From a533eb28b1a182a2b70dc46624ff1142378c8bbf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Moreau?= <mamoreau@devolutions.net>
Date: Wed, 16 Sep 2026 17:28:30 -0400
Subject: [PATCH] ci: fix macOS codesign failure and nuget-publish skip on
 workflow_dispatch

- Stage-MacOsApp.ps1: move (not copy) the third-party notices files into
  Contents/Resources instead of leaving duplicates in Contents/MacOS.
  Apple's codesign treats stray non-executable files sitting next to the
  main executable in Contents/MacOS as nested code requiring their own
  signature, which made 'codesign ... Devolutions.Terminal' fail with
  'code object is not signed at all / In subcomponent: ...GHOSTTY.txt'
  during the macOS sign and notarize jobs.
- Test-MacOsPackage.ps1: updated to expect the notices files under
  Contents/Resources to match the new layout.
- build-terminal.yml: align the nuget-publish job's if condition with
  the other release jobs (macos-sign, release) so it also runs on
  workflow_dispatch, not only on tag pushes. Previously it was skipped
  on every workflow_dispatch run (as seen in run 35150675662) even when
  dry_run was false, because github.ref never starts with refs/tags/
  for a workflow_dispatch trigered from a branch.
---
 .github/workflows/build-terminal.yml | 2 +-
 scripts/Stage-MacOsApp.ps1           | 4 ++--
 scripts/Test-MacOsPackage.ps1        | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build-terminal.yml b/.github/workflows/build-terminal.yml
index 2e8d305..34854db 100644
--- a/.github/workflows/build-terminal.yml
+++ b/.github/workflows/build-terminal.yml
@@ -200,7 +200,7 @@ jobs:
 
   nuget-publish:
     name: Publish Devolutions.Terminal.Control to nuget.org
-    if: ${{ needs.release-metadata.outputs.dry_run != 'true' && startsWith(github.ref, 'refs/tags/') }}
+    if: ${{ needs.release-metadata.outputs.dry_run != 'true' && (github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/')) }}
     needs:
       - release-metadata
       - nuget-pack
diff --git a/scripts/Stage-MacOsApp.ps1 b/scripts/Stage-MacOsApp.ps1
index 8ad5265..54ae60a 100644
--- a/scripts/Stage-MacOsApp.ps1
+++ b/scripts/Stage-MacOsApp.ps1
@@ -126,9 +126,9 @@ finally {
 }
 
 Copy-Item -LiteralPath (Join-Path $repoRoot 'LICENSE') -Destination (Join-Path $resources 'LICENSE') -Force
-Copy-Item -LiteralPath (Join-Path $macosDir 'THIRD-PARTY-NOTICES-GHOSTTY.txt') `
+Move-Item -LiteralPath (Join-Path $macosDir 'THIRD-PARTY-NOTICES-GHOSTTY.txt') `
     -Destination (Join-Path $resources 'THIRD-PARTY-NOTICES-GHOSTTY.txt') -Force
-Copy-Item -LiteralPath (Join-Path $macosDir 'THIRD-PARTY-NOTICES-NOTO-EMOJI.txt') `
+Move-Item -LiteralPath (Join-Path $macosDir 'THIRD-PARTY-NOTICES-NOTO-EMOJI.txt') `
     -Destination (Join-Path $resources 'THIRD-PARTY-NOTICES-NOTO-EMOJI.txt') -Force
 Invoke-Native -FilePath chmod -ArgumentList @(
     '0644',
diff --git a/scripts/Test-MacOsPackage.ps1 b/scripts/Test-MacOsPackage.ps1
index d7e9668..9ca4c05 100644
--- a/scripts/Test-MacOsPackage.ps1
+++ b/scripts/Test-MacOsPackage.ps1
@@ -62,8 +62,8 @@ function Test-MacOsAppBundle {
         (Join-Path $macosDir $metadata.GHOSTTY_LIBRARY),
         (Join-Path $macosDir 'libSkiaSharp.dylib'),
         (Join-Path $macosDir 'libHarfBuzzSharp.dylib'),
-        (Join-Path $macosDir 'THIRD-PARTY-NOTICES-GHOSTTY.txt'),
-        (Join-Path $macosDir 'THIRD-PARTY-NOTICES-NOTO-EMOJI.txt'),
+        (Join-Path $App 'Contents/Resources/THIRD-PARTY-NOTICES-GHOSTTY.txt'),
+        (Join-Path $App 'Contents/Resources/THIRD-PARTY-NOTICES-NOTO-EMOJI.txt'),
         (Join-Path $App 'Contents/Resources/LICENSE'),
         $plist,
         $icns