fix(ci): move mac entitlements out of gitignored build/ so it's committed

Author: adrbn

.github/workflows/florin-release.yml

@@ -33,15 +33,15 @@ jobs:
         # notarytool with the APPLE_* creds and staples the result. If these
         # secrets are unset the build is produced unsigned instead of failing.
         #
-        # Entitlements are passed as an ABSOLUTE path: in this pnpm monorepo the
-        # relative `build/entitlements.mac.plist` from electron-builder.yml gets
-        # resolved by codesign against the wrong CWD ("cannot read entitlement
-        # data"). $PWD is apps/desktop here, so this always resolves.
+        # Entitlements passed as an ABSOLUTE path so codesign always resolves it
+        # regardless of its CWD. The plist lives at apps/desktop/entitlements.mac.plist
+        # (NOT under build/, which .gitignore excludes — that's why an earlier
+        # run got "cannot read entitlement data": the file wasn't committed).
         run: |
           cd apps/desktop
           pnpm exec electron-builder --mac --publish never \
-            --config.mac.entitlements="$PWD/build/entitlements.mac.plist" \
-            --config.mac.entitlementsInherit="$PWD/build/entitlements.mac.plist"
+            --config.mac.entitlements="$PWD/entitlements.mac.plist" \
+            --config.mac.entitlementsInherit="$PWD/entitlements.mac.plist"
         env:
           CSC_LINK: ${{ secrets.CSC_LINK }}
           CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}

apps/desktop/electron-builder.yml

@@ -42,8 +42,8 @@ mac:
   # and skips notarization — CI is the only place the secrets exist.
   hardenedRuntime: true
   gatekeeperAssess: false
-  entitlements: build/entitlements.mac.plist
-  entitlementsInherit: build/entitlements.mac.plist
+  entitlements: entitlements.mac.plist
+  entitlementsInherit: entitlements.mac.plist
   notarize: true
   target:
     # dmg = manual install / first bootstrap; zip = what electron-updater

apps/desktop/entitlements.mac.plist

@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <!-- Electron's V8 JIT needs writable+executable memory under the hardened
+       runtime; without these, notarization passes but the app crashes on
+       launch. -->
+  <key>com.apple.security.cs.allow-jit</key>
+  <true/>
+  <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+  <true/>
+  <!-- better-sqlite3 ships a prebuilt native .node; library validation would
+       reject loading a differently-signed dylib into the signed app. -->
+  <key>com.apple.security.cs.disable-library-validation</key>
+  <true/>
+  <!-- The main process sets env vars (e.g. NODE_TLS_REJECT_UNAUTHORIZED for the
+       self-signed localhost server) that the loader must honor. -->
+  <key>com.apple.security.cs.allow-dyld-environment-variables</key>
+  <true/>
+</dict>
+</plist>