Add drag-to-Applications Lua DMG layout

.github/workflows/release.yml

@@ -201,12 +201,26 @@ jobs:
 
           ditto -c -k --keepParent "$app" "$dist/$update_zip"
           ditto "$app" "$RUNNER_TEMP/dmg-root/Lua.app"
+          ln -s /Applications "$RUNNER_TEMP/dmg-root/Applications"
           hdiutil create \
             -volname "Lua Browser" \
             -srcfolder "$RUNNER_TEMP/dmg-root" \
             -ov -format UDZO \
             "$dist/$dmg_name"
 
+          verify_mount="$RUNNER_TEMP/dmg-verify"
+          mkdir -p "$verify_mount"
+          hdiutil attach -readonly -nobrowse -mountpoint "$verify_mount" "$dist/$dmg_name"
+          layout_ok=1
+          [[ -d "$verify_mount/Lua.app" ]] || layout_ok=0
+          [[ -L "$verify_mount/Applications" ]] || layout_ok=0
+          [[ "$(readlink "$verify_mount/Applications" 2>/dev/null || true)" == /Applications ]] || layout_ok=0
+          hdiutil detach "$verify_mount"
+          if [[ "$layout_ok" != 1 ]]; then
+            echo "DMG must contain Lua.app and an Applications symlink." >&2
+            exit 1
+          fi
+
           xcrun notarytool submit "$dist/$dmg_name" \
             --key "$api_key_path" \
             --key-id "$APPLE_API_KEY_ID" \

RELEASING.md

@@ -3,7 +3,10 @@
 Lua ships Apple Silicon ZIP and DMG artifacts as
 `Lua-Browser-<version>-arm64`. Public artifacts must be Developer ID signed,
 notarized, stapled, Gatekeeper-assessed, checksummed, and published with a
-signed Sparkle appcast. There is no unsigned public-release fallback.
+signed Sparkle appcast. The DMG must contain both `Lua.app` and an
+`Applications` symlink so installation is an ordinary drag-and-drop flow. The
+release workflow mounts the generated DMG and verifies that layout before
+notarization. There is no unsigned public-release fallback.
 
 ## Publish a version
 

script/release-preflight

@@ -21,6 +21,8 @@ grep -q 'CR_PRODUCT_DIR_NAME = ${PRODUCT_BUNDLE_IDENTIFIER}' "$ROOT_DIR/Configs/
 grep -q 'PRODUCT_BUNDLE_IDENTIFIER = dev.jow.LuaBrowser.Development' "$ROOT_DIR/Configs/OpenSource.xcconfig"
 grep -q 'github.com/ojowwalker77/phibrowser-mac/releases/latest/download/appcast.xml' "$ROOT_DIR/Configs/Release.xcconfig"
 grep -q 'DEFAULT_SHA256="[0-9a-f]\{64\}"' "$ROOT_DIR/script/fetch_phi_framework.sh"
+grep -Fq 'ln -s /Applications "$RUNNER_TEMP/dmg-root/Applications"' \
+  "$ROOT_DIR/.github/workflows/release.yml"
 
 if grep -R -E 'ota\.phibrowser\.com|account\.phibrowser\.com|ai\.phibrowser\.com' \
   "$ROOT_DIR/Configs" "$ROOT_DIR/Resources" "$ROOT_DIR/Sources"; then