CI: publish nightly mac installers to a rolling prerelease

[dcwhite]

The mac nightly already builds four .pkg installers, but they only ever existed as Actions artifacts: 90-day expiry, and a signed-in GitHub account needed to download one. This attaches them to a rolling nightly prerelease so there is a permanent, anonymous download link, and posts that link to the same Slack channel as the nightly test results.

mac.yml — new nightly-release job

Schedule-only (master pushes would rewrite the release several times a day), needs the four installer-producing jobs with if: always() so one red variant still publishes the rest.

Three details that aren't obvious from the diff:

• The packages get renamed. All four variants emit SCIRun-<version>-Darwin.pkg — CPack sets a single PKG_FILE_NAME in src/CMakeLists.txt. As release assets those identical names would overwrite each other, so each gets a runner/arch/python suffix: SCIRun-5.0.0-macos26-arm64.pkg, -macos26-x86_64.pkg, -macos-latest-arm64.pkg, -macos-latest-arm64-nopython.pkg.
• Updating the release force-moves the git ref. GitHub ignores target_commitish on an already-published release, so without the explicit ref update the release page would keep showing whatever commit the tag was first cut from, forever.
• Yesterday's assets are deleted before upload, so a variant that fails tonight doesn't leave a stale installer sitting next to fresh ones.

nightly-slack.yml — installer link

Adds a :package: line to the existing mac-build message. It only appears when the nightly tag's sha matches the run's head sha — if the release job failed, the message omits the link rather than quietly pointing at the previous night's build.

Testing

workflow_run and schedule triggers only fire from the default branch, so none of this can be exercised from a PR branch — the same caveat already documented at the top of nightly-slack.yml. The first real exercise is the first nightly after merge. What I did verify locally: both files parse as YAML, and the rename/notes-table logic was dry-run against a simulated artifact set including a missing variant.

Everything is additive — a new job at the end of mac.yml plus one hunk in nightly-slack.yml — so it should not conflict with the other CI work in flight (#2575, #2576, #2644).

Not signed

The packages remain unsigned and un-notarized, so Gatekeeper will refuse them on download. The release body ships the xattr -dr com.apple.quarantine workaround as a stopgap and points at #1663, which now carries the full signing process, ordering constraints, and a TODO list. Publishing these behind a public link raises the priority of that issue but doesn't depend on it.

🤖 Generated with Claude Code

[dcwhite]

Closing: this duplicates work already on master. publish-release.yml (#2398, #2588) has published mac and Windows installers to a rolling nightly release since 2026-08-08, and handles the v* draft-release case this branch does not.

I built this from a stale worktree whose branch predated that merge, and git diff master...HEAD hid it — a three-dot diff only shows what a branch adds over the merge base.

The two parts that are genuinely missing from master — a Slack link to the nightly release, and a note in the release body that the packages are unsigned — are split out into a much smaller PR against the existing publisher.