From 746aa694053e1cc6745194375ff4fa4eb8cfc88c Mon Sep 17 00:00:00 2001
From: Psychotoxical <dev@psysonic.app>
Date: Thu, 2 Apr 2026 02:53:08 +0200
Subject: [PATCH] fix: explicit bundle signing step after tauri-action

---
 .github/workflows/release.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 623717cd..d676aad4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -109,6 +109,24 @@ jobs:
           releaseId: ${{ needs.create-release.outputs.release_id }}
           args: ${{ matrix.settings.args }}
 
+      - name: sign and upload bundle signature
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ needs.create-release.outputs.package_version }}
+        run: |
+          if [[ "${{ matrix.settings.platform }}" == "macos-latest" ]]; then
+            if [[ "${{ matrix.settings.args }}" == *"aarch64"* ]]; then
+              BUNDLE="src-tauri/target/aarch64-apple-darwin/release/bundle/macos/Psysonic.app.tar.gz"
+            else
+              BUNDLE="src-tauri/target/x86_64-apple-darwin/release/bundle/macos/Psysonic.app.tar.gz"
+            fi
+          else
+            BUNDLE=$(find src-tauri/target/release/bundle/nsis -name "*.nsis.zip" | head -1)
+          fi
+          npx tauri signer sign --private-key "$TAURI_SIGNING_PRIVATE_KEY" --password "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$BUNDLE"
+          gh release upload "app-v${VERSION}" "${BUNDLE}.sig" --clobber
+
   build-linux:
     needs: create-release
     permissions: