feat(packaging): pack macos builds as a dmg disk image

.github/workflows/build.yml

@@ -1,7 +1,8 @@
 # Manual-only release build (PLAN §7.2): no push or pull_request trigger.
 # Each RID job runs build -> test -> publish/pack -> upload; a failing step
 # skips the rest of that job, so a RID whose tests fail produces no artifact.
-# win-x64 packs an Inno Setup installer; the other RIDs keep tar.gz archives.
+# win-x64 packs an Inno Setup installer; linux-x64 a tar.gz; osx-arm64 a
+# drag-to-Applications dmg.
 # Artifacts are uploaded unzipped (upload-artifact archive: false): each RID's
 # dist/ holds exactly one file, and its name becomes the artifact name.
 # No GitHub Release is created.

USAGE.md

@@ -4,17 +4,17 @@ YKanBan is a local, offline kanban board. Like Git, it keeps its data in a `.yka
 
 ## Installing
 
-Each release build is a self-contained archive; no .NET runtime is needed.
+Each release build is self-contained; no .NET runtime is needed.
 
-| Platform | Archive | Executable |
+| Platform | Package | Executable |
 |---|---|---|
-| Windows x64 | `YKanBan-<version>-win-x64.zip` | `YKanBan.exe` |
+| Windows x64 | `YKanBan-<version>-win-x64-setup.exe` | `YKanBan.exe` |
 | Linux x64 | `YKanBan-<version>-linux-x64.tar.gz` | `YKanBan` |
-| macOS Apple silicon | `YKanBan-<version>-osx-arm64.tar.gz` | `YKanBan.app` (see [macOS](#macos)) |
+| macOS Apple silicon | `YKanBan-<version>-osx-arm64.dmg` | `YKanBan.app` (see [macOS](#macos)) |
 
 Only Apple silicon macOS is a release target; there is no Intel Mac build.
 
-Extract the archive anywhere. To type `ykanban <path>` as shown below, put the executable on your `PATH` under that name, for example:
+On Windows, run the installer. On Linux, extract the archive anywhere. On macOS, open the disk image and drag `YKanBan.app` into `Applications` (or any other folder). To type `ykanban <path>` as shown below, put the executable on your `PATH` under that name, for example:
 
 ```sh
 # Linux
@@ -23,7 +23,7 @@ ln -s /opt/YKanBan-<version>-linux-x64/YKanBan ~/.local/bin/ykanban
 ln -s /Applications/YKanBan.app/Contents/MacOS/YKanBan /usr/local/bin/ykanban
 ```
 
-On Windows, add the extracted folder to `PATH`; `ykanban` then finds `YKanBan.exe` because Windows ignores case.
+On Windows, add the installed folder to `PATH` (the default is `C:\Program Files\YKanBan`); `ykanban` then finds `YKanBan.exe` because Windows ignores case.
 
 ## Starting YKanBan
 
@@ -50,7 +50,7 @@ The window title is `<workspace name> - YKanBan` while a workspace is open and j
 
 ## macOS
 
-The app is not notarized. After extracting, remove the download quarantine once, or macOS refuses to open it:
+The app is not notarized. After dragging it out of the disk image, remove the download quarantine once, or macOS refuses to open it:
 
 ```sh
 xattr -dr com.apple.quarantine YKanBan.app

packaging/package.sh

@@ -5,9 +5,9 @@
 #
 # win-x64   -> YKanBan-<version>-win-x64-setup.exe  (Inno Setup installer)
 # linux-x64 -> YKanBan-<version>-linux-x64.tar.gz (folder YKanBan-<version>-linux-x64/)
-# osx-*     -> YKanBan-<version>-<rid>.tar.gz     (YKanBan.app bundle, ad-hoc signed when possible)
+# osx-*     -> YKanBan-<version>-<rid>.dmg        (YKanBan.app in a drag-to-Applications disk image, ad-hoc signed when possible)
 #
-# tar.gz keeps the executable bit, which a plain zip artifact upload would lose.
+# tar.gz/dmg keep the executable bit, which a plain zip artifact upload would lose.
 set -euo pipefail
 
 if [ "$#" -ne 4 ]; then
@@ -56,7 +56,8 @@ case "$rid" in
         echo "warning: ad-hoc signing of YKanBan.app failed; packing it unsigned" >&2
       fi
     fi
-    tar -C "$staging" -czf "$output_dir/$name.tar.gz" YKanBan.app
+    ln -s /Applications "$staging/Applications"
+    hdiutil create -volname "YKanBan" -srcfolder "$staging" -format UDZO -ov "$output_dir/$name.dmg"
     ;;
   *)
     echo "unsupported RID: $rid" >&2