macOS notarization

.github/workflows/build.yml

@@ -137,6 +137,14 @@ jobs:
         echo "VERSION=$(cat build/version.txt)" >> $GITHUB_ENV
         cpack --config build/CPackConfig.cmake -B build/installer --verbose
         mv build/installer/*.dmg build/Release
+    - name: Notarize
+      if: github.ref_name == 'main'
+      run: |
+        misc/ci-macos-notarize.sh build/Release/*.dmg
+      env:
+        APPLE_NOTARIZATION_USERNAME: ${{ secrets.APPLE_NOTARIZATION_USERNAME }}
+        APPLE_NOTARIZATION_PASSWORD: ${{ secrets.APPLE_NOTARIZATION_PASSWORD }}
+        APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
     - name: Upload
       uses: actions/upload-artifact@v4
       with: