fix(release): build macOS updater bundles (#1733)

.github/scripts/release-workflow-contract_test.py

@@ -128,6 +128,23 @@ class ReleaseWorkflowContractTest(unittest.TestCase):
             r"needs\.prepare\.outputs\.tag \}\}\^\{commit\}",
         )
 
+    def test_macos_signed_build_selects_updater_bundle(self) -> None:
+        build = step_block("Build Tauri desktop app")
+        collect = step_block("Collect desktop artifacts")
+        initialize = 'tauri_bundles="${{ matrix.tauri_bundles }}"'
+        append = 'tauri_bundles="${tauri_bundles},updater"'
+        invoke = '--bundles "$tauri_bundles"'
+
+        self.assertIn('[[ "${{ matrix.platform }}" == macos-*', build)
+        self.assertIn('"${UPDATER_SIGNING_ENABLED:-false}" = "true"', build)
+        self.assertIn(initialize, build)
+        self.assertIn(append, build)
+        self.assertIn(invoke, build)
+        self.assertLess(build.index(initialize), build.index(append))
+        self.assertLess(build.index(append), build.index(invoke))
+        self.assertIn('"${UPDATER_SIGNING_ENABLED:-false}" = "true"', collect)
+        self.assertIn('"$DESKTOP_ASSET_VERIFIER" --require-updaters', collect)
+
     def test_macos_dmg_build_has_retry_timeout_and_diagnostics(self) -> None:
         build = step_block("Build Tauri desktop app")
         self.assertIn("timeout-minutes: 70", build)

.github/workflows/release.yml

@@ -848,9 +848,13 @@ jobs:
             unset WINDOWS_TIMESTAMP_URL
             unset WINDOWS_SIGNTOOL_PATH
           fi
+          tauri_bundles="${{ matrix.tauri_bundles }}"
           updater_config='{"bundle":{"createUpdaterArtifacts":false}}'
           if [ "${UPDATER_SIGNING_ENABLED:-false}" = "true" ]; then
             updater_config='{"bundle":{"createUpdaterArtifacts":"v1Compatible"}}'
+            if [[ "${{ matrix.platform }}" == macos-* ]]; then
+              tauri_bundles="${tauri_bundles},updater"
+            fi
           else
             unset TAURI_SIGNING_PRIVATE_KEY
             unset TAURI_SIGNING_PRIVATE_KEY_PASSWORD
@@ -917,7 +921,7 @@ jobs:
               pnpm tauri build \
                 --features desktop-runtime \
                 --target "${{ matrix.rust_target }}" \
-                --bundles "${{ matrix.tauri_bundles }}" \
+                --bundles "$tauri_bundles" \
                 --config "$updater_config"
           }
 
@@ -1070,7 +1074,12 @@ jobs:
             exit 1
           fi
 
-          bash "$DESKTOP_ASSET_VERIFIER" "$out_dir" "${{ matrix.platform }}"
+          if [ "${UPDATER_SIGNING_ENABLED:-false}" = "true" ]; then
+            bash "$DESKTOP_ASSET_VERIFIER" --require-updaters \
+              "$out_dir" "${{ matrix.platform }}"
+          else
+            bash "$DESKTOP_ASSET_VERIFIER" "$out_dir" "${{ matrix.platform }}"
+          fi
           ls -lh "$out_dir"
 
       - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5