ci: add coordinated release pipeline

.github/workflows/apple-release.yml

@@ -1,20 +1,19 @@
 name: Apple release (macOS DMG)
 
-# Builds, signs, notarizes, and publishes the direct-download macOS build:
+# Builds, signs, notarizes, and uploads the direct-download macOS build:
 #   - a Developer ID–signed, notarized VniDrop-<version>.dmg,
-#   - a Sparkle appcast.xml (both attached to the GitHub Release), and
-#   - an updated Homebrew cask pushed to the sudosylabs/homebrew-vnidrop tap.
+#   - a Sparkle appcast.xml.
+#
+# The central release workflow publishes these artifacts and updates Homebrew.
 #
 # The App Store / TestFlight build is NOT produced here — that goes through Xcode
 # Organizer / App Store Connect. This workflow only covers direct distribution.
 #
-# Trigger: push the canonical vMAJOR.MINOR.PATCH tag (must point at a commit on
-# master), or run manually using the version committed in version.properties.
+# Called by the central tag-release workflow, or run manually to validate the
+# signed/notarized direct-download artifact.
 
 on:
-  push:
-    tags:
-      - "v*.*.*"
+  workflow_call:
   workflow_dispatch:
 
 permissions:
@@ -33,8 +32,6 @@ jobs:
     name: Build & notarize DMG
     runs-on: macos-latest
     timeout-minutes: 90
-    permissions:
-      contents: write
     outputs:
       version: ${{ steps.version.outputs.app }}
     steps:
@@ -82,7 +79,7 @@ jobs:
         run: brew install xcodegen swiftlint create-dmg
 
       - name: Install Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 
       - name: Download Sparkle tools
         # generate_appcast + sign_update ship in the Sparkle release tarball.
@@ -151,68 +148,3 @@ jobs:
             apple/dist/appcast.xml
           if-no-files-found: error
           retention-days: 14
-
-      - name: Publish GitHub Release
-        if: github.event_name == 'push' && github.ref_type == 'tag'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-        run: |
-          set -euo pipefail
-          tag="$GITHUB_REF_NAME"
-          version="${tag#v}"
-          if gh release view "$tag" >/dev/null 2>&1; then
-            echo "Release $tag already exists; refusing to replace assets" >&2
-            exit 1
-          fi
-          gh release create "$tag" \
-            "apple/dist/VniDrop-${version}.dmg" \
-            "apple/dist/appcast.xml" \
-            --verify-tag \
-            --title "VniDrop $version" \
-            --generate-notes
-
-  update-cask:
-    name: Update Homebrew cask
-    needs: build
-    if: github.event_name == 'push' && github.ref_type == 'tag'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-
-      - name: Download DMG artifact
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
-        with:
-          name: vnidrop-${{ needs.build.outputs.version }}-macos-dmg
-          path: dist
-
-      - name: Render cask
-        env:
-          VERSION: ${{ needs.build.outputs.version }}
-        run: |
-          set -euo pipefail
-          sha="$(sha256sum "dist/VniDrop-${VERSION}.dmg" | cut -d' ' -f1)"
-          sed -e "s/^  version \".*\"/  version \"${VERSION}\"/" \
-              -e "s/^  sha256 \".*\"/  sha256 \"${sha}\"/" \
-              packaging/homebrew/vnidrop.rb > /tmp/vnidrop.rb
-          echo "Rendered cask:"; cat /tmp/vnidrop.rb
-
-      - name: Push to tap
-        env:
-          TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
-          VERSION: ${{ needs.build.outputs.version }}
-        run: |
-          set -euo pipefail
-          git clone "https://x-access-token:${TAP_TOKEN}@github.com/sudosylabs/homebrew-vnidrop.git" tap
-          mkdir -p tap/Casks
-          cp /tmp/vnidrop.rb tap/Casks/vnidrop.rb
-          cd tap
-          git config user.name "vnidrop-release-bot"
-          git config user.email "release-bot@users.noreply.github.com"
-          git add Casks/vnidrop.rb
-          git commit -m "vnidrop ${VERSION}" || { echo "no cask changes"; exit 0; }
-          git push