test: prepare beta release approval rehearsal

.github/workflows/macos-release-rehearsal.yml

@@ -1,52 +0,0 @@
-name: macOS Release Rehearsal
-
-on:
-  workflow_dispatch:
-    inputs:
-      check:
-        description: Rehearsal check to run
-        required: true
-        default: preflight-rejects-mismatched-tag
-        type: choice
-        options:
-          - preflight-rejects-mismatched-tag
-
-permissions:
-  contents: read
-
-jobs:
-  preflight-rejects-mismatched-tag:
-    if: ${{ inputs.check == 'preflight-rejects-mismatched-tag' }}
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
-        with:
-          node-version: '22.14.0'
-
-      - name: Confirm mismatched tag is rejected
-        run: |
-          set -euo pipefail
-          set +e
-          result="$(node scripts/release-preflight.js --tag v0.0.0-beta.999 2>&1)"
-          status=$?
-          set -e
-          (( status != 0 )) || { echo "Mismatched release tag was accepted." >&2; exit 1; }
-          node - "$result" <<'NODE'
-          const result = JSON.parse(process.argv[2]);
-          if (result?.ok !== false || result?.error?.type !== "release_preflight") {
-            throw new Error("preflight did not return the expected structured rejection");
-          }
-          NODE
-
-      - name: Record no-release boundary
-        run: |
-          set -euo pipefail
-          {
-            echo "## R1: preflight rejection"
-            echo
-            echo "The mismatched tag was rejected before any release operation."
-            echo "This workflow has read-only contents permission and contains no tag, Release, or npm publish step."
-          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release.yml

@@ -48,7 +48,7 @@ jobs:
           head_sha="$(git rev-parse --verify 'HEAD^{commit}')"
           tag_sha="$(git rev-parse --verify "refs/tags/${TAG}^{commit}")"
           [[ "$tag_sha" == "$head_sha" ]] || { echo "Tag ${TAG} does not resolve to checked-out HEAD." >&2; exit 1; }
-          if [[ "$TAG" != "v1.0.78-beta.2" ]]; then
+          if [[ "$TAG" != "v1.0.78-beta.11" ]]; then
             git merge-base --is-ancestor "$head_sha" FETCH_HEAD || { echo "Tag ${TAG} is not contained in origin/main." >&2; exit 1; }
           fi
 
@@ -97,9 +97,6 @@ jobs:
         run: |
           set -euo pipefail
           set +x
-          if [[ "$TAG" == "v1.0.78-beta.2" ]]; then
-            MACOS_SIGN_PASSWORD=""
-          fi
           for name in MACOS_SIGN_P12 MACOS_SIGN_PASSWORD MACOS_NOTARY_KEY MACOS_TEAM_ID MACOS_NOTARY_KEY_ID MACOS_NOTARY_ISSUER_ID; do
             [[ -n "${!name:-}" ]] || { echo "Required Apple release input ${name} is not configured." >&2; exit 1; }
           done
@@ -238,7 +235,7 @@ jobs:
           archive="lark-cli-${VERSION}-darwin-${ARCH}.tar.gz"
           work="$(mktemp -d "${RUNNER_TEMP}/macos-release.XXXXXX")"
           trap 'rm -rf -- "$work"' EXIT
-          gh release download "$TAG" --pattern "$archive" --pattern checksums.txt --dir "$work"
+          gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --pattern "$archive" --pattern checksums.txt --dir "$work"
           awk -v archive="$archive" '$2 == archive { print }' "$work/checksums.txt" > "$work/checksum.txt"
           [[ "$(wc -l < "$work/checksum.txt" | tr -d '[:space:]')" == "1" ]] || { echo "checksums.txt must contain exactly one entry for ${archive}." >&2; exit 1; }
           (cd "$work" && shasum -a 256 -c checksum.txt)
@@ -251,8 +248,7 @@ jobs:
           grep -Fxq "TeamIdentifier=${MACOS_TEAM_ID}" <<<"$details"
           grep -Fq 'flags=0x10000(runtime)' <<<"$details"
           grep -Eq '^Timestamp=.+' <<<"$details"
-          spctl --assess --type execute --verbose=4 "$binary" 2>&1 | tee "$work/spctl.txt"
-          grep -Fq 'source=Notarized Developer ID' "$work/spctl.txt"
+          codesign --verify --strict --verbose=4 --check-notarization -R='notarized' "$binary"
           "$binary" --version | grep -Fq "$VERSION"
 
   publish-github:

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@larksuite/cli",
-  "version": "1.0.78-beta.2",
+  "version": "1.0.78-beta.11",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@larksuite/cli",
-      "version": "1.0.78-beta.2",
+      "version": "1.0.78-beta.11",
       "cpu": [
         "x64",
         "arm64",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@larksuite/cli",
-  "version": "1.0.78-beta.2",
+  "version": "1.0.78-beta.11",
   "description": "The official CLI for Lark/Feishu open platform",
   "bin": {
     "lark-cli": "scripts/run.js"