building intel mac app (#878)

Co-authored-by: Max Novich <mnovich@squareup.com>

.github/workflows/bundle-desktop-intel.yml

@@ -0,0 +1,258 @@
+# This is a **reuseable** workflow that bundles the Desktop App for Intel macOS.
+# It doesn't get triggered on its own. It gets used in multiple workflows:
+#  - release.yml
+#  - canary.yml
+#  - pr-comment-bundle-desktop.yml
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: 'Version to set for the build'
+        required: false
+        default: ""
+        type: string
+      signing:
+        description: 'Whether to perform signing and notarization'
+        required: false
+        default: false
+        type: boolean
+      quick_test:
+        description: 'Whether to perform the quick launch test'
+        required: false
+        default: true
+        type: boolean
+    secrets:
+      CERTIFICATE_OSX_APPLICATION:
+        description: 'Certificate for macOS application signing'
+        required: false
+      CERTIFICATE_PASSWORD:
+        description: 'Password for the macOS certificate'
+        required: false
+      APPLE_ID:
+        description: 'Apple ID for notarization'
+        required: false
+      APPLE_ID_PASSWORD:
+        description: 'Password for the Apple ID'
+        required: false
+      APPLE_TEAM_ID:
+        description: 'Apple Team ID'
+        required: false
+
+name: Reusable workflow to bundle desktop app for Intel Mac
+
+jobs:
+  bundle-desktop-intel:
+    runs-on: macos-latest
+    name: Bundle Desktop App on Intel macOS
+    steps:
+      # Check initial disk space
+      - name: Check initial disk space
+        run: df -h
+
+      # Validate Signing Secrets if signing is enabled
+      - name: Validate Signing Secrets
+        if: ${{ inputs.signing }}
+        run: |
+          if [[ -z "${{ secrets.CERTIFICATE_OSX_APPLICATION }}" ]]; then
+            echo "Error: CERTIFICATE_OSX_APPLICATION secret is required for signing."
+            exit 1
+          fi
+          if [[ -z "${{ secrets.CERTIFICATE_PASSWORD }}" ]]; then
+            echo "Error: CERTIFICATE_PASSWORD secret is required for signing."
+            exit 1
+          fi
+          if [[ -z "${{ secrets.APPLE_ID }}" ]]; then
+            echo "Error: APPLE_ID secret is required for signing."
+            exit 1
+          fi
+          if [[ -z "${{ secrets.APPLE_ID_PASSWORD }}" ]]; then
+            echo "Error: APPLE_ID_PASSWORD secret is required for signing."
+            exit 1
+          fi
+          if [[ -z "${{ secrets.APPLE_TEAM_ID }}" ]]; then
+            echo "Error: APPLE_TEAM_ID secret is required for signing."
+            exit 1
+          fi
+          echo "All required signing secrets are present."
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      # Update versions before build
+      - name: Update versions
+        if: ${{ inputs.version != '' }}
+        run: |
+          # Update version in Cargo.toml
+          sed -i.bak 's/^version = ".*"/version = "'${{ inputs.version }}'"/' Cargo.toml
+          rm -f Cargo.toml.bak
+          
+          # Update version in package.json 
+          cd ui/desktop
+          npm version ${{ inputs.version }} --no-git-tag-version --allow-same-version
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+          targets: x86_64-apple-darwin
+
+      # Pre-build cleanup to ensure enough disk space
+      - name: Pre-build cleanup
+        run: |
+          echo "Performing pre-build cleanup..."
+          # Clean npm cache
+          npm cache clean --force || true
+          # Clean any previous build artifacts
+          rm -rf target || true
+          # Clean Homebrew cache
+          brew cleanup || true
+          # Remove unnecessary large directories
+          rm -rf ~/Library/Caches/* || true
+          # Check disk space after cleanup
+          df -h
+
+      - name: Cache Cargo registry
+        uses: actions/cache@v3
+        with:
+          path: ~/.cargo/registry
+          key: ${{ runner.os }}-intel-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-intel-cargo-registry-
+
+      - name: Cache Cargo index
+        uses: actions/cache@v3
+        with:
+          path: ~/.cargo/index
+          key: ${{ runner.os }}-intel-cargo-index
+          restore-keys: |
+            ${{ runner.os }}-intel-cargo-index
+
+      - name: Cache Cargo build
+        uses: actions/cache@v3
+        with:
+          path: target
+          key: ${{ runner.os }}-intel-cargo-build-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-intel-cargo-build-
+
+      # Build specifically for Intel architecture
+      - name: Build goosed for Intel
+        run: cargo build --release -p goose-server --target x86_64-apple-darwin
+
+      # Post-build cleanup to free space
+      - name: Post-build cleanup
+        run: |
+          echo "Performing post-build cleanup..."
+          # Remove debug artifacts
+          rm -rf target/debug || true
+          rm -rf target/x86_64-apple-darwin/debug || true
+          # Keep only what's needed for the next steps
+          rm -rf target/x86_64-apple-darwin/release/deps || true
+          rm -rf target/x86_64-apple-darwin/release/build || true
+          rm -rf target/x86_64-apple-darwin/release/incremental || true
+          # Check disk space after cleanup
+          df -h
+
+      - name: Copy binary into Electron folder
+        run: cp target/x86_64-apple-darwin/release/goosed ui/desktop/src/bin/goosed
+
+      - name: Add MacOS certs for signing and notarization
+        if: ${{ inputs.signing }}
+        run: ./scripts/add-macos-cert.sh
+        working-directory: ui/desktop
+        env:
+          CERTIFICATE_OSX_APPLICATION: ${{ secrets.CERTIFICATE_OSX_APPLICATION }}
+          CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v2
+        with:
+          node-version: 'lts/*'
+
+      - name: Install dependencies
+        run: npm ci
+        working-directory: ui/desktop
+
+      # Configure Electron builder for Intel architecture
+      - name: Configure for Intel build
+        run: |
+          # Set the architecture to x64 for Intel Mac build
+          jq '.build.mac.target[0].arch = "x64"' package.json > package.json.tmp && mv package.json.tmp package.json
+        working-directory: ui/desktop
+
+      # Check disk space before bundling
+      - name: Check disk space before bundling
+        run: df -h
+
+      - name: Make Unsigned App
+        if: ${{ !inputs.signing }}
+        run: |
+          attempt=0
+          max_attempts=2
+          until [ $attempt -ge $max_attempts ]; do
+            npm run bundle:default && break
+            attempt=$((attempt + 1))
+            echo "Attempt $attempt failed. Retrying..."
+            sleep 5
+          done
+          if [ $attempt -ge $max_attempts ]; then
+            echo "Action failed after $max_attempts attempts."
+            exit 1
+          fi
+        working-directory: ui/desktop
+
+      - name: Make Signed App
+        if: ${{ inputs.signing }}
+        run: |
+          attempt=0
+          max_attempts=2
+          until [ $attempt -ge $max_attempts ]; do
+            npm run bundle:default && break
+            attempt=$((attempt + 1))
+            echo "Attempt $attempt failed. Retrying..."
+            sleep 5
+          done
+          if [ $attempt -ge $max_attempts ]; then
+            echo "Action failed after $max_attempts attempts."
+            exit 1
+          fi
+        working-directory: ui/desktop
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+
+      - name: Final cleanup before artifact upload
+        run: |
+          echo "Performing final cleanup..."
+          # Remove build artifacts that are no longer needed
+          rm -rf target || true
+          # Check disk space after cleanup
+          df -h
+
+      - name: Upload Desktop artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: Goose-darwin-x64
+          path: ui/desktop/out/Goose-darwin-x64/Goose.zip
+
+      - name: Quick launch test (macOS)
+        if: ${{ inputs.quick_test }}
+        run: |
+          # Ensure no quarantine attributes (if needed)
+          xattr -cr "ui/desktop/out/Goose-darwin-x64/Goose.app"
+          echo "Opening Goose.app..."
+          open -g "ui/desktop/out/Goose-darwin-x64/Goose.app"
+
+          # Give the app a few seconds to start and write logs
+          sleep 5
+
+          # Check if it's running
+          if pgrep -f "Goose.app/Contents/MacOS/Goose" > /dev/null; then
+            echo "App appears to be running."
+          else
+            echo "App did not stay open. Possible crash or startup error."
+            exit 1
+          fi
+          # Kill the app to clean up
+          pkill -f "Goose.app/Contents/MacOS/Goose"

.github/workflows/bundle-desktop.yml

@@ -45,6 +45,10 @@ jobs:
     runs-on: macos-latest
     name: Bundle Desktop App on macOS
     steps:
+      # Check initial disk space
+      - name: Check initial disk space
+        run: df -h
+
       # Validate Signing Secrets if signing is enabled
       - name: Validate Signing Secrets
         if: ${{ inputs.signing }}
@@ -86,6 +90,21 @@ jobs:
           cd ui/desktop
           npm version ${{ inputs.version }} --no-git-tag-version --allow-same-version
 
+      # Pre-build cleanup to ensure enough disk space
+      - name: Pre-build cleanup
+        run: |
+          echo "Performing pre-build cleanup..."
+          # Clean npm cache
+          npm cache clean --force || true
+          # Clean any previous build artifacts
+          rm -rf target || true
+          # Clean Homebrew cache
+          brew cleanup || true
+          # Remove unnecessary large directories
+          rm -rf ~/Library/Caches/* || true
+          # Check disk space after cleanup
+          df -h
+
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
         with:
@@ -115,10 +134,23 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-cargo-build-
 
-      # Rest of the workflow remains the same...
+      # Build the project
       - name: Build goosed
         run: cargo build --release -p goose-server
 
+      # Post-build cleanup to free space
+      - name: Post-build cleanup
+        run: |
+          echo "Performing post-build cleanup..."
+          # Remove debug artifacts
+          rm -rf target/debug || true
+          # Keep only what's needed for the next steps
+          rm -rf target/release/deps || true
+          rm -rf target/release/build || true
+          rm -rf target/release/incremental || true
+          # Check disk space after cleanup
+          df -h
+
       - name: Copy binary into Electron folder
         run: cp target/release/goosed ui/desktop/src/bin/goosed
 
@@ -139,6 +171,10 @@ jobs:
         run: npm ci
         working-directory: ui/desktop
 
+      # Check disk space before bundling
+      - name: Check disk space before bundling
+        run: df -h
+
       - name: Make Unsigned App
         if: ${{ !inputs.signing }}
         run: |
@@ -177,6 +213,14 @@ jobs:
           APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
 
+      - name: Final cleanup before artifact upload
+        run: |
+          echo "Performing final cleanup..."
+          # Remove build artifacts that are no longer needed
+          rm -rf target || true
+          # Check disk space after cleanup
+          df -h
+
       - name: Upload Desktop artifact
         uses: actions/upload-artifact@v4
         with:
@@ -202,4 +246,4 @@ jobs:
             exit 1
           fi
           # Kill the app to clean up
-          pkill -f "Goose.app/Contents/MacOS/Goose"
+          pkill -f "Goose.app/Contents/MacOS/Goose"

.github/workflows/ci.yml

@@ -76,6 +76,31 @@ jobs:
           cargo test
         working-directory: crates
 
+      # Add disk space cleanup before linting
+      - name: Check disk space before cleanup
+        run: df -h
+
+      - name: Clean up disk space
+        run: |
+          echo "Cleaning up disk space..."
+          # Remove debug artifacts that are no longer needed after tests
+          rm -rf target/debug/deps
+          rm -rf target/debug/build
+          rm -rf target/debug/incremental
+          # Clean npm cache if it exists
+          npm cache clean --force || true
+          # Clean apt cache
+          sudo apt-get clean
+          # Remove unnecessary large directories
+          rm -rf ~/.cargo/registry/index || true
+          # Remove docker images if any
+          docker system prune -af || true
+          # Remove unused packages
+          sudo apt-get autoremove -y || true
+
+      - name: Check disk space after cleanup
+        run: df -h
+
       - name: Lint
         run: cargo clippy -- -D warnings
 
@@ -104,4 +129,4 @@ jobs:
     uses: ./.github/workflows/bundle-desktop.yml
     if: github.event_name == 'pull_request'
     with:
-      signing: false
+      signing: false

.github/workflows/pr-comment-bundle-desktop.yml

@@ -1,96 +0,0 @@
-# This workflow is triggered by a comment on an issue or PR with the text ".bundle"
-# It bundles the Desktop App, then creates a PR comment with a link to download the app.
-
-# IMPORTANT: issue_comment workflows only use files found on "main" branch to run.
-# Do NOT allow on: pull_request since that allows a user to alter a file in a PR and exfil secrets for example.
-# Only using issue_comment is the suggested workflow type. Comments on pull requests, and issues will trigger the issue_comment workflow event.
-on:
-  issue_comment:
-    types: [created]
-
-# permissions needed for reacting to IssueOps commands on PRs
-permissions:
-  pull-requests: write
-  checks: read
-  # issues: write
-
-name: Workflow to Bundle Desktop App
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  trigger-on-command:
-    name: Trigger on ".bundle" PR comment
-    runs-on: ubuntu-latest
-    outputs:
-      continue: ${{ steps.command.outputs.continue }}
-      # Cannot use github.event.pull_request.number since the trigger is 'issue_comment'
-      pr_number: ${{ steps.command.outputs.issue_number }}
-    steps:
-      - uses: github/command@v1.3.0
-        id: command
-        with:
-          command: ".bundle"
-          skip_reviews: true
-          reaction: "eyes"
-          allowed_contexts: pull_request
-
-  bundle-desktop:
-    # Only run this if ".bundle" command is detected.
-    needs: [trigger-on-command]
-    if: ${{ needs.trigger-on-command.outputs.continue == 'true' }}
-    uses: ./.github/workflows/bundle-desktop.yml
-    with:
-      signing: true
-    secrets:
-      CERTIFICATE_OSX_APPLICATION: ${{ secrets.CERTIFICATE_OSX_APPLICATION }}
-      CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}
-      APPLE_ID: ${{ secrets.APPLE_ID }}
-      APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
-      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-
-  bundle-desktop-windows:
-    # Only run this if ".bundle" command is detected.
-    needs: [trigger-on-command]
-    if: ${{ needs.trigger-on-command.outputs.continue == 'true' }}
-    uses: ./.github/workflows/bundle-desktop-windows.yml
-    with:
-      signing: true
-    secrets:
-      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-      WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-
-  pr-comment:
-    name: PR Comment with Desktop App
-    runs-on: ubuntu-latest
-    needs: [trigger-on-command, bundle-desktop, bundle-desktop-windows]
-    permissions:
-      pull-requests: write
-
-    steps:
-      - name: Download all artifacts
-        uses: actions/download-artifact@v4
-        with:
-          merge-multiple: true
-
-      - name: Comment on PR with download link
-        uses: peter-evans/create-or-update-comment@v4
-        with:
-          issue-number: ${{ needs.trigger-on-command.outputs.pr_number }}
-          body: |
-            ### Desktop App for this PR
-
-            The following builds are available for testing:
-
-            - [📱 macOS Desktop App (arm64, signed)](https://nightly.link/${{ github.repository }}/actions/runs/${{ github.run_id }}/Goose-darwin-arm64.zip)
-            - [🪟 Windows Desktop App (x64, signed)](https://nightly.link/${{ github.repository }}/actions/runs/${{ github.run_id }}/desktop-windows-dist.zip)
-
-            **macOS Instructions:**
-            After downloading, unzip the file and drag the Goose.app to your Applications folder. The app is signed and notarized for macOS.
-
-            **Windows Instructions:**
-            After downloading, unzip the file and run Goose.exe. The app is signed for Windows.
-
-            These links are provided by nightly.link and will work even if you're not logged into GitHub.

.github/workflows/pr-comment-bundle-intel.yml

@@ -0,0 +1,83 @@
+# This workflow is triggered by a comment on an issue or PR with the text ".bundle-intel"
+# It bundles the Intel Desktop App, then creates a PR comment with a link to download the app.
+
+on:
+  issue_comment:
+    types: [created]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to comment on'
+        required: true
+        type: string
+
+# permissions needed for reacting to IssueOps commands on PRs
+permissions:
+  pull-requests: write
+  checks: read
+
+name: Bundle Intel Desktop App
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  trigger-on-command:
+    name: Trigger on ".bundle-intel" PR comment
+    runs-on: ubuntu-latest
+    outputs:
+      continue: ${{ steps.command.outputs.continue || github.event_name == 'workflow_dispatch' }}
+      # Cannot use github.event.pull_request.number since the trigger is 'issue_comment'
+      pr_number: ${{ steps.command.outputs.issue_number || github.event.inputs.pr_number }}
+    steps:
+      - if: ${{ github.event_name == 'issue_comment' }}
+        uses: github/command@v1.3.0
+        id: command
+        with:
+          command: ".bundle-intel"
+          skip_reviews: true
+          reaction: "eyes"
+          allowed_contexts: pull_request
+
+  bundle-desktop-intel:
+    # Only run this if ".bundle-intel" command is detected.
+    needs: [trigger-on-command]
+    if: ${{ needs.trigger-on-command.outputs.continue == 'true' }}
+    uses: ./.github/workflows/bundle-desktop-intel.yml
+    with:
+      signing: true
+    secrets:
+      CERTIFICATE_OSX_APPLICATION: ${{ secrets.CERTIFICATE_OSX_APPLICATION }}
+      CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}
+      APPLE_ID: ${{ secrets.APPLE_ID }}
+      APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+
+  pr-comment-intel:
+    name: PR Comment with macOS Intel App
+    runs-on: ubuntu-latest
+    needs: [trigger-on-command, bundle-desktop-intel]
+    permissions:
+      pull-requests: write
+
+    steps:
+      - name: Download Intel artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: Goose-darwin-x64
+          path: intel-dist
+
+      - name: Comment on PR with Intel download link
+        uses: peter-evans/create-or-update-comment@v4
+        with:
+          issue-number: ${{ needs.trigger-on-command.outputs.pr_number }}
+          body: |
+            ### macOS Intel Desktop App (x64)
+
+            [💻 Download macOS Desktop App (Intel x64, signed)](https://nightly.link/${{ github.repository }}/actions/runs/${{ github.run_id }}/Goose-darwin-x64.zip)
+
+            **Instructions:**
+            After downloading, unzip the file and drag the Goose.app to your Applications folder. The app is signed and notarized for macOS.
+
+            This link is provided by nightly.link and will work even if you're not logged into GitHub.

.github/workflows/pr-comment-bundle-windows.yml

@@ -0,0 +1,80 @@
+# This workflow is triggered by a comment on an issue or PR with the text ".bundle-windows"
+# It bundles the Windows Desktop App, then creates a PR comment with a link to download the app.
+
+on:
+  issue_comment:
+    types: [created]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to comment on'
+        required: true
+        type: string
+
+# permissions needed for reacting to IssueOps commands on PRs
+permissions:
+  pull-requests: write
+  checks: read
+
+name: Bundle Windows Desktop App
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  trigger-on-command:
+    name: Trigger on ".bundle-windows" PR comment
+    runs-on: ubuntu-latest
+    outputs:
+      continue: ${{ steps.command.outputs.continue || github.event_name == 'workflow_dispatch' }}
+      # Cannot use github.event.pull_request.number since the trigger is 'issue_comment'
+      pr_number: ${{ steps.command.outputs.issue_number || github.event.inputs.pr_number }}
+    steps:
+      - if: ${{ github.event_name == 'issue_comment' }}
+        uses: github/command@v1.3.0
+        id: command
+        with:
+          command: ".bundle-windows"
+          skip_reviews: true
+          reaction: "eyes"
+          allowed_contexts: pull_request
+
+  bundle-desktop-windows:
+    # Only run this if ".bundle-windows" command is detected.
+    needs: [trigger-on-command]
+    if: ${{ needs.trigger-on-command.outputs.continue == 'true' }}
+    uses: ./.github/workflows/bundle-desktop-windows.yml
+    with:
+      signing: false  # false for now as we don't have a cert yet
+    secrets:
+      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+      WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+
+  pr-comment-windows:
+    name: PR Comment with Windows App
+    runs-on: ubuntu-latest
+    needs: [trigger-on-command, bundle-desktop-windows]
+    permissions:
+      pull-requests: write
+
+    steps:
+      - name: Download Windows artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: desktop-windows-dist
+          path: windows-dist
+
+      - name: Comment on PR with Windows download link
+        uses: peter-evans/create-or-update-comment@v4
+        with:
+          issue-number: ${{ needs.trigger-on-command.outputs.pr_number }}
+          body: |
+            ### Windows Desktop App
+
+            [🪟 Download Windows Desktop App (x64, signed)](https://nightly.link/${{ github.repository }}/actions/runs/${{ github.run_id }}/desktop-windows-dist.zip)
+
+            **Instructions:**
+            After downloading, unzip the file and run Goose.exe. The app is signed for Windows.
+
+            This link is provided by nightly.link and will work even if you're not logged into GitHub.

.github/workflows/pr-comment-bundle.yml

@@ -0,0 +1,83 @@
+# This workflow is triggered by a comment on an issue or PR with the text ".bundle"
+# It bundles the ARM64 Desktop App, then creates a PR comment with a link to download the app.
+
+on:
+  issue_comment:
+    types: [created]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to comment on'
+        required: true
+        type: string
+
+# permissions needed for reacting to IssueOps commands on PRs
+permissions:
+  pull-requests: write
+  checks: read
+
+name: Bundle ARM64 Desktop App
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  trigger-on-command:
+    name: Trigger on ".bundle" PR comment
+    runs-on: ubuntu-latest
+    outputs:
+      continue: ${{ steps.command.outputs.continue || github.event_name == 'workflow_dispatch' }}
+      # Cannot use github.event.pull_request.number since the trigger is 'issue_comment'
+      pr_number: ${{ steps.command.outputs.issue_number || github.event.inputs.pr_number }}
+    steps:
+      - if: ${{ github.event_name == 'issue_comment' }}
+        uses: github/command@v1.3.0
+        id: command
+        with:
+          command: ".bundle"
+          skip_reviews: true
+          reaction: "eyes"
+          allowed_contexts: pull_request
+
+  bundle-desktop:
+    # Only run this if ".bundle" command is detected.
+    needs: [trigger-on-command]
+    if: ${{ needs.trigger-on-command.outputs.continue == 'true' }}
+    uses: ./.github/workflows/bundle-desktop.yml
+    with:
+      signing: true
+    secrets:
+      CERTIFICATE_OSX_APPLICATION: ${{ secrets.CERTIFICATE_OSX_APPLICATION }}
+      CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}
+      APPLE_ID: ${{ secrets.APPLE_ID }}
+      APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+
+  pr-comment-arm64:
+    name: PR Comment with macOS ARM64 App
+    runs-on: ubuntu-latest
+    needs: [trigger-on-command, bundle-desktop]
+    permissions:
+      pull-requests: write
+
+    steps:
+      - name: Download ARM64 artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: Goose-darwin-arm64
+          path: arm64-dist
+
+      - name: Comment on PR with ARM64 download link
+        uses: peter-evans/create-or-update-comment@v4
+        with:
+          issue-number: ${{ needs.trigger-on-command.outputs.pr_number }}
+          body: |
+            ### macOS ARM64 Desktop App (Apple Silicon)
+
+            [📱 Download macOS Desktop App (arm64, signed)](https://nightly.link/${{ github.repository }}/actions/runs/${{ github.run_id }}/Goose-darwin-arm64.zip)
+
+            **Instructions:**
+            After downloading, unzip the file and drag the Goose.app to your Applications folder. The app is signed and notarized for macOS.
+
+            This link is provided by nightly.link and will work even if you're not logged into GitHub.

.github/workflows/release.yml

@@ -46,8 +46,22 @@ jobs:
       APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
       APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
 
+  # ------------------------------------------------------------
+  # 4) Bundle Desktop App (macOS)
+  # ------------------------------------------------------------
+  bundle-desktop-intel:
+    uses: ./.github/workflows/bundle-desktop-intel.yml
+    with:
+      signing: true
+    secrets:
+      CERTIFICATE_OSX_APPLICATION: ${{ secrets.CERTIFICATE_OSX_APPLICATION }}
+      CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}
+      APPLE_ID: ${{ secrets.APPLE_ID }}
+      APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+
 #  # ------------------------------------------------------------
-#  # 4) Bundle Desktop App (Windows)
+#  # 5) Bundle Desktop App (Windows)
 #  # ------------------------------------------------------------
 #  bundle-desktop-windows:
 #    uses: ./.github/workflows/bundle-desktop-windows.yml
@@ -60,7 +74,7 @@ jobs:
 #    #   WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
 
   # ------------------------------------
-  # 4) Create/Update GitHub Release
+  # 6) Create/Update GitHub Release
   # ------------------------------------
   release:
     name: Release

Justfile

@@ -37,6 +37,12 @@ release-windows:
     fi
     echo "Windows executable and required DLLs created at ./target/x86_64-pc-windows-gnu/release/"
 
+# Build for Intel Mac
+release-intel:
+    @echo "Building release version for Intel Mac..."
+    cargo build --release --target x86_64-apple-darwin
+    @just copy-binary-intel
+
 copy-binary BUILD_MODE="release":
     @if [ -f ./target/{{BUILD_MODE}}/goosed ]; then \
         echo "Copying goosed binary from target/{{BUILD_MODE}}..."; \
@@ -46,6 +52,16 @@ copy-binary BUILD_MODE="release":
         exit 1; \
     fi
 
+# Copy binary command for Intel build
+copy-binary-intel:
+    @if [ -f ./target/x86_64-apple-darwin/release/goosed ]; then \
+        echo "Copying Intel goosed binary to ui/desktop/src/bin with permissions preserved..."; \
+        cp -p ./target/x86_64-apple-darwin/release/goosed ./ui/desktop/src/bin/; \
+    else \
+        echo "Intel release binary not found."; \
+        exit 1; \
+    fi
+
 # Copy Windows binary command
 copy-binary-windows:
     @powershell.exe -Command "if (Test-Path ./target/x86_64-pc-windows-gnu/release/goosed.exe) { \
@@ -111,6 +127,11 @@ make-ui-windows:
         exit 1; \
     fi
 
+# make GUI with latest binary
+make-ui-intel:
+    @just release-intel
+    cd ui/desktop && npm run bundle:intel
+
 # Setup langfuse server
 langfuse-server:
     #!/usr/bin/env bash

ui/desktop/forge.config.ts

@@ -54,8 +54,9 @@ module.exports = {
       name: '@electron-forge/maker-zip',
       platforms: ['darwin', 'win32'],
       config: {
-        options: {
-          icon: 'src/images/icon.ico'
+          arch: process.env.ELECTRON_ARCH === 'x64' ? ['x64'] : ['arm64'],
+          options: {
+              icon: 'src/images/icon.ico'
         }
       }
     },

ui/desktop/package.json

@@ -13,6 +13,7 @@
     "make": "electron-forge make",
     "bundle:default": "npm run make && cd out/Goose-darwin-arm64 && ditto -c -k --sequesterRsrc --keepParent Goose.app Goose.zip",
     "bundle:windows": "npm run make -- --platform=win32 --arch=x64 && node scripts/copy-windows-dlls.js",
+    "bundle:intel": " npm run make -- --arch=x64 && cd out/Goose-darwin-x64 && ditto -c -k --sequesterRsrc --keepParent Goose.app Goose_intel_mac.zip",
     "debug": "echo 'run --remote-debugging-port=8315' && lldb out/Goose-darwin-arm64/Goose.app",
     "test-e2e": "electron-forge start > /tmp/out.txt & ELECTRON_PID=$! && sleep 12 && if grep -q 'renderer: ChatWindow loaded' /tmp/out.txt; then echo 'process is running'; pkill -f electron; else echo 'not starting correctly'; cat /tmp/out.txt; pkill -f electron; exit 1; fi",
     "lint": "eslint \"src/**/*.{ts,tsx}\" --fix",