Fix macOS installer when release artifact is missing

[manuschillerdev]

Summary

• make the macOS full installer select the latest release, then fall back to building that release from source when the darwin server archive is missing
• share the source-build path with BRANCH installs instead of duplicating it
• stop requiring Docker CLI during macOS preflight; Docker remains optional for build workloads
• publish hypeman_<version>_darwin_arm64.tar.gz from the release workflow on a macOS arm64 runner and update checksums.txt
• keep tag releases as drafts until the macOS artifact and merged checksum file are uploaded, so users do not see partially-published releases
• add workflow_dispatch to backfill the macOS artifact for an existing release tag
• document the macOS source-build fallback prerequisites

Closes #273.

Validation

• bash -n scripts/install.sh scripts/install-cli.sh
• git diff --check
• actionlint -ignore 'label "kvm" is unknown' .github/workflows/release.yml
• make sign-darwin
• confirmed https://get.hypeman.sh/cli currently redirects to scripts/install-cli.sh
• confirmed latest release v0.1.0 only has Linux server archives

---

Note

Medium Risk
Changes how GitHub releases are published (draft until macOS artifacts land) and how macOS installs resolve versions and binaries; mistakes could leave releases unpublished or ship unsigned builds if signing steps fail.

Overview
Fixes macOS installs when a GitHub release has Linux artifacts but no darwin_arm64 server archive, and aligns CI so those archives are produced and releases are not published half-finished.

Release pipeline: GoReleaser now creates draft releases; the Linux job only runs on tag push. A macOS arm64 self-hosted job builds with make sign-darwin, uploads hypeman_<version>_darwin_arm64.tar.gz, merges the archive into checksums.txt, and on tag push publishes the release (--draft=false). workflow_dispatch with a tag input backfills the macOS artifact for an existing release.

Installer (install.sh): On macOS, latest is resolved via the releases API (not “newest release that already has an artifact”). If the darwin tarball download fails, it builds that tag from source via a shared build_server_from_source path (also used for BRANCH). Docker is no longer required in preflight; it stays optional for the builder image. README/install header document the source-build prerequisites.

^{Reviewed by Cursor Bugbot for commit a0748e1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Created a monitoring plan for this PR.

What this PR does: Makes the Hypeman macOS full installer work when the latest release doesn't include a pre-built macOS server binary — it now falls back to building from source instead of failing with an error. Docker is no longer required at install time on macOS.

Intended effect:

• macOS install success rate: baseline = 0% (full installer hard-fails when no Darwin artifact exists, as with current v0.1.0); confirmed if macOS users can complete installation using the source-build fallback path without a Docker requirement.
• No production server telemetry exists for installer execution — this is a curl | bash script running on user machines. Confirmation is manual (macOS test run) or inferred from absence of new GitHub Issues reporting macOS install failures.

Risks:

• Missing source-build prerequisites — require_source_build_tools check, alert if users report "git/go/make is required to build from source but not installed" errors (GitHub Issues or user feedback within 48h of merge).
• find_latest_release_tag selects a partially-uploaded release — installer falls back to source build even though the artifact will be available shortly; self-resolving, alert if sustained reports of unexpected source builds appear.
• make sign-darwin fails without signing identity — codesign error during macOS source build; alert if any report of "Build/signing failed" from the new source-build fallback path.

Status updates will be posted automatically on this PR as monitoring progresses.

View monitor

[manuschillerdev]

Added the release-side fix as well: the release workflow now builds and uploads hypeman_<version>_darwin_arm64.tar.gz from a macOS arm64 runner, updates checksums.txt, and supports workflow_dispatch so maintainers can backfill an existing tag such as v0.1.0.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ed23bdc. Configure here.}

[manuschillerdev]

Addressed the remaining caveats from the monitoring plan: future tag releases are now created as drafts and only published after the macOS artifact plus merged checksums are uploaded, so installers will not see a partially-published latest release. I also validated the macOS source build/signing path with make sign-darwin on darwin/arm64, confirming ad-hoc signing works without a Developer ID identity.