Add a native SwiftUI macOS app that shares the iOS player.

The GTK Mac build stays; CI now also publishes maturita-macos-swift.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/bundle-macos-swift.sh

@@ -0,0 +1,128 @@
+#!/bin/sh
+# Build the native Swift macOS .app and zip it for the builds branch.
+
+set -eu
+
+root=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
+cd "$root"
+
+export DEVELOPER_DIR="${DEVELOPER_DIR:-/Applications/Xcode.app/Contents/Developer}"
+if [ -z "${COMMIT:-}" ]; then
+  if [ ! -e "$root/.git" ] ||
+     ! COMMIT="$(git -C "$root" rev-parse --verify HEAD 2>/dev/null)"; then
+    echo "error: cannot determine the source commit; set COMMIT when bundling without Git metadata" >&2
+    exit 1
+  fi
+fi
+export COMMIT
+
+arch=$(uname -m)
+case "$arch" in
+  arm64|aarch64) arch_tag=arm64 ;;
+  x86_64) arch_tag=x86_64 ;;
+  *)
+    echo "Unsupported architecture: $arch" >&2
+    exit 1
+    ;;
+esac
+
+dd="$root/macos/DerivedData"
+out_zip="maturita-macos-swift-${arch_tag}.zip"
+mkdir -p "$dd" "$root/dist"
+
+xcodebuild \
+  -project macos/Maturita.xcodeproj \
+  -scheme Maturita \
+  -configuration Release \
+  -destination "generic/platform=macOS" \
+  -derivedDataPath "$dd" \
+  CODE_SIGNING_ALLOWED=NO \
+  CODE_SIGNING_REQUIRED=NO \
+  COMMIT="$COMMIT"
+
+app=$(find "$dd" -name 'Maturita.app' -path '*/Release/*' | head -n 1)
+if [ -z "$app" ]; then
+  echo "Maturita.app not found" >&2
+  exit 1
+fi
+
+dest="$root/dist/Maturita.app"
+rm -rf "$dest"
+cp -R "$app" "$dest"
+
+ENTITLEMENTS="$root/macos/Maturita/Maturita.entitlements"
+
+pick_sign_identity() {
+  if [ -n "${MACOS_SIGN_IDENTITY:-}" ]; then
+    printf '%s\n' "$MACOS_SIGN_IDENTITY"
+    return
+  fi
+  found="$(security find-identity -v -p codesigning 2>/dev/null \
+    | awk -F'"' '/Developer ID Application/ { print $2; exit }')"
+  if [ -n "$found" ]; then
+    printf '%s\n' "$found"
+    return
+  fi
+  printf '%s\n' "-"
+}
+
+IDENTITY="$(pick_sign_identity)"
+echo "==> Signing Maturita.app ($IDENTITY)"
+sign_args="--force --sign $IDENTITY"
+if [ "$IDENTITY" != "-" ]; then
+  sign_args="$sign_args --options runtime --timestamp"
+fi
+if [ -f "$ENTITLEMENTS" ]; then
+  # shellcheck disable=SC2086
+  codesign $sign_args --entitlements "$ENTITLEMENTS" "$dest"
+else
+  # shellcheck disable=SC2086
+  codesign $sign_args "$dest"
+fi
+codesign --verify --strict --verbose=2 "$dest"
+
+can_notarize() {
+  [ "$IDENTITY" != "-" ] || return 1
+  if [ -n "${APPLE_API_KEY:-}" ] && [ -n "${APPLE_API_KEY_ID:-}" ] &&
+     [ -n "${APPLE_API_ISSUER:-}" ]; then
+    return 0
+  fi
+  if [ -n "${APPLE_ID:-}" ] && [ -n "${APPLE_APP_SPECIFIC_PASSWORD:-}" ] &&
+     [ -n "${APPLE_TEAM_ID:-}" ]; then
+    return 0
+  fi
+  return 1
+}
+
+if can_notarize; then
+  echo "==> Notarizing Maturita.app"
+  zip="$root/dist/.notarize-$out_zip"
+  rm -f "$zip"
+  ditto -c -k --keepParent "$dest" "$zip"
+  if [ -n "${APPLE_API_KEY:-}" ]; then
+    keyfile="$(mktemp)"
+    printf '%s\n' "$APPLE_API_KEY" > "$keyfile"
+    xcrun notarytool submit "$zip" --wait \
+      --key "$keyfile" --key-id "$APPLE_API_KEY_ID" --issuer "$APPLE_API_ISSUER"
+    rm -f "$keyfile"
+  else
+    xcrun notarytool submit "$zip" --wait \
+      --apple-id "$APPLE_ID" \
+      --password "$APPLE_APP_SPECIFIC_PASSWORD" \
+      --team-id "$APPLE_TEAM_ID"
+  fi
+  rm -f "$zip"
+  xcrun stapler staple "$dest"
+else
+  if [ "$IDENTITY" != "-" ] && [ -n "${GITHUB_ACTIONS:-}${CI:-}" ]; then
+    echo "error: Developer ID is present but notarization secrets are missing." >&2
+    exit 1
+  fi
+fi
+
+rm -f "$root/dist/$out_zip"
+(
+  cd "$root/dist"
+  zip -qry "$out_zip" Maturita.app
+)
+echo "wrote $root/dist/$out_zip"