fix(release): rebuild DMG from scratch via bundle_dmg.sh (supersedes #952/#955)

[senamakel]

Summary

Stops trying to mount-and-modify the Tauri-built DMG after notarization, and instead rebuilds it from scratch using the same bundle_dmg.sh Tauri itself uses. The mount-and-modify approach (and every variant we tried — retry loop, temp output path, hdiutil compact) fails consistently on macOS 26.x runners with:

Preparing imaging engine…
hdiutil: convert failed - internal error

after UDZO → UDRW → modify → UDZO. The failure is structural in current hdiutil — modifying a converted UDRW and re-compressing it to UDZO is broken. Tauri's own bundle_dmg.sh builds a fresh UDRW from a source folder via hdiutil create -srcfolder and then converts to UDZO, which works fine.

Approach

• Tauri leaves <bundle_dir>/dmg/bundle_dmg.sh and <bundle_dir>/share/create-dmg/support/ on disk after the original bundle pass. Reuse them.
• Run bundle_dmg.sh against the (now-notarized) <bundle_dir>/macos/OpenHuman.app with the same defaults Tauri passes (--volname OpenHuman, --icon OpenHuman.app 180 170, --app-drop-link 480 170, --window-size 660 400, --background images/background-dmg.png, --skip-jenkins).
• Output replaces the original DMG at <bundle_dir>/dmg/<NAME>.dmg.
• Stage the .app into MACOS_DIR if the caller passed it from elsewhere, so the source folder always contains the right (notarized) bundle.
• Pre-clean any leftover rw.*.dmg scratch files; resolve every path absolute so the cd-then-invoke flow doesn't break.
• Notarization, log-fetch-on-failure, stapling, and final mount/layout verification logic preserved.

Test plan

• Local end-to-end run against OpenHuman.app from the debug bundle: bundle_dmg.sh produced a 176M UDZO DMG, Apple notary returned status: Accepted, issues: null, xcrun stapler staple succeeded, mount verification confirmed OpenHuman.app + Applications symlink present.
• Dispatch a staging release on GitHub Actions; confirm Re-package DMG after notarization succeeds and the resulting DMG has the expected layout.

Supersedes

• fix(release): retry hdiutil convert on intermittent UDZO internal error #952 (retry-only) — won't help against the structural failure.
• fix(release): convert UDZO to temp path + compact (DMG repackage) #955 (temp path + compact) — same.

Reference failing run: https://github.com/tinyhumansai/openhuman/actions/runs/24970255766/job/73111881422

Summary by CodeRabbit

• Chores
  • Optimized the macOS disk image creation process to enhance build reliability.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e55ddaf4-600b-4aac-9608-b550eab7ce3e

📥 Commits

Reviewing files that changed from the base of the PR and between e3c46d1 and 91af806.

📒 Files selected for processing (1)

• scripts/release/repackage-dmg.sh

---

📝 Walkthrough

Walkthrough

The DMG re-packaging flow transitions from modifying an existing Tauri-built UDZO image in-place to rebuilding the DMG from scratch using Tauri's vendored bundle_dmg.sh. The script now resolves paths, validates files, stages the notarized .app, optionally injects background images, executes the bundle script, and notarizes the rebuilt DMG.

Changes

Cohort / File(s)

Summary

DMG Repackaging Logic Rewrite scripts/release/repackage-dmg.sh

Replaces in-place UDZO conversion (UDZO→UDRW→mount→replace→resize→UDZO) with scratch rebuild via bundle_dmg.sh. Adds bundle path resolution, file/directory validation, staged .app placement into $bundle_dir/macos/<AppName>, optional DMG background image injection, and notarization of the rebuilt DMG. Updates cleanup to remove rw.*.dmg scratch artifacts and adjusts error output to reference $APP_NAME and write to stderr.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• fix(release): retry hdiutil convert on intermittent UDZO internal error #952: Hardens the original in-place hdiutil UDZO conversion approach (force detach, sync, retry) to handle intermittent errors—opposite strategy to this rebuild-from-scratch approach.
• Restore macOS DMG layout after re-package #939: Also modifies repackage-dmg.sh to integrate a notarized .app into a DMG but uses in-place repackaging instead of the scratch-rebuild strategy.
• fix(release): sign CEF inner dylibs so macOS notarization passes #951: Adds JSON notary submission handling and status checks to the DMG repackage/notarization flow.

Poem

🐰 A bundle rebuilt from scratch so fine,
No UDZO quirks shall make us pine,
With bundle_dmg.sh we leap and bound,
A cleaner path for DMGs found!
Notarized and stapled with care, ✨

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}