ci(macos): retry transient stapler failures

[ReenigneArcher]

Description

The macOS notarization job can fail after Apple accepts the DMG because stapler loses its connection to Apple's ticket service and exits with code 68, as shown in the failed job. Rerunning the job can then succeed.

Retry stapling up to five times with 30 seconds between attempts for exit code 68 (EX_NOHOST). Stop immediately on other errors and preserve the failure exit code if retries are exhausted.

Screenshot

Issues Fixed or Closed

Roadmap Issues

Testing

• Workflow lint passed: actionlint -shellcheck= .github/workflows/ci-macos-dmg.yml.
• Bash syntax validation passed for the full embedded workflow step.
• Executed the exact retry loop under Bash with simulated xcrun and sleep commands: 18 scenarios passed across the arm64 and x86_64 artifact targets. Covered immediate success, recovery after a transient failure, recovery on the final attempt, retry exhaustion, permanent failures, and a permanent failure after a transient error.
• Confirmed the original single-attempt command exits with code 68 instead of recovering in the same simulated network-failure scenario.
• git diff --check passed.

This change only modifies CI configuration; the embedded Bash was exercised directly without adding a persistent test suite. Live Apple notarization/stapling was not run locally because it requires macOS and Apple credentials.

Type of Change

• feat: New feature (non-breaking change which adds functionality)
• fix: Bug fix (non-breaking change which fixes an issue)
• docs: Documentation only changes
• style: Changes that do not affect the meaning of the code (white-space, formatting, missing semicolons, etc.)
• refactor: Code change that neither fixes a bug nor adds a feature
• perf: Code change that improves performance
• test: Adding missing tests or correcting existing tests
• build: Changes that affect the build system or external dependencies
• ci: Changes to CI configuration files and scripts
• chore: Other changes that don't modify src or test files
• revert: Reverts a previous commit
• BREAKING CHANGE: Introduces a breaking change (can be combined with any type above)

Checklist

• Code follows the style guidelines of this project
• Code has been self-reviewed
• Code has been commented, particularly in hard-to-understand areas
• Code docstring/documentation-blocks for new or existing methods/components have been added or updated
• Tests have been added or updated for new or modified functionality, including regression tests for bug fixes

AI Usage

See our AI usage policy.

• AI tools were used while preparing this PR

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 50.70%. Comparing base (abfaca5) to head (bf39efa).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #315   +/-   ##
=======================================
  Coverage   50.70%   50.70%           
=======================================
  Files          40       40           
  Lines       13259    13259           
=======================================
  Hits         6723     6723           
  Misses       6536     6536           

Flag	Coverage Δ
aarch64-apple-darwin	49.73% <ø> (ø)
aarch64-unknown-linux-gnu	49.73% <ø> (ø)
aarch64-unknown-linux-musl	50.16% <ø> (ø)
x86_64-apple-darwin	49.73% <ø> (ø)
x86_64-pc-windows-msvc	50.74% <ø> (ø)
x86_64-unknown-linux-gnu	49.73% <ø> (ø)
x86_64-unknown-linux-musl	50.16% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update abfaca5...bf39efa. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.