feat(ci): macOS + iOS 客户端 CI 脚本(照 jiu + 系统扩展)+ 自动更新 manifest 推送接线

compile-macos.sh(Developer ID 签名+公证+staple, 2 描述文件+libbox 重建+CFBundleVersion 递增,
早期 fail-fast 缺 secret 不浪费构建)、compile-ios.sh(TestFlight, 缺 secret 优雅跳过)。
deploy-client.yml 加 build-macos/build-ios(runs-on mac, continue-on-error+release-deploy 不 needs
它们 → 不拖挂 android/windows)。release-client.sh 兼容自动更新 manifest 推送 + macos zip。
+ url_launcher 的 macos/windows 生成插件注册。代码就绪, 待 Apple secret 才能真跑 macOS/iOS。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013nMthbVEmQquxBRKb9Fj8u

.gitea/workflows/ci.yml

@@ -58,6 +58,8 @@ jobs:
               /mnt/scripts/ci/backup-db.sh \
               /mnt/scripts/ci/compile-android.sh \
               /mnt/scripts/ci/compile-windows.sh \
+              /mnt/scripts/ci/compile-macos.sh \
+              /mnt/scripts/ci/compile-ios.sh \
               /mnt/scripts/ci/release-client.sh \
               /mnt/scripts/ci/deploy-client.sh
 

.gitea/workflows/deploy-client.yml

@@ -1,10 +1,10 @@
 name: Deploy Client
 
 # Mirrors ~/code/jiu/.gitea/workflows/deploy-client.yml's tag→build→release→
-# deploy shape, trimmed to the two platforms drafted so far (Android +
-# Windows — no client-web/macOS/iOS jobs; pangolin has no Flutter-web build
-# in this pipeline and macOS/iOS are a separate not-yet-drafted phase, see
-# docs/superpowers/plans/2026-07-05-cicd.md Phase 3).
+# deploy shape. Android + Windows are required (release-deploy `needs` them);
+# macOS + iOS (Phase 3, see docs/superpowers/plans/2026-07-05-cicd.md) are
+# intentionally DECOUPLED — see the "why build-macos/build-ios don't block"
+# note above the build-macos job below for the mechanism and rationale.
 #
 # TODO(controller) — RUNNER AVAILABILITY: per docs/ci-runner.md, pangolin
 # currently has exactly ONE registered Gitea Actions runner
@@ -76,6 +76,77 @@ jobs:
           name: windows
           path: dist/
 
+  # Why build-macos/build-ios don't block the working android+windows pipeline
+  # when Apple secrets aren't configured yet (they aren't, as of this writing):
+  #   1. release-deploy's `needs:` below is [build-android, build-windows]
+  #      ONLY — macOS/iOS are NOT dependencies, so release-deploy never waits
+  #      on them and never fails because of them.
+  #   2. `continue-on-error: true` on both jobs keeps the overall workflow-run
+  #      status green even while compile-macos.sh hard-fails (Apple Developer
+  #      ID / notary secrets absent — see its fail-fast checks) — that failure
+  #      is real signal ("go configure the secrets"), but it shouldn't read as
+  #      "the release pipeline is broken" when android+windows shipped fine.
+  #   3. compile-macos.sh's own default behavior is to hard-fail (not skip)
+  #      when its secrets are missing (macOS distribution must never ship
+  #      unsigned/unnotarized — see its header comment); compile-ios.sh's
+  #      default is to skip gracefully (exit 0) since an unconfigured iOS
+  #      account is a normal "not set up yet" state, not a defect. Either way
+  #      the job produces no dist/pangolin-macos-x64.zip, and
+  #      release-deploy's "Download all artifacts" step (no `name:` filter)
+  #      simply picks up whatever artifacts DO exist — an absent "macos"
+  #      artifact is not an error there.
+  build-macos:
+    runs-on: mac
+    continue-on-error: true
+    env:
+      PUB_HOSTED_URL: https://pub.flutter-io.cn
+      FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Compile (macOS System Extension app)
+        env:
+          MACOS_DEVELOPER_ID_CERT_P12_BASE64: ${{ secrets.MACOS_DEVELOPER_ID_CERT_P12_BASE64 }}
+          MACOS_DEVELOPER_ID_CERT_PASSWORD: ${{ secrets.MACOS_DEVELOPER_ID_CERT_PASSWORD }}
+          MACOS_APP_PROVISION_PROFILE_BASE64: ${{ secrets.MACOS_APP_PROVISION_PROFILE_BASE64 }}
+          MACOS_SYSEXT_PROVISION_PROFILE_BASE64: ${{ secrets.MACOS_SYSEXT_PROVISION_PROFILE_BASE64 }}
+          APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
+          APPSTORE_API_ISSUER_ID: ${{ secrets.APPSTORE_API_ISSUER_ID }}
+          APPSTORE_API_KEY_P8_BASE64: ${{ secrets.APPSTORE_API_KEY_P8_BASE64 }}
+          REF_NAME: ${{ gitea.ref_name }}
+        run: bash scripts/ci/compile-macos.sh "$REF_NAME"
+
+      - name: Upload macos artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: macos
+          path: dist/
+
+  build-ios:
+    runs-on: mac
+    continue-on-error: true
+    env:
+      PUB_HOSTED_URL: https://pub.flutter-io.cn
+      FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Compile & upload to TestFlight (iOS)
+        env:
+          IOS_DIST_CERT_P12_BASE64: ${{ secrets.IOS_DIST_CERT_P12_BASE64 }}
+          IOS_DIST_CERT_PASSWORD: ${{ secrets.IOS_DIST_CERT_PASSWORD }}
+          IOS_APP_PROVISIONING_PROFILE_BASE64: ${{ secrets.IOS_APP_PROVISIONING_PROFILE_BASE64 }}
+          IOS_PACKETTUNNEL_PROVISIONING_PROFILE_BASE64: ${{ secrets.IOS_PACKETTUNNEL_PROVISIONING_PROFILE_BASE64 }}
+          APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
+          APPSTORE_API_ISSUER_ID: ${{ secrets.APPSTORE_API_ISSUER_ID }}
+          APPSTORE_API_KEY_P8_BASE64: ${{ secrets.APPSTORE_API_KEY_P8_BASE64 }}
+          REF_NAME: ${{ gitea.ref_name }}
+        run: bash scripts/ci/compile-ios.sh "$REF_NAME"
+      # No artifact upload — compile-ios.sh uploads straight to TestFlight via
+      # altool (matches jiu); nothing is produced under dist/ for this job.
+
   release-deploy:
     needs: [build-android, build-windows]
     runs-on: mac
@@ -101,6 +172,11 @@ jobs:
         env:
           FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
           FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
+          # Needed here (not just in the "Deploy" step below) because
+          # release-client.sh now also SSH-pushes the auto-update manifest
+          # (version.yaml) straight to pangolin1's /etc/pangolin/ — see the
+          # header comment in scripts/ci/release-client.sh.
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
           REF_NAME: ${{ gitea.ref_name }}
         run: bash scripts/ci/release-client.sh "$REF_NAME"