fix(cd): pass universal binary to notarization script (fixes #1493)

[ddupont808]

Problem

The CD workflow correctly built arm64 + x86_64 and combined them with lipo into a universal binary, but then called build-release-notarized.sh without CUA_DRIVER_PREBUILT_BINARY. The script would:

1. Rebuild from source (arm64 only via swift build -c release)
2. Package the arm64 binary into .app and then into the tarball
3. The workflow's post-hoc cp .build/cua-driver-universal only updated the .app on disk — the tarball was already sealed

Result: every released tarball (-arm64, -x86_64, -universal) contained an arm64-only binary. Intel users got zsh: bad CPU type in executable (#1493 / reported by @jakechism).

Fix

• Export CUA_DRIVER_PREBUILT_BINARY="$(pwd)/.build/cua-driver-universal" before calling the notarization script so it uses the fat binary when assembling the .app and creating tarballs
• Add CUA_DRIVER_PREBUILT_BINARY support to build-release-notarized.sh (skips swift build, uses the provided binary path)
• Replace the post-hoc binary injection block with a lipo -info verification so it's clear from CI logs whether the packaged binary is actually universal
• Backward-compatible: running the script locally without the env var still builds from source as before

Test plan

• Trigger CD workflow for a new cua-driver-v* tag
• In the "Build arm64 + x86_64" step logs, confirm lipo -info reports Architectures in the fat file: arm64 x86_64
• Download the released -x86_64.tar.gz and run file cua-driver — expect Mach-O universal binary with 2 architectures
• Install on an Intel Mac and confirm cua-driver --version works

Fixes #1493

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Streamlined macOS release workflow - Optimized the application packaging and notarization process to support prebuilt binaries. Previously, the system would build applications, then package them, and finally re-sign them. Now, prebuilt binaries are embedded directly during assembly, reducing redundant steps and improving the efficiency of generating notarized macOS applications.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Ignored		May 12, 2026 9:37pm

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 8cc34f48-73be-4b70-b959-c611886b1ba1

📥 Commits

Reviewing files that changed from the base of the PR and between 93c2abd and 3c34107.

📒 Files selected for processing (2)

• .github/workflows/cd-swift-cua-driver.yml
• libs/cua-driver/scripts/build/build-release-notarized.sh

---

📝 Walkthrough

Walkthrough

The macOS notarization workflow is restructured to embed a prebuilt universal binary into the app during script execution rather than injecting it afterward. The build script now accepts an optional environment variable to use a supplied binary, bypassing the Swift build when a prebuilt binary is available.

Changes

macOS Notarization Build with Prebuilt Universal Binary

Layer / File(s)	Summary
Script prebuilt binary support libs/cua-driver/scripts/build/build-release-notarized.sh	The script adds conditional build logic to check for CUA_DRIVER_PREBUILT_BINARY; when set, it uses that path and skips swift build; otherwise it builds locally. Bundle assembly is updated to copy from the resolved binary path instead of hard-coded .build/release/cua-driver.
Workflow prebuilt binary handoff and verification .github/workflows/cd-swift-cua-driver.yml	The CD workflow exports the prebuilt universal binary path to the script before execution, then verifies the packaged app binary architecture with lipo -info. The previous post-hoc binary injection and re-signing steps are removed.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• trycua/cua#1413: Both PRs modify the macOS CD workflow to handle the built/signed cua-driver binary; this PR adds passing a prebuilt universal binary into the notarization script, while the retrieved PR adds steps to extract/package and upload the signed bare binary.

Poem

🐰 A universal binary now takes the express lane,
No more local Swift builds in the notarization chain,
The workflow hands off what's already done,
Embedding it early—one binary for everyone,
Intel and Apple Silicon under one stone! ✨

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/cd-universal-binary-content

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}