Add a native SwiftUI macOS app that shares the iOS player.

The GTK Mac build stays; CI now also publishes maturita-macos-swift.

Co-authored-by: Cursor <cursoragent@cursor.com>

.github/workflows/build.yml

@@ -215,9 +215,62 @@ jobs:
           name: maturita-ios
           path: dist-ios/maturita-ios.ipa
 
+  macos-swift:
+    name: macOS Swift app
+    runs-on: macos-26
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Import Developer ID certificate
+        env:
+          MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
+          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
+        run: |
+          set -euo pipefail
+          if [ -z "${MACOS_CERTIFICATE:-}" ]; then
+            echo "No Developer ID certificate; the bundle will be ad-hoc signed."
+            exit 0
+          fi
+          cert="$RUNNER_TEMP/certificate.p12"
+          keychain="$RUNNER_TEMP/signing.keychain-db"
+          pass="$(openssl rand -base64 32)"
+          echo "$MACOS_CERTIFICATE" | base64 --decode > "$cert"
+          security create-keychain -p "$pass" "$keychain"
+          security set-keychain-settings -lut 21600 "$keychain"
+          security unlock-keychain -p "$pass" "$keychain"
+          security import "$cert" -k "$keychain" \
+            -P "$MACOS_CERTIFICATE_PASSWORD" \
+            -T /usr/bin/codesign -T /usr/bin/security
+          security set-key-partition-list -S apple-tool:,apple: -s \
+            -k "$pass" "$keychain"
+          security list-keychains -d user -s "$keychain" \
+            $(security list-keychains -d user | tr -d '"')
+          rm -f "$cert"
+
+      - name: Build Swift .app zip
+        env:
+          COMMIT: ${{ github.sha }}
+          DEVELOPER_DIR: /Applications/Xcode.app/Contents/Developer
+          MACOS_SIGN_IDENTITY: ${{ secrets.MACOS_SIGN_IDENTITY }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+        run: |
+          chmod +x scripts/bundle-macos-swift.sh
+          ./scripts/bundle-macos-swift.sh
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: maturita-macos-swift
+          path: dist/maturita-macos-swift-*.zip
+
   publish:
     name: Publish to builds branch
-    needs: [linux, windows, macos, android, ios]
+    needs: [linux, windows, macos, android, ios, macos-swift]
     # One broken platform must not freeze the others: publish whatever was
     # built and keep the previous package for anything that failed.
     if: ${{ !cancelled() && contains(needs.*.result, 'success') }}
@@ -254,6 +307,7 @@ jobs:
           # here, so a platform that failed this run is not offered as new.
           [ -f fresh/maturita-android.apk ] && echo "${{ github.sha }}" > staged/VERSION-android
           [ -f fresh/maturita-ios.ipa ] && echo "${{ github.sha }}" > staged/VERSION-ios
+          ls fresh/maturita-macos-swift-*.zip >/dev/null 2>&1 && echo "${{ github.sha }}" > staged/VERSION-macos-swift
           ls fresh staged
 
       # The branch is rewritten from scratch every time rather than added to,