ci: verify main, gate releases on version match, pin Sparkle, fix artifact names

- CI now runs on pushes to main (it was PR-only while commits land
  directly on main, so main was never build-verified) and runs the unit
  test suite alongside the build.
- Releases gain a preflight that asserts the pushed tag matches
  project.yml's MARKETING_VERSION. Without it, tagging v2.6.0 with a
  stale project.yml shipped mismatched assets — and Sparkle still pushed
  them to every user, since CFBundleVersion (commit count) always grows.
- workflow_dispatch removed from the release workflow: dispatched from a
  branch, github.ref_name is the branch name, which baked broken
  enclosure URLs into the appcast. A concurrency group serialises
  releases so concurrent tags can't race the gh-pages publish.
- Sparkle is pinned to exactly 2.6.4 (matching the CLI tools CI pins).
  Package.resolved lives inside the gitignored, regenerated xcodeproj so
  it can't pin anything; the floating from:2.6.0 resolved a fresh latest
  2.x each build — the stale-module failure while landing this commit
  confirmed local builds were already on a newer, unpinned Sparkle.
- Release artifacts are named -universal instead of the runner's
  uname -m: the archive is universal (ARCHS_STANDARD, ONLY_ACTIVE_ARCH
  NO), and the old -arm64 suffix deterred the Intel users the README
  promises support for.

Author: jasonzh0

.github/workflows/build-workflow.yml

@@ -70,7 +70,7 @@ jobs:
           sed -i '' 's/objectVersion = 77;/objectVersion = 70;/' CineScreen.xcodeproj/project.pbxproj
           grep -m1 "objectVersion" CineScreen.xcodeproj/project.pbxproj
 
-      - name: Build (Debug, no signing)
+      - name: Build & test (Debug, no signing)
         if: '!inputs.release'
         run: |
           set -o pipefail
@@ -83,7 +83,7 @@ jobs:
             -destination 'platform=macOS' \
             CODE_SIGN_IDENTITY="-" \
             CODE_SIGNING_REQUIRED=NO \
-            build | tee build/build.log
+            build test | tee build/build.log
 
       # ----- Code signing setup (release only) ------------------------------
       - name: Import signing certificate

.github/workflows/build.yml

@@ -1,7 +1,11 @@
 name: CI
 
+# PRs and pushes to main both build + test. Commits land directly on main in
+# this repo, so a PR-only trigger left main permanently unverified.
 on:
   pull_request:
+  push:
+    branches: [main]
 
 jobs:
   build:

.github/workflows/release.yml

@@ -1,16 +1,41 @@
 name: Release
 
+# Tag-push only. workflow_dispatch was removed deliberately: run from a
+# branch, github.ref_name is the branch name, which baked broken enclosure
+# URLs into the appcast and broke the release step's tag lookup.
 on:
   push:
     tags:
       - 'v*.*.*'
-  workflow_dispatch:
 
 permissions:
   contents: write
 
+# One release at a time — concurrent tag pushes raced each other publishing
+# to gh-pages.
+concurrency:
+  group: release
+  cancel-in-progress: false
+
 jobs:
+  preflight:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Assert tag matches MARKETING_VERSION
+        run: |
+          TAG="${GITHUB_REF_NAME#v}"
+          VERSION="$(grep -E '^\s*MARKETING_VERSION:' project.yml | head -1 | sed 's/.*"\(.*\)".*/\1/')"
+          if [ "$TAG" != "$VERSION" ]; then
+            echo "Tag v$TAG does not match project.yml MARKETING_VERSION=$VERSION." >&2
+            echo "Bump MARKETING_VERSION and commit before tagging — Sparkle's" >&2
+            echo "CFBundleVersion is the commit count, so a mismatched tag would" >&2
+            echo "still auto-update every user to wrongly-versioned assets." >&2
+            exit 1
+          fi
+
   build:
+    needs: preflight
     uses: ./.github/workflows/build-workflow.yml
     with:
       upload-artifacts: true

project.yml

@@ -35,9 +35,14 @@ packages:
   # Sparkle powers in-place auto-updates. Updating the app at its existing
   # path preserves its code-signing identity, so TCC keeps the user's granted
   # Accessibility / Screen Recording permissions — no re-granting after updates.
+  #
+  # Pinned exactly (Package.resolved lives inside the gitignored, regenerated
+  # xcodeproj, so it can't pin anything): a floating `from:` resolved a fresh
+  # latest-2.x on every release build — non-reproducible builds and silent
+  # framework/CLI skew against the 2.6.4 appcast tools pinned in CI.
   Sparkle:
     url: https://github.com/sparkle-project/Sparkle
-    from: "2.6.0"
+    exactVersion: "2.6.4"
 
 targets:
   CineScreen:

scripts/make_release.sh

@@ -55,17 +55,20 @@ VERSION="$(grep -E '^\s*MARKETING_VERSION:' project.yml | head -1 | sed 's/.*"\(
 # monotonic build number from the commit count. (Requires a full clone — CI
 # checks out with fetch-depth: 0.)
 BUILD_NUMBER="$(git rev-list --count HEAD 2>/dev/null || echo 1)"
-ARCH="$(uname -m)"
-DMG_PATH="$RELEASE_DIR/CineScreen-${VERSION}-${ARCH}.dmg"
-ZIP_PATH="$RELEASE_DIR/CineScreen-${VERSION}-${ARCH}.zip"
+# The archive is universal (ARCHS_STANDARD + ONLY_ACTIVE_ARCH=NO) — naming
+# artifacts after the build runner's `uname -m` mislabelled them "-arm64",
+# contradicting the README's Intel support and deterring Intel users.
+ARTIFACT_SUFFIX="universal"
+DMG_PATH="$RELEASE_DIR/CineScreen-${VERSION}-${ARTIFACT_SUFFIX}.dmg"
+ZIP_PATH="$RELEASE_DIR/CineScreen-${VERSION}-${ARTIFACT_SUFFIX}.zip"
 
 rm -rf "$RELEASE_DIR/build" "$EXPORT_PATH"
 mkdir -p "$BUILD_DIR" "$RELEASE_DIR"
 
 # ---------------------------------------------------------------------------
 # Archive
 # ---------------------------------------------------------------------------
-echo "==> xcodebuild archive (Release, $ARCH)"
+echo "==> xcodebuild archive (Release, universal)"
 
 XCODEBUILD_ARGS=(
   -project "$PROJECT"