200d1060811e6f5d2d40c88f65448f2125bc77ffce5121e6e183b
+  aws-partitions (1.1261.0) sha256=89eda89781c1ea4e1be2a2dcdc72318c62c6171a01cdaeaa0cbecf3cea6f9fdc
+  aws-sdk-core (3.252.0) sha256=09c042cbfc2acf2239441cc9b982ebab2a999bed2ef6bdc51849e7b3d6e48a1c
+  aws-sdk-kms (1.129.0) sha256=363f548df321f4a4fcfd05523384e591060b400f8e65133ed7ef0793155a3343
+  aws-sdk-s3 (1.226.0) sha256=e599f431e006ec9b92c61ee0f14d3f658a1f6c8a1d623d2160be927ac958e2bf
+  aws-sigv4 (1.12.1) sha256=6973ff95cb0fd0dc58ba26e90e9510a2219525d07620c8babeb70ef831826c00
+  babosa (1.0.4) sha256=18dea450f595462ed7cb80595abd76b2e535db8c91b350f6c4b3d73986c5bc99
+  base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
+  benchmark (0.5.0) sha256=465df122341aedcb81a2a24b4d3bd19b6c67c1530713fd533f3ff034e419236c
+  bigdecimal (4.1.2) sha256=53d217666027eab4280346fba98e7d5b66baaae1b9c3c1c0ffe89d48188a3fbd
+  claide (1.1.0) sha256=6d3c5c089dde904d96aa30e73306d0d4bd444b1accb9b3125ce14a3c0183f82e
+  colored (1.2) sha256=9d82b47ac589ce7f6cab64b1f194a2009e9fd00c326a5357321f44afab2c1d2c
+  colored2 (3.1.2) sha256=b13c2bd7eeae2cf7356a62501d398e72fde78780bd26aec6a979578293c28b4a
+  commander (4.6.0) sha256=7d1ddc3fccae60cc906b4131b916107e2ef0108858f485fdda30610c0f2913d9
+  csv (3.3.5) sha256=6e5134ac3383ef728b7f02725d9872934f523cb40b961479f69cf3afa6c8e73f
+  declarative (0.0.20) sha256=8021dd6cb17ab2b61233c56903d3f5a259c5cf43c80ff332d447d395b17d9ff9
+  digest-crc (0.7.0) sha256=64adc23a26a241044cbe6732477ca1b3c281d79e2240bcff275a37a5a0d78c07
+  domain_name (0.6.20240107) sha256=5f693b2215708476517479bf2b3802e49068ad82167bcd2286f899536a17d933
+  dotenv (2.8.1) sha256=c5944793349ae03c432e1780a2ca929d60b88c7d14d52d630db0508c3a8a17d8
+  emoji_regex (3.2.3) sha256=ecd8be856b7691406c6bf3bb3a5e55d6ed683ffab98b4aa531bb90e1ddcc564b
+  excon (0.112.0) sha256=daf9ac3a4c2fc9aa48383a33da77ecb44fa395111e973084d5c52f6f214ae0f0
+  faraday (1.10.5) sha256=b144f1d2b045652fa820b5f532723e1643cc28b93dae911d784e5c5f88e8f6ed
+  faraday-cookie_jar (0.0.8) sha256=0140605823f8cc63c7028fccee486aaed8e54835c360cffc1f7c8c07c4299dbb
+  faraday-em_http (1.0.0) sha256=7a3d4c7079789121054f57e08cd4ef7e40ad1549b63101f38c7093a9d6c59689
+  faraday-em_synchrony (1.0.1) sha256=bf3ce45dcf543088d319ab051f80985ea6d294930635b7a0b966563179f81750
+  faraday-excon (1.1.0) sha256=b055c842376734d7f74350fe8611542ae2000c5387348d9ba9708109d6e40940
+  faraday-httpclient (1.0.1) sha256=4c8ff1f0973ff835be8d043ef16aaf54f47f25b7578f6d916deee8399a04d33b
+  faraday-multipart (1.2.0) sha256=7d89a949693714176f612323ca13746a2ded204031a6ba528adee788694ef757
+  faraday-net_http (1.0.2) sha256=63992efea42c925a20818cf3c0830947948541fdcf345842755510d266e4c682
+  faraday-net_http_persistent (1.2.0) sha256=0b0cbc8f03dab943c3e1cc58d8b7beb142d9df068b39c718cd83e39260348335
+  faraday-patron (1.0.0) sha256=dc2cd7b340bb3cc8e36bcb9e6e7eff43d134b6d526d5f3429c7a7680ddd38fa7
+  faraday-rack (1.0.0) sha256=ef60ec969a2bb95b8dbf24400155aee64a00fc8ba6c6a4d3968562bcc92328c0
+  faraday-retry (1.0.4) sha256=dc659233777fabf96c69c2ffe56c0a5d2c102af90321a42cc6c90157bcd716aa
+  faraday_middleware (1.2.1) sha256=d45b78c8ee864c4783fbc276f845243d4a7918a67301c052647bacabec0529e9
+  fastimage (2.4.1) sha256=c64bebd46b6fd8943ab70c1e6e85ff728f970f2e48f92ecd249b6bc3a540ad20
+  fastlane (2.236.1) sha256=fb89e618e0f38636e487743622cf710ad722723f5d33a63f19e367f84d3770bc
+  fastlane-sirp (1.1.0) sha256=10bc94f9682efd8e1badfb31452a76dd8981f1f3a33717c765fde6d75b54d847
+  gh_inspector (1.1.3) sha256=04cca7171b87164e053aa43147971d3b7f500fcb58177698886b48a9fc4a1939
+  google-apis-androidpublisher_v3 (0.102.0) sha256=562415c44bd7f81cc808abbea11845ede16cdc3696d95f95efcf50aaffb159cf
+  google-apis-core (0.18.0) sha256=96b057816feeeab448139ed5b5c78eab7fc2a9d8958f0fbc8217dedffad054ee
+  google-apis-iamcredentials_v1 (0.27.0) sha256=9289f29968610754ef11d98b9ec627f0153f3e2616fef839aef096de529f6d1e
+  google-apis-playcustomapp_v1 (0.17.0) sha256=d5bc90b705f3f862bab4998086449b0abe704ee1685a84821daa90ca7fa95a78
+  google-apis-storage_v1 (0.63.0) sha256=7063a6c19c40f5ef96d5894df33c4f9ac915e3107e632b1870ba5247e3bb633f
+  google-cloud-core (1.9.0) sha256=ab55409f51488e8deefb6edcc1ce4771dfb5da2fe7b3bc075709a030c2b682a4
+  google-cloud-env (2.2.2) sha256=94bed40e05a67e9468ce1cb38389fba9a90aa8fc62fc9e173204c1dca59e21e7
+  google-cloud-errors (1.6.0) sha256=1da8476dd706ad04b9d32e3c4b90d07d3463b37d6407cb56d41342ea7647d0a1
+  google-cloud-storage (1.61.0) sha256=a77f10f4a603289948b09e81c3e23d762a18733fd69d70a4c1399663fbd96002
+  google-logging-utils (0.2.0) sha256=675462b4ea5affa825a3442694ca2d75d0069455a1d0956127207498fca3df7b
+  googleauth (1.17.1) sha256=0f7e6fc70e204cee1b2d71f1e1de2d3b349d432404197fe68ebf7fa23d0821b9
+  highline (2.0.3) sha256=2ddd5c127d4692721486f91737307236fe005352d12a4202e26c48614f719479
+  http-cookie (1.0.8) sha256=b14fe0445cf24bf9ae098633e9b8d42e4c07c3c1f700672b09fbfe32ffd41aa6
+  httpclient (2.9.0) sha256=4b645958e494b2f86c2f8a2f304c959baa273a310e77a2931ddb986d83e498c8
+  jmespath (1.6.2) sha256=238d774a58723d6c090494c8879b5e9918c19485f7e840f2c1c7532cf84ebcb1
+  json (2.19.9) sha256=9b9025b7cdddafa38d316eca0b2358488e42d417045c1b90d216a9fefe46b79a
+  jwt (3.2.0) sha256=5419b1fe37b1da0982bd07051f573a8b8789ab724c2aa7e785e4784a3ed217d7
+  logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203
+  mini_magick (4.13.2) sha256=71d6258e0e8a3d04a9a0a09784d5d857b403a198a51dd4f882510435eb95ddd9
+  mini_mime (1.1.5) sha256=8681b7e2e4215f2a159f9400b5816d85e9d8c6c6b491e96a12797e798f8bccef
+  multi_json (1.21.1) sha256=e6126a31808e3b4d19f483c775ceac34df190dffa62adfb63a165ee14ba68080
+  multipart-post (2.4.1) sha256=9872d03a8e552020ca096adadbf5e3cb1cd1cdd6acd3c161136b8a5737cdb4a8
+  mutex_m (0.3.0) sha256=cfcb04ac16b69c4813777022fdceda24e9f798e48092a2b817eb4c0a782b0751
+  nanaimo (0.4.0) sha256=faf069551bab17f15169c1f74a1c73c220657e71b6e900919897a10d991d0723
+  naturally (2.3.0) sha256=459923cf76c2e6613048301742363200c3c7e4904c324097d54a67401e179e01
+  nkf (0.3.0) sha256=357a8dbeba38b727b75930f665146546076a394a1c243faf634ff176e3588895
+  optparse (0.8.1) sha256=42bea10d53907ccff4f080a69991441d611fbf8733b60ed1ce9ee365ce03bd1a
+  os (1.1.4) sha256=57816d6a334e7bd6aed048f4b0308226c5fb027433b67d90a9ab435f35108d3f
+  ostruct (0.6.3) sha256=95a2ed4a4bd1d190784e666b47b2d3f078e4a9efda2fccf18f84ddc6538ed912
+  plist (3.7.2) sha256=d37a4527cc1116064393df4b40e1dbbc94c65fa9ca2eec52edf9a13616718a42
+  pstore (0.2.1) sha256=03904d0f2c66579e96d1e6704cdabc0c88df7ea8ed8782d9f3569f6f6c702c1a
+  public_suffix (7.0.5) sha256=1a8bb08f1bbea19228d3bed6e5ed908d1cb4f7c2726d18bd9cadf60bc676f623
+  rake (13.4.2) sha256=cb825b2bd5f1f8e91ca37bddb4b9aaf345551b4731da62949be002fa89283701
+  representable (3.2.0) sha256=cc29bf7eebc31653586849371a43ffe36c60b54b0a6365b5f7d95ec34d1ebace
+  retriable (3.8.0) sha256=9f2f1b0207594c7817f17f671587b8ec7587387ac6cebda6c941a802bb98a8e5
+  rexml (3.4.4) sha256=19e0a2c3425dfbf2d4fc1189747bdb2f849b6c5e74180401b15734bc97b5d142
+  rouge (3.28.0) sha256=0d6de482c7624000d92697772ab14e48dca35629f8ddf3f4b21c99183fd70e20
+  ruby2_keywords (0.0.5) sha256=ffd13740c573b7301cf7a2e61fc857b2a8e3d3aff32545d6f8300d8bae10e3ef
+  rubyzip (2.4.1) sha256=8577c88edc1fde8935eb91064c5cb1aef9ad5494b940cf19c775ee833e075615
+  security (0.1.5) sha256=3a977a0eca7706e804c96db0dd9619e0a94969fe3aac9680fcfc2bf9b8a833b7
+  signet (0.22.0) sha256=b76d495ccb07ad35dbc89f3e920665a9d8ed717141955034005d7843dcfe4780
+  simctl (1.6.10) sha256=b99077f4d13ad81eace9f86bf5ba4df1b0b893a4d1b368bd3ed59b5b27f9236b
+  terminal-notifier (2.0.0) sha256=7a0d2b2212ab9835c07f4b2e22a94cff64149dba1eed203c04835f7991078cea
+  terminal-table (3.0.2) sha256=f951b6af5f3e00203fb290a669e0a85c5dd5b051b3b023392ccfd67ba5abae91
+  trailblazer-option (0.1.2) sha256=20e4f12ea4e1f718c8007e7944ca21a329eee4eed9e0fa5dde6e8ad8ac4344a3
+  tty-cursor (0.7.1) sha256=79534185e6a777888d88628b14b6a1fdf5154a603f285f80b1753e1908e0bf48
+  tty-screen (0.8.2) sha256=c090652115beae764336c28802d633f204fb84da93c6a968aa5d8e319e819b50
+  tty-spinner (0.9.3) sha256=0e036f047b4ffb61f2aa45f5a770ec00b4d04130531558a94bfc5b192b570542
+  uber (0.1.0) sha256=5beeb407ff807b5db994f82fa9ee07cfceaa561dad8af20be880bc67eba935dc
+  unicode-display_width (2.6.0) sha256=12279874bba6d5e4d2728cef814b19197dbb10d7a7837a869bab65da943b7f5a
+  word_wrap (1.0.0) sha256=f556d4224c812e371000f12a6ee8102e0daa724a314c3f246afaad76d82accc7
+  xcodeproj (1.27.0) sha256=8cc7a73b4505c227deab044dce118ede787041c702bc47636856a2e566f854d3
+  xcpretty (0.4.1) sha256=b14c50e721f6589ee3d6f5353e2c2cfcd8541fa1ea16d6c602807dd7327f3892
+  xcpretty-travis-formatter (1.0.1) sha256=aacc332f17cb7b2cba222994e2adc74223db88724fe76341483ad3098e232f93
+
+BUNDLED WITH
+  4.0.11
--- a/apps/desktop/assets/icon.icns
+++ b/apps/desktop/assets/icon.icns
--- a/apps/desktop/electron-builder.config.cjs
+++ b/apps/desktop/electron-builder.config.cjs
@@ -1,12 +1,59 @@
 const path = require("node:path");
-const { spawn } = require("node:child_process");
+const { execFileSync, spawn } = require("node:child_process");
+const { Arch } = require("electron-builder");

 const desktopDir = __dirname;
+const repoRoot = path.resolve(desktopDir, "..", "..");
 const runtimeResourceDir = path.resolve(desktopDir, "..", "..", "tmp", "desktop", "zerobyte-runtime");
 const shouldNotarize = Boolean(
 	process.env.APPLE_API_KEY && process.env.APPLE_API_KEY_ID && process.env.APPLE_API_ISSUER,
 );
-const shouldSign = process.env.ZEROBYTE_MAC_SIGN === "true" || shouldNotarize;
+const isMasTarget = process.argv.some((arg) => arg === "mas" || arg === "mas-dev" || arg.includes("--mac=mas"));
+const shouldSign = process.env.ZEROBYTE_MAC_SIGN === "true" || shouldNotarize || isMasTarget;
+
+const readCurrentGitTag = () => {
+	try {
+		return execFileSync("git", ["describe", "--tags", "--exact-match"], {
+			cwd: repoRoot,
+			encoding: "utf-8",
+			stdio: ["ignore", "pipe", "ignore"],
+		}).trim();
+	} catch {
+		return undefined;
+	}
+};
+
+let releaseVersion = process.env.ZEROBYTE_DESKTOP_VERSION;
+if (!releaseVersion) releaseVersion = process.env.APP_VERSION;
+if (!releaseVersion) releaseVersion = process.env.GITHUB_REF_NAME;
+if (!releaseVersion) releaseVersion = readCurrentGitTag();
+
+const releaseTag = releaseVersion?.replace(/^refs\/tags\//, "");
+const appStoreVersion = releaseTag?.replace(/^v/, "").match(/^\d+\.\d+\.\d+/)?.[0];
+const buildNumber = process.env.ZEROBYTE_BUILD_NUMBER || process.env.GITHUB_RUN_NUMBER;
+const exportComplianceCode =
+	process.env.ZEROBYTE_EXPORT_COMPLIANCE_CODE || process.env.APP_STORE_EXPORT_COMPLIANCE_CODE;
+const masProvisioningProfile =
+	process.env.ZEROBYTE_MAS_PROVISIONING_PROFILE || path.join(desktopDir, "profiles", "mac-app-store.provisionprofile");
+const masDevProvisioningProfile =
+	process.env.ZEROBYTE_MAS_DEV_PROVISIONING_PROFILE ||
+	path.join(desktopDir, "profiles", "mac-development.provisionprofile");
+
+if (releaseTag && !process.env.APP_VERSION) {
+	process.env.APP_VERSION = releaseTag;
+}
+if (releaseTag && !process.env.VITE_APP_VERSION) {
+	process.env.VITE_APP_VERSION = releaseTag;
+}
+
+if (!releaseTag || !appStoreVersion) {
+	throw new Error("Desktop builds require a release version like v0.39.0 or v0.39.0-beta.3.");
+}
+
+const archNames = {
+	[Arch.x64]: "x64",
+	[Arch.arm64]: "arm64",
+};

 const run = (command, args) =>
 	new Promise((resolve, reject) => {
@@ -27,17 +74,24 @@ const run = (command, args) =>
 		});
 	});

-const prepareRuntime = async ({ electronPlatformName }) => {
+const prepareRuntime = async ({ electronPlatformName, arch }) => {
+	const archName = archNames[arch];
+	const runtimePlatformName = electronPlatformName === "mas" ? "darwin" : electronPlatformName;
+	if (!archName) {
+		throw new Error(`Unsupported desktop target architecture: ${arch}`);
+	}
+
 	await run("bun", ["run", "build:electron"]);
-	await run("bun", ["scripts/prepare-runtime.ts", "--platform", electronPlatformName, "--arch", "arm64"]);
+	await run("bun", ["scripts/prepare-runtime.ts", "--platform", runtimePlatformName, "--arch", archName]);
 };

 /** @type {import("electron-builder").Configuration} */
 const config = {
 	appId: "com.nicotsx.zerobyte",
 	productName: "Zerobyte",
+	extraMetadata: { version: appStoreVersion },
 	asar: true,
-	artifactName: "${productName}-${version}-${os}-${arch}.${ext}",
+	artifactName: `\${productName}-${releaseTag}-\${os}-\${arch}.\${ext}`,
 	directories: {
 		output: "dist",
 		buildResources: "assets",
@@ -56,22 +110,32 @@ const config = {
 	mac: {
 		category: "public.app-category.utilities",
 		icon: "assets/icon.icns",
+		extendInfo: {
+			ITSAppUsesNonExemptEncryption: Boolean(exportComplianceCode),
+			...(exportComplianceCode ? { ITSEncryptionExportComplianceCode: exportComplianceCode } : {}),
+		},
 		target: [
 			{
 				target: "dmg",
 				arch: ["arm64"],
 			},
-			{
-				target: "zip",
-				arch: ["arm64"],
-			},
 		],
 		hardenedRuntime: true,
 		entitlements: "electron/entitlements.mac.plist",
 		entitlementsInherit: "electron/entitlements.mac.plist",
+		...(buildNumber ? { bundleVersion: buildNumber } : {}),
 		...(shouldSign ? {} : { identity: null }),
 		...(shouldNotarize ? { notarize: true } : {}),
 	},
+	mas: {
+		hardenedRuntime: false,
+		entitlements: "electron/entitlements.mas.plist",
+		entitlementsInherit: "electron/entitlements.mas.inherit.plist",
+		provisioningProfile: masProvisioningProfile,
+	},
+	masDev: {
+		provisioningProfile: masDevProvisioningProfile,
+	},
 	dmg: {
 		background: "assets/dmg-background.png",
 		icon: "assets/icon.icns",
--- a/apps/desktop/electron/desktop-runtime.ts
+++ b/apps/desktop/electron/desktop-runtime.ts
@@ -24,6 +24,10 @@ export type DesktopRuntime = {

 const ownerOnlyDirMode = 0o700;
 const ownerOnlyFileMode = 0o600;
+const desktopAppVersion = import.meta.env.VITE_APP_VERSION;
+if (app.isPackaged && !desktopAppVersion) {
+	throw new Error("Packaged desktop app is missing VITE_APP_VERSION.");
+}

 const chmodIfSupported = async (targetPath: string, mode: number) => {
 	if (process.platform !== "win32") {
@@ -99,7 +103,7 @@ const createServerEnv = (port: number, dirs: DesktopDirs, serverUrl: string, lau
 	BASE_URL: serverUrl,
 	TRUSTED_ORIGINS: serverUrl,
 	APP_SECRET: dirs.appSecret,
-	APP_VERSION: app.getVersion(),
+	APP_VERSION: desktopAppVersion,
 	ZEROBYTE_RUNTIME: "desktop",
 	ZEROBYTE_DESKTOP_LAUNCH_SECRET: launchSecret,
 	ZEROBYTE_DATABASE_URL: path.join(dirs.dataDir, "zerobyte.db"),
--- a/apps/desktop/electron/entitlements.mas.inherit.plist
+++ b/apps/desktop/electron/entitlements.mas.inherit.plist
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.security.app-sandbox</key>
+	<true/>
+	<key>com.apple.security.inherit</key>
+	<true/>
+</dict>
+</plist>
--- a/apps/desktop/electron/entitlements.mas.plist
+++ b/apps/desktop/electron/entitlements.mas.plist
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.security.app-sandbox</key>
+	<true/>
+	<key>com.apple.security.cs.allow-jit</key>
+	<true/>
+	<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+	<true/>
+	<key>com.apple.security.files.user-selected.read-write</key>
+	<true/>
+	<key>com.apple.security.network.client</key>
+	<true/>
+	<key>com.apple.security.network.server</key>
+	<true/>
+</dict>
+</plist>
--- a/apps/desktop/fastlane/.env.example
+++ b/apps/desktop/fastlane/.env.example
@@ -0,0 +1,3 @@
+APP_STORE_CONNECT_API_KEY_ID=
+APP_STORE_CONNECT_ISSUER_ID=
+APP_STORE_CONNECT_API_KEY_PATH=fastlane/AuthKey_YOUR_KEY_ID.p8
--- a/apps/desktop/fastlane/Fastfile
+++ b/apps/desktop/fastlane/Fastfile
@@ -0,0 +1,118 @@
+require "shellwords"
+require "fileutils"
+
+opt_out_usage
+default_platform(:mac)
+
+DESKTOP_DIR = File.expand_path("..", __dir__)
+APP_IDENTIFIER = "com.nicotsx.zerobyte"
+
+def env_value(*names)
+	names.each do |name|
+		value = ENV[name]
+		return value unless value.nil? || value.empty?
+	end
+
+	nil
+end
+
+def latest_mas_pkg
+	configured_pkg = env_value("ZEROBYTE_MAS_PKG")
+	return File.expand_path(configured_pkg, DESKTOP_DIR) if configured_pkg
+
+	packages = Dir[File.join(DESKTOP_DIR, "dist", "mas-arm64", "*.pkg")]
+	UI.user_error!("No MAS package found. Run `bundle exec fastlane mac build_mas` first.") if packages.empty?
+
+	packages.max_by { |path| File.mtime(path) }
+end
+
+def prepare_mas_output
+	output_dir = File.join(DESKTOP_DIR, "dist", "mas-arm64")
+	app_dir = File.join(output_dir, "Zerobyte.app")
+	return unless File.exist?(app_dir)
+	return if File.stat(app_dir).uid == Process.uid && File.writable?(app_dir)
+
+	stale_output_dir = "#{output_dir}.stale.#{Time.now.strftime("%Y%m%d%H%M%S")}"
+	FileUtils.mv(output_dir, stale_output_dir)
+	FileUtils.mkdir_p(output_dir)
+	UI.important("Moved stale MAS output to #{stale_output_dir}")
+end
+
+def app_store_api_key
+	return @app_store_api_key if @app_store_api_key
+
+	key_id = env_value("APP_STORE_CONNECT_API_KEY_ID", "ASC_KEY_ID")
+	issuer_id = env_value("APP_STORE_CONNECT_ISSUER_ID", "ASC_ISSUER_ID")
+	key_filepath = env_value("APP_STORE_CONNECT_API_KEY_PATH", "ASC_KEY_PATH")
+	key_content = env_value("APP_STORE_CONNECT_API_KEY_CONTENT", "ASC_KEY_CONTENT")
+	key_content_base64 = env_value("APP_STORE_CONNECT_API_KEY_BASE64", "ASC_KEY_BASE64")
+
+	UI.user_error!("Set APP_STORE_CONNECT_API_KEY_ID or ASC_KEY_ID.") unless key_id
+	UI.user_error!("Set APP_STORE_CONNECT_ISSUER_ID or ASC_ISSUER_ID.") unless issuer_id
+
+	options = {
+		key_id: key_id,
+		issuer_id: issuer_id,
+	}
+
+	if key_filepath
+		options[:key_filepath] = File.expand_path(key_filepath, DESKTOP_DIR)
+	elsif key_content_base64
+		options[:key_content] = key_content_base64
+		options[:is_key_content_base64] = true
+	elsif key_content
+		options[:key_content] = key_content
+	else
+		UI.user_error!(
+			"Set APP_STORE_CONNECT_API_KEY_PATH, APP_STORE_CONNECT_API_KEY_CONTENT, or APP_STORE_CONNECT_API_KEY_BASE64.",
+		)
+	end
+
+	@app_store_api_key = app_store_connect_api_key(**options)
+end
+
+def mas_build_number
+	explicit_build_number = env_value("ZEROBYTE_BUILD_NUMBER")
+	return explicit_build_number if explicit_build_number
+
+	run_number = env_value("GITHUB_RUN_NUMBER")
+	run_attempt = env_value("GITHUB_RUN_ATTEMPT")
+	return [run_number, run_attempt].compact.join(".") if run_number
+
+	UI.user_error!("Set ZEROBYTE_BUILD_NUMBER or GITHUB_RUN_NUMBER.")
+end
+
+platform :mac do
+	desc "Build the signed Mac App Store package"
+	lane :build_mas do
+		build_number = mas_build_number
+		env = "ZEROBYTE_BUILD_NUMBER=#{Shellwords.escape(build_number)} "
+
+		prepare_mas_output
+		sh("cd #{Shellwords.escape(DESKTOP_DIR)} && #{env}bun run make:mas")
+	end
+
+	desc "Upload the latest signed Mac App Store package to App Store Connect"
+	lane :upload_testflight do
+		pkg = latest_mas_pkg
+		UI.message("Uploading #{pkg}")
+
+		upload_to_app_store(
+			api_key: app_store_api_key,
+			app_identifier: APP_IDENTIFIER,
+			pkg: pkg,
+			platform: "osx",
+			skip_metadata: true,
+			skip_screenshots: true,
+			skip_app_version_update: true,
+			force: true,
+			run_precheck_before_submit: false,
+		)
+	end
+
+	desc "Build and upload the Mac App Store package to App Store Connect"
+	lane :beta do |options|
+		build_mas unless options[:skip_build] || ENV["ZEROBYTE_SKIP_MAS_BUILD"] == "true"
+		upload_testflight
+	end
+end
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -9,6 +9,9 @@
 		"build:electron": "vite build --config vite.main.config.ts",
 		"package": "electron-builder --config electron-builder.config.cjs --mac dir --publish never",
 		"make": "electron-builder --config electron-builder.config.cjs --mac --publish never",
+		"make:mas": "electron-builder --config electron-builder.config.cjs --mac mas --publish never",
+		"make:mas-dev": "electron-builder --config electron-builder.config.cjs --mac mas-dev --publish never",
+		"publish": "electron-builder --config electron-builder.config.cjs --mac --publish always",
 		"tsc": "tsc --noEmit"
 	},
 	"dependencies": {