fix(desktop): notarize dmg in a retryable step to survive poll timeouts

.github/workflows/release.yml

@@ -108,9 +108,6 @@ jobs:
           # is the correct state for unsigned builds.
           MAC_CSC_LINK: ${{ secrets.MAC_CSC_LINK }}
           MAC_CSC_KEY_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           WIN_CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
           WIN_CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
         run: |
@@ -134,8 +131,50 @@ jobs:
           # `--publish never` still emits the latest*.yml files we parse for sha512.
           # Use the dynamic config (electron-builder.js) so mac.binaries is
           # populated with the embedded backend's Mach-O files for signing.
+          # electron-builder signs but does NOT notarize (notarize:false); the
+          # dedicated step below notarizes + staples with retry.
           npx electron-builder ${{ matrix.eb_flags }} --config electron-builder.js --publish never
 
+      # Whether Mac signing secrets are present. `secrets` can't be used in a
+      # step `if:` directly, and step-level `env` isn't visible to that step's
+      # own `if:`, so surface it as an output for the notarize step to gate on.
+      - name: Check mac signing secrets
+        id: macsign
+        if: matrix.platform == 'mac'
+        shell: bash
+        env:
+          MAC_CSC_LINK: ${{ secrets.MAC_CSC_LINK }}
+        run: |
+          if [ -n "$MAC_CSC_LINK" ]; then
+            echo "enabled=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "enabled=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::MAC_CSC_LINK not set — skipping notarization (unsigned build)."
+          fi
+
+      # Notarize + staple the dmg in a separate, retryable step. electron-builder's
+      # inline notarize aborts the whole build on a single notarytool poll timeout
+      # (NSURLErrorDomain -1001); this step retries so a flaky poll doesn't discard
+      # the signed build. Skipped for Windows and for unsigned builds (no cert).
+      - name: Notarize macOS dmg
+        if: matrix.platform == 'mac' && steps.macsign.outputs.enabled == 'true'
+        working-directory: desktop
+        shell: bash
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          shopt -s nullglob
+          dmgs=(release/*.dmg)
+          if [ ${#dmgs[@]} -eq 0 ]; then
+            echo "::error::no dmg found to notarize"
+            exit 1
+          fi
+          for dmg in "${dmgs[@]}"; do
+            bash build/notarize-dmg.sh "$dmg"
+          done
+
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with: