ci: add macOS release workflow (unsigned DMG)

Builds DMG for both Apple Silicon (aarch64) and Intel (x86_64).
Triggered on tag push or manual dispatch. Artifacts uploaded to
GitHub Releases as pre-release.

Unsigned — users bypass Gatekeeper with right-click > Open.

cc

.github/workflows/release-macos.yml

@@ -0,0 +1,130 @@
+name: release-macos
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Optional release tag to build (e.g. v1.2.1)"
+        required: false
+        type: string
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  build-macos:
+    strategy:
+      matrix:
+        include:
+          - runner: macos-latest
+            target: aarch64-apple-darwin
+            arch: aarch64
+          - runner: macos-13
+            target: x86_64-apple-darwin
+            arch: x86_64
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Resolve release version
+        id: release
+        run: |
+          VERSION=""
+          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
+            VERSION="${GITHUB_REF#refs/tags/v}"
+          elif [[ -n "${{ inputs.tag }}" ]]; then
+            VERSION="${{ inputs.tag }}"
+            VERSION="${VERSION#v}"
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Sync version to build metadata
+        if: steps.release.outputs.version != ''
+        env:
+          QBZ_VERSION: ${{ steps.release.outputs.version }}
+        run: |
+          python3 - <<'PY'
+          import json
+          import os
+          import pathlib
+          import re
+
+          version = os.environ["QBZ_VERSION"]
+
+          def update_json(path, updater):
+              p = pathlib.Path(path)
+              data = json.loads(p.read_text(encoding="utf-8"))
+              updater(data)
+              p.write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8")
+
+          update_json("package.json", lambda d: d.__setitem__("version", version))
+
+          def update_lock(d):
+              d["version"] = version
+              packages = d.get("packages")
+              if isinstance(packages, dict) and "" in packages:
+                  packages[""]["version"] = version
+          update_json("package-lock.json", update_lock)
+
+          update_json("src-tauri/tauri.conf.json", lambda d: d.__setitem__("version", version))
+
+          cargo_path = pathlib.Path("src-tauri/Cargo.toml")
+          cargo_text = cargo_path.read_text(encoding="utf-8")
+          cargo_text = re.sub(r'(?m)^version = \"[^\"]+\"', f'version = \"{version}\"', cargo_text, count=1)
+          cargo_path.write_text(cargo_text, encoding="utf-8")
+          PY
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Rust cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: src-tauri -> target
+
+      - name: Install JS dependencies
+        run: npm ci
+
+      - name: Build DMG
+        run: npm run tauri build -- --target ${{ matrix.target }} --bundles dmg
+
+      - name: Collect artifacts
+        id: artifacts
+        env:
+          VERSION: ${{ steps.release.outputs.version }}
+          ARCH: ${{ matrix.arch }}
+        run: |
+          mkdir -p dist
+          cp -v src-tauri/target/${{ matrix.target }}/release/bundle/dmg/*.dmg dist/ || true
+          # Rename with arch for clarity
+          for f in dist/*.dmg; do
+            if [[ -f "$f" && ! "$f" =~ "_${ARCH}" ]]; then
+              base=$(basename "$f" .dmg)
+              mv "$f" "dist/${base}_${ARCH}.dmg"
+            fi
+          done
+          ls -la dist
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: qbz-macos-${{ matrix.arch }}
+          path: dist/*
+
+      - name: Publish GitHub Release Assets
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: softprops/action-gh-release@v2
+        with:
+          files: dist/*
+          prerelease: true