Sign and notarize macOS binaries via GoReleaser's quill integration

Uses the free cross-platform notarize.macos config (quill), which
needs no Xcode/macOS runner and no GoReleaser Pro license. Reads the
Developer ID Application cert, its password, and the App Store
Connect API key/IDs from repo secrets, all wired into the release
workflow's GoReleaser step.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: jochbru

.github/workflows/release.yml

@@ -70,6 +70,11 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
+          MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
+          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
+          MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
+          MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
 
   pages:
     needs: goreleaser

.goreleaser.yaml

@@ -23,6 +23,21 @@ builds:
     ldflags:
       - -s -w -X github.com/pixelunioneu/immich-archiver/cmd.version={{.Version}}
 
+notarize:
+  macos:
+    - enabled: '{{ isEnvSet "MACOS_SIGN_P12" }}'
+      ids:
+        - immich-archiver
+      sign:
+        certificate: "{{.Env.MACOS_SIGN_P12}}"
+        password: "{{.Env.MACOS_SIGN_PASSWORD}}"
+      notarize:
+        issuer_id: "{{.Env.MACOS_NOTARY_ISSUER_ID}}"
+        key_id: "{{.Env.MACOS_NOTARY_KEY_ID}}"
+        key: "{{.Env.MACOS_NOTARY_KEY}}"
+        wait: true
+        timeout: 20m
+
 archives:
   - id: immich-archiver
     formats: [binary]