desktop: Refactor packing and signing build phases

[iinuwa]

🎟️ Tracking

PM-43001

📔 Objective

Refactors after-pack and after-sign build phases:

• Moves safari extension copy to after-pack phase to avoid re-signing the app unnecessarily
• Clarifies why we guard on macOS universal builds
• adds GitHub Actions grouping to more easily scan the logs
• Allows skipping notarization for local developer builds.

At this point, we could also remove after-sign.js entirely, as all we need to do there now is to notarize the app. I am not doing that in this PR.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the refactor of the desktop macOS after-pack.js and after-sign.js build phases: the Safari extension copy moves from after-sign to after-pack (removing the second full app signing), the universal-arch guard is replaced with target-arch detection from packager.info.options.targets, GitHub Actions log grouping and error re-throwing are added to both hooks, and notarization can now be skipped via APPLE_NOTARIZE. The extension-copy consolidation into copyMacOsPlugin reads well and the ::group::/::endgroup:: pairing is correctly wrapped in try/finally. Two items worth a look before merge: the target-arch guard also changes fuse behavior for single-arch macOS builds, and the autofill copy is narrowed to mas-dev only. Note that the mac packaging paths in build-desktop.yml do not run on pull requests, so this diff is not exercised by CI here — the failing Rust deny/Rust lint checks are unrelated to these files.

Code Review Details

• ♻️ : Autofill copy narrowed to mas-dev, leaving pack:mac:with-extension building an extension it can no longer ship
  • apps/desktop/scripts/after-pack.js:238
• ❓ : Single-arch macOS builds now get fuses flipped while resetAdHocDarwinSignature stays keyed to universal
  • apps/desktop/scripts/after-pack.js:53

[claude]

❓ QUESTION: Single-arch macOS builds now get fuses flipped — was this behavior change intended?

Details

The old guard was context.packager.platform.nodeName !== "darwin" || context.arch === builder.Arch.universal, so on macOS addElectronFuses ran only for the universal arch. With the new logic, when no universal target is requested (pack:mac:arm64, pack:mac:masdev:arm64, pack:dir, publish:mac) isTargetArch is true, so fuses are now applied to those builds as well.

Applying fuses there looks like an improvement, but resetAdHocDarwinSignature (line 202) is still keyed to context.arch === builder.Arch.universal:

resetAdHocDarwinSignature: platform === "darwin" && context.arch === builder.Arch.universal,

So a single-arch macOS binary is now left with a signature invalidated by the fuse flip, and that is only repaired if electron-builder subsequently signs the app (i.e. a signing identity is available). For a local --dir/single-arch build with no identity, the resulting app can fail to launch on Apple Silicon.

If the broader fuse coverage is intended, consider resetAdHocDarwinSignature: platform === "darwin".

[claude]

♻️ DEBT: Narrowing the autofill copy to mas-dev leaves pack:mac:with-extension building an extension it can no longer ship.

Details

Previously the gate was context.electronPlatformName === "darwin" || isMasDevBuild, so Developer ID (darwin) builds copied the extension when it existed. The npm script pack:mac:with-extension (apps/desktop/package.json) exists for exactly that flow: it runs build:macos-extension:mac (ReleaseDeveloper config) and then electron-builder --mac --universal. With this change that build spends the Xcode build time and then hits the early return, producing an app with no autofill extension and only a "needs Apple Developer Portal changes" log line.

If the darwin path is intentionally parked until the provisioning profiles are fixed, consider removing or renaming pack:mac:with-extension (and build:macos-extension:mac) so the scripts do not advertise a capability that is now disabled.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 55.58%. Comparing base (b57513e) to head (e5dc58b).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #23020   +/-   ##
=======================================
  Coverage   55.57%   55.58%           
=======================================
  Files        4412     4412           
  Lines      140965   140969    +4     
  Branches    22392    22392           
=======================================
+ Hits        78348    78351    +3     
- Misses      56916    56917    +1     
  Partials     5701     5701           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.