release: sign 1.1.3 without notarization

.github/workflows/finalize-release.yml

@@ -1,19 +1,12 @@
-name: Finalize Release
+name: Finalize Notarization (manual)
 
 on:
-  workflow_run:
-    workflows:
-      - Release
-    types:
-      - completed
   workflow_dispatch:
     inputs:
       release_run_id:
         description: Release workflow run ID; leave blank to use the latest pending run
         required: false
         type: string
-  schedule:
-    - cron: "17,47 * * * *"
 
 permissions:
   actions: read

.github/workflows/release.yml

@@ -9,7 +9,7 @@ on:
         type: string
 
 permissions:
-  contents: read
+  contents: write
 
 concurrency:
   group: meetingnotes-release
@@ -20,9 +20,7 @@ jobs:
     runs-on: macos-15
     env:
       VERSION: ${{ inputs.version }}
-      APPLE_ID: ${{ secrets.APPLE_ID }}
-      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-      APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
+      SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
     steps:
       - uses: actions/checkout@v7
         with:
@@ -33,7 +31,7 @@ jobs:
           APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
         run: |
-          for variable in APPLE_CERTIFICATE_P12 APPLE_CERTIFICATE_PASSWORD APPLE_ID APPLE_TEAM_ID APPLE_APP_PASSWORD; do
+          for variable in APPLE_CERTIFICATE_P12 APPLE_CERTIFICATE_PASSWORD SPARKLE_PRIVATE_KEY; do
             if [[ -z "${!variable:-}" ]]; then
               echo "Missing GitHub Actions secret: $variable" >&2
               exit 1
@@ -55,20 +53,19 @@ jobs:
           fi
           echo "SIGNING_IDENTITY=$signing_identity" >> "$GITHUB_ENV"
 
-      - name: Build, sign, and submit for notarization
+      - name: Build and sign release
         timeout-minutes: 30
         run: scripts/package_release.sh
 
-      - name: Preserve signed build while Apple processes it
+      - name: Preserve signed release artifacts
         uses: actions/upload-artifact@v4
         with:
-          name: meetingnotes-notarization-${{ github.run_id }}
-          path: ${{ runner.temp }}/meetingnotes-release/pending
+          name: meetingnotes-signed-release-${{ github.run_id }}
+          path: ${{ runner.temp }}/meetingnotes-release/release
           if-no-files-found: error
           retention-days: 30
 
-      - name: Legacy inline publisher (disabled)
-        if: ${{ false }}
+      - name: Publish signed GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |