chore(release): prepare 1.1.0, with a universal macOS disk image

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -16,7 +16,7 @@ body:
     attributes:
       label: QuickPlay version
       description: From the settings page (gear in the title bar) or `waveflow-quickplay --version`.
-      placeholder: "1.0.0"
+      placeholder: "1.1.0"
     validations:
       required: true
 
@@ -31,8 +31,8 @@ body:
         - Linux (KDE Plasma on Wayland)
         - Linux (X11 — any desktop)
         - Linux (other, specify below)
-        - macOS (Apple Silicon, built from source)
-        - macOS (Intel, built from source)
+        - macOS (Apple Silicon)
+        - macOS (Intel)
         - Other (specify in the steps)
     validations:
       required: true
@@ -44,7 +44,9 @@ body:
       options:
         - GitHub Releases (Windows installer .exe)
         - GitHub Releases (.deb)
+        - GitHub Releases (.rpm)
         - GitHub Releases (.AppImage)
+        - GitHub Releases (macOS .dmg)
         - Built from source (`cargo build --release`)
     validations:
       required: true
@@ -82,8 +84,8 @@ body:
       label: Steps to reproduce
       description: Numbered steps a stranger could follow on a fresh install.
       placeholder: |
-        1. Install QuickPlay 1.0.0 with the Windows installer.
-        2. Right-click a 24-bit FLAC → "Play with WaveFlow QuickPlay".
+        1. Install QuickPlay 1.1.0 with the Windows installer.
+        2. Right-click a 24-bit FLAC → "Play with QuickPlay".
         3. Observe the status line.
     validations:
       required: true

.github/SECURITY.md

@@ -29,7 +29,7 @@ Your report should include:
 - a clear description of the issue;
 - the expected impact on users or their files;
 - the affected version, platform, and installation mode (installer, `.deb`,
-  AppImage, built from source);
+  `.rpm`, AppImage, `.dmg`, built from source);
 - the affected surface: a file format, the single-instance socket, the
   file-manager registration, the installer, a user flow;
 - detailed reproduction steps, with a sample file when the issue is in a

.github/workflows/ci.yml

@@ -1,6 +1,7 @@
-# Format, lint and test on every push and pull request, on the two platforms
-# QuickPlay is released for. The toolchain comes from rust-toolchain.toml;
-# waveflow-core is fetched from the pinned WaveFlow commit.
+# Format, lint and test on every push and pull request, on the three
+# platforms QuickPlay is released for. The toolchain comes from
+# rust-toolchain.toml; waveflow-core is fetched from the pinned WaveFlow
+# commit.
 name: CI
 
 on:
@@ -21,7 +22,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-latest, ubuntu-24.04]
+        os: [windows-latest, ubuntu-24.04, macos-latest]
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
     steps:

.github/workflows/release.yml

@@ -1,14 +1,14 @@
 # Builds the installers for a version tag (`v1.0.0`) and publishes them as a
 # GitHub release: a per-user NSIS installer for Windows, a .deb, an .rpm and
-# an AppImage for Linux, with SHA-256 checksums and the notes from
-# docs/releases/<tag>.md. Nothing is built unless the tag matches Cargo.toml
-# and the tests pass.
+# an AppImage for Linux, a universal disk image for macOS, with SHA-256
+# checksums and the notes from docs/releases/<tag>.md. Nothing is built
+# unless the tag matches Cargo.toml and the tests pass.
 #
 # It can also be run by hand from `main` for an existing tag (Actions ›
 # Release › Run workflow), with the workflow definition of `main` and the
 # sources of the tag: that is how a package format added after a release
-# gets attached to it. `linux_only` skips the Windows job so the signed
-# installer already published is left untouched; files that are rebuilt
+# gets attached to it. `linux_only` skips the Windows and macOS jobs so the
+# signed builds already published are left untouched; files that are rebuilt
 # replace their namesake on the release.
 name: Release
 
@@ -39,7 +39,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ env.RELEASE_TAG }}
           persist-credentials: false
@@ -58,7 +58,7 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ env.RELEASE_TAG }}
           persist-credentials: false
@@ -146,7 +146,7 @@ jobs:
             "{0}  {1}" -f (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower(), $_.Name
           } | Set-Content target/packager/SHA256SUMS-windows.txt -Encoding ascii
           Get-Content target/packager/SHA256SUMS-windows.txt
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: windows
           path: |
@@ -163,15 +163,15 @@ jobs:
       # linuxdeploy and appimagetool are AppImages themselves; no FUSE on runners.
       APPIMAGE_EXTRACT_AND_RUN: "1"
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ env.RELEASE_TAG }}
           persist-credentials: false
       # The packaging definitions (desktop entries, rpm.toml) come from the
       # workflow's own ref: on a tag push that is the tag itself, on a
       # manual run it is the branch chosen, so a package format added after
       # a release can be built for it.
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
           path: workflow-ref
@@ -210,7 +210,7 @@ jobs:
           cd target/packager
           sha256sum *.deb *.rpm *.AppImage > SHA256SUMS-linux.txt
           cat SHA256SUMS-linux.txt
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: linux
           path: |
@@ -220,22 +220,89 @@ jobs:
             target/packager/SHA256SUMS-linux.txt
           if-no-files-found: error
 
+  macos:
+    name: macOS disk image
+    needs: version
+    if: ${{ !inputs.linux_only }}
+    runs-on: macos-latest
+    timeout-minutes: 90
+    env:
+      # The oldest macOS the binary and the bundle's Info.plist accept.
+      MACOSX_DEPLOYMENT_TARGET: "11.0"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ env.RELEASE_TAG }}
+          persist-credentials: false
+      # The bundle definition comes from the workflow's own ref, as the
+      # Linux packaging does, so a manual run can attach it to an older tag.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          path: workflow-ref
+          sparse-checkout: |
+            packaging
+            assets
+          persist-credentials: false
+      - run: |
+          cp -r workflow-ref/packaging/. packaging/
+          cp workflow-ref/assets/icon.icns assets/icon.icns
+      - run: rustup show active-toolchain
+      - run: rustup target add aarch64-apple-darwin x86_64-apple-darwin
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - run: cargo test --locked
+      # One binary for Apple silicon and Intel Macs.
+      - name: Universal binary
+        run: |
+          cargo build --release --locked --target aarch64-apple-darwin
+          cargo build --release --locked --target x86_64-apple-darwin
+          mkdir -p target/universal
+          lipo -create -output target/universal/waveflow-quickplay \
+            target/aarch64-apple-darwin/release/waveflow-quickplay \
+            target/x86_64-apple-darwin/release/waveflow-quickplay
+          lipo -info target/universal/waveflow-quickplay
+      # Signed ad hoc, as WaveFlow Desktop's macOS build is: sealed, with no
+      # Apple Developer ID behind it and an identity that changes with every
+      # build, so Gatekeeper blocks the first launch of each downloaded
+      # version until the user allows it (see packaging/macos/bundle.sh).
+      - name: App bundle and disk image
+        run: |
+          version=$(grep -m1 '^version' Cargo.toml | cut -d'"' -f2)
+          mkdir -p target/packager
+          bash packaging/macos/bundle.sh target/universal/waveflow-quickplay "$version" target/packager
+          app="target/packager/WaveFlow QuickPlay.app"
+          codesign --display --verbose=2 "$app" 2>&1 | grep -q 'Signature=adhoc'
+          lipo -info "$app/Contents/MacOS/waveflow-quickplay" | grep -q 'x86_64 arm64'
+          test "$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$app/Contents/Info.plist")" = "$version"
+      - name: Checksums
+        run: |
+          cd target/packager
+          shasum -a 256 *.dmg > SHA256SUMS-macos.txt
+          cat SHA256SUMS-macos.txt
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: macos
+          path: |
+            target/packager/*.dmg
+            target/packager/SHA256SUMS-macos.txt
+          if-no-files-found: error
+
   publish:
     name: GitHub release
-    needs: [windows, linux]
-    # Runs when every job that ran succeeded; `windows` may have been
-    # skipped by `linux_only`.
-    if: ${{ always() && needs.linux.result == 'success' && (needs.windows.result == 'success' || needs.windows.result == 'skipped') }}
+    needs: [windows, linux, macos]
+    # Runs when every job that ran succeeded; `windows` and `macos` may
+    # have been skipped by `linux_only`.
+    if: ${{ always() && needs.linux.result == 'success' && (needs.windows.result == 'success' || needs.windows.result == 'skipped') && (needs.macos.result == 'success' || needs.macos.result == 'skipped') }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ env.RELEASE_TAG }}
           persist-credentials: false
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: dist
           merge-multiple: true

CONTRIBUTING.md

@@ -2,8 +2,8 @@
 
 Thanks for wanting to help. QuickPlay is the small player next to
 [WaveFlow](https://github.com/InstaZDLL/WaveFlow): **Rust + egui/eframe** on
-top of `waveflow-core`, the desktop app's codec and tag crate. WaveFlow's
-[CONTRIBUTING.md](https://github.com/InstaZDLL/WaveFlow/blob/main/CONTRIBUTING.md)
+top of `waveflow-core`, the desktop app's codec, tag and playback-decoding
+crate. WaveFlow's [CONTRIBUTING.md](https://github.com/InstaZDLL/WaveFlow/blob/main/CONTRIBUTING.md)
 is the canonical guide for the WaveFlow family; this file adds what is
 specific to QuickPlay.
 
@@ -42,6 +42,9 @@ cargo build --config 'patch."https://github.com/InstaZDLL/WaveFlow".waveflow-cor
 `QUICKPLAY_CAPTURE_AFTER_MS`) writes a PNG of the player window after
 start, which is how the window is checked on displays that cannot be
 grabbed from outside (GNOME on Wayland, an ssh session on macOS).
+`QUICKPLAY_WAVEFLOW=<path>` points the "Continue in WaveFlow" button at
+another WaveFlow executable, such as a development build, and skips the
+version check that otherwise hides it for WaveFlow before 2.0.0-beta.1.
 
 ## Before you open a PR
 
@@ -93,7 +96,9 @@ test checks the placeholders.
 
 Version in `Cargo.toml`, notes in `docs/releases/v<version>.md`, then a
 `v<version>` tag: `.github/workflows/release.yml` builds the signed Windows
-installer, the `.deb` and the AppImage and publishes the GitHub release.
+installer, the `.deb`, the `.rpm`, the AppImage and the macOS disk image
+(a universal app signed ad hoc, `packaging/macos/bundle.sh`) and publishes
+the GitHub release.
 Only the maintainers tag.
 
 ## Reporting bugs and security issues

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "waveflow-quickplay"
-version = "1.0.0"
+version = "1.1.0"
 description = "WaveFlow QuickPlay — a standalone, lightweight egui/eframe audio player built on WaveFlow's Rust audio infrastructure."
 authors = ["InstaZDLL <github.105mh@8shield.net>"]
 edition = "2021"
@@ -103,6 +103,20 @@ windows-sys = { version = "0.61", features = [
     "Win32_Storage_FileSystem",
 ] }
 
+[target.'cfg(target_os = "macos")'.dependencies]
+# Files opened from Finder arrive as `application:openURLs:` on the
+# application delegate (src/macos.rs): the event loop is built here so the
+# method can be added to winit's delegate before it starts, with the winit
+# and objc2 versions eframe already pulls.
+winit = { version = "0.30", default-features = false }
+objc2 = "0.5"
+objc2-foundation = { version = "0.2", features = [
+    "NSArray",
+    "NSEnumerator",
+    "NSString",
+    "NSURL",
+] }
+
 [build-dependencies]
 # Embeds the icon + VERSIONINFO into the Windows executable only; a no-op
 # elsewhere (see build.rs).