feat(macos): build a signed .app bundle in a .dmg

[andygrundman]

Description

This PR should be able to build a signed or unsigned Sunshine.app from both CI and from a manual build script. 6 secrets are required to properly sign and notarize a Mac app. Since CI produces builds from pull requests containing unknown code, I took care to only automatically sign builds when github.event_name == push.

An unsigned build should be possible to run but requires jumping through a few security hoops: "Open Anyway" as well as possibly forcing the removal of the quarantine bit.

The .app bundles all dependent libraries in the Frameworks directory, as well as all web UI assets in the Resources directory, so everything should be fully self-contained.

I don't think it breaks any other build including Mac homebrew, but it's difficult to test all possible CI builds as some appear to require various secrets.

Screenshot

Issues Fixed or Closed

• Resolves https://github.com/orgs/LizardByte/discussions/547

Roadmap Issues

• Closes Sunshine: Create macOS dmg package roadmap#18

Type of Change

• feat: New feature (non-breaking change which adds functionality)
• fix: Bug fix (non-breaking change which fixes an issue)
• docs: Documentation only changes
• style: Changes that do not affect the meaning of the code (white-space, formatting, missing semicolons, etc.)
• refactor: Code change that neither fixes a bug nor adds a feature
• perf: Code change that improves performance
• test: Adding missing tests or correcting existing tests
• build: Changes that affect the build system or external dependencies
• ci: Changes to CI configuration files and scripts
• chore: Other changes that don't modify src or test files
• revert: Reverts a previous commit
• BREAKING CHANGE: Introduces a breaking change (can be combined with any type above)

Checklist

• Code follows the style guidelines of this project
• Code has been self-reviewed
• Code has been commented, particularly in hard-to-understand areas
• Code docstring/documentation-blocks for new or existing methods/components have been added or updated
• Unit tests have been added or updated for any new or modified functionality

AI Usage

• None: No AI tools were used in creating this PR
• Light: AI provided minor assistance (formatting, simple suggestions)
• Moderate: AI helped with code generation or debugging specific parts
• Heavy: AI generated most or all of the code changes

[ReenigneArcher]

Thank you for this PR!

Do you have a link for instructions on what I need to do to sign up and get the required secrets? I guess the first step is to enroll here (https://developer.apple.com/programs/enroll/)?

[ReenigneArcher]

This reminds me I wanted to check if we could get away with not linking to icu4c.

I saw this in homebrew, but not sure if it would work for us. https://github.com/Homebrew/homebrew-core/blob/3d2fa66822448968bde0ede5bc3f8396f2410db8/Formula/x/xerces-c.rb#L25-L29

[ReenigneArcher]

This is looking really good. I think these are my final suggestions.

I will also run CI to just confirm linting passes and everything.

Edit: there's a few lint errors in actionlint, cmake-lint, and yamllint -> https://github.com/LizardByte/Sunshine/actions/runs/22299335343/job/64535327417?pr=4759

[codecov]

Bundle Report

Bundle size has no change ✅

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (master@b000d43). Learn more about missing BASE report.
⚠️ Report is 1 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##             master    #4759   +/-   ##
=========================================
  Coverage          ?   16.74%           
=========================================
  Files             ?      106           
  Lines             ?    21747           
  Branches          ?     9733           
=========================================
  Hits              ?     3642           
  Misses            ?    14287           
  Partials          ?     3818           

Flag	Coverage Δ
Archlinux	11.07% <ø> (?)
FreeBSD-14.3-amd64	13.06% <ø> (?)
Homebrew-ubuntu-22.04	13.27% <ø> (?)
Linux-AppImage	11.48% <ø> (?)
Windows-AMD64	13.43% <ø> (?)
Windows-ARM64	12.35% <ø> (?)
macOS-arm64	16.96% <ø> (?)
macOS-x86_64	15.54% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

[ReenigneArcher]

This should solve all the lint issues.

[hauntek]

When running in the background, can the Dock icon be hidden? I noticed that quitting from the Dock doesn’t seem to have any effect. As long as there’s a tray icon, I can operate the program just fine.

[andygrundman]

When running in the background, can the Dock icon be hidden? I noticed that quitting from the Dock doesn’t seem to have any effect. As long as there’s a tray icon, I can operate the program just fine.

Yeah, this doesn't need to affect this PR, but should certainly be fixed. The other related thing I know will be needed is a way to run it on startup as a proper LaunchDaemon. I don't really consider the Mac version to be in a usable state yet, this app bundle is just intended to help resolve the permission issues caused by running from Terminal, and remove the need for people to build the homebrew version.

[ReenigneArcher]

I've added all the required secrets, but have a few requested changes before this is merged.

The big points are I'd like the secrets to all start with APPLE_ so it's easier to identify them. And then to re-use the logic from our release_setup action which already provides a value for whether we should publish or not, which in this case would also be used for whether we should sign or not.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud