v1.3.0: launch hardening and Mac installer

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,46 @@
+name: Bug report
+description: Something in Isolate doesn't work as expected
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a problem. If macOS won't open Isolate, see [First launch](https://github.com/neokumar1/Isolate#first-launch); many other problems are covered in [Troubleshooting](https://github.com/neokumar1/Isolate/blob/main/TROUBLESHOOTING.md).
+  - type: input
+    id: version
+    attributes:
+      label: Isolate version
+      description: Shown in About Isolate.
+      placeholder: "1.3.0"
+    validations:
+      required: true
+  - type: input
+    id: macos
+    attributes:
+      label: macOS version and Mac model
+      placeholder: "macOS 15.6, MacBook Air M2"
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: What did you do?
+      description: The steps that lead to the problem.
+      placeholder: |
+        1. Imported a 4-minute FLAC file with ⌘O
+        2. ...
+    validations:
+      required: true
+  - type: textarea
+    id: result
+    attributes:
+      label: What happened, and what did you expect?
+      description: Include the exact message Isolate showed, if any.
+    validations:
+      required: true
+  - type: input
+    id: audio
+    attributes:
+      label: Audio file details
+      description: Format, sample rate, channels and length, if the problem involves a song. Please don't attach copyrighted or private audio.
+      placeholder: "FLAC, 48 kHz, stereo, 4:05"

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: macOS won't open Isolate
+    url: https://github.com/neokumar1/Isolate#first-launch
+    about: Releases are ad-hoc signed; approve the first launch in System Settings › Privacy & Security.
+  - name: Troubleshooting guide
+    url: https://github.com/neokumar1/Isolate/blob/main/TROUBLESHOOTING.md
+    about: Model errors, iCloud Drive files, disk space, stuck imports, library backups and exports.

.github/workflows/build.yml

@@ -5,6 +5,7 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -15,26 +16,60 @@ concurrency:
 
 jobs:
   build:
-    runs-on: macos-15
-    timeout-minutes: 30
+    name: Build & Test (${{ matrix.runner }})
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [macos-15, macos-26]
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 45
+    env:
+      # Pull requests from forks get no repository variables; they build and
+      # test without the model, and the inference tests skip.
+      ISOLATE_MODEL_ARCHIVE_URL: ${{ vars.ISOLATE_MODEL_ARCHIVE_URL }}
+      ISOLATE_MODEL_ARCHIVE_SHA256: ${{ vars.ISOLATE_MODEL_ARCHIVE_SHA256 }}
+      # macOS 15 checks safe refusal of its known-bad Core ML runtime. macOS 26
+      # must actually separate; an incompatible model there fails the build.
+      TEST_RUNNER_ISOLATE_ALLOW_INCOMPATIBLE_MODEL: ${{ matrix.runner == 'macos-15' && '1' || '0' }}
     steps:
       - uses: actions/checkout@v5
       - uses: maxim-lobanov/setup-xcode@v1
         with:
           xcode-version: latest-stable
       - run: brew install xcodegen
-      - run: xcodegen generate
-      - name: Check shell scripts and whitespace
+      - name: Generate Xcode project
         run: |
-          bash -n install.sh scripts/package_release.sh scripts/fetch_release_model.sh
+          if [[ "${{ matrix.runner }}" == macos-15 ]]; then
+            ruby scripts/ci_legacy_icon.rb
+            xcodegen generate --spec project.ci-legacy.yml
+          else
+            xcodegen generate
+          fi
+      - name: Check scripts, version metadata and whitespace
+        run: |
+          for script in install.sh scripts/*.sh; do bash -n "$script"; done
+          ruby -c Casks/isolate.rb
+          bash scripts/check_version.sh
+          git diff --exit-code -- Info.plist
           git diff --check
+      - name: Fetch and validate the pinned model
+        if: env.ISOLATE_MODEL_ARCHIVE_URL != '' && env.ISOLATE_MODEL_ARCHIVE_SHA256 != ''
+        run: |
+          bash scripts/fetch_release_model.sh
+          # Xcode forwards TEST_RUNNER_ variables to the tests, which then fail
+          # instead of skipping when the model cannot run.
+          echo "TEST_RUNNER_ISOLATE_REQUIRE_MODEL=1" >> "$GITHUB_ENV"
+      - name: Note skipped inference
+        if: env.ISOLATE_MODEL_ARCHIVE_URL == '' || env.ISOLATE_MODEL_ARCHIVE_SHA256 == ''
+        run: echo "::notice::The model variables are not available to this run, so Core ML inference tests will skip."
       - name: Build Apple Silicon release
         run: xcodebuild build -project Isolate.xcodeproj -scheme Isolate -configuration Release -destination 'platform=macOS,arch=arm64' -derivedDataPath build/DerivedData CODE_SIGNING_ALLOWED=NO
       - name: Run unit and audio regression tests
-        run: xcodebuild test -project Isolate.xcodeproj -scheme Isolate -destination 'platform=macOS,arch=arm64' -derivedDataPath build/DerivedData -only-testing:IsolateTests CODE_SIGNING_ALLOWED=NO
+        # Exercise the release configuration already built above.
+        run: xcodebuild test -project Isolate.xcodeproj -scheme Isolate -configuration Release -destination 'platform=macOS,arch=arm64' -derivedDataPath build/DerivedData -only-testing:IsolateTests CODE_SIGNING_ALLOWED=NO ENABLE_TESTABILITY=YES
       - name: Preserve test results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.1
         with:
-          name: test-results
+          name: test-results-${{ matrix.runner }}
           path: build/DerivedData/Logs/Test/*.xcresult

.github/workflows/release.yml

@@ -14,18 +14,30 @@ concurrency:
 
 jobs:
   release:
-    runs-on: macos-15
-    timeout-minutes: 45
+    # Core ML computes the model incorrectly on hosted macOS 14 and 15 (Isolate refuses to
+    # separate there), so the inference gate must run where separation is verified.
+    runs-on: macos-26
+    timeout-minutes: 60
     env:
       ISOLATE_MODEL_ARCHIVE_URL: ${{ vars.ISOLATE_MODEL_ARCHIVE_URL }}
       ISOLATE_MODEL_ARCHIVE_SHA256: ${{ vars.ISOLATE_MODEL_ARCHIVE_SHA256 }}
       TEST_RUNNER_ISOLATE_REQUIRE_MODEL: '1'
+      TEST_RUNNER_ISOLATE_ALLOW_INCOMPATIBLE_MODEL: '0'
+      RELEASE_TAG: ${{ github.ref_name }}
     steps:
       - uses: actions/checkout@v5
-      - name: Require a release tag
+      # Fail in seconds, before the model download and test run, when the tag,
+      # project.yml, Info.plist and CHANGELOG.md do not agree.
+      - name: Require a version tag that matches the app
         env:
           REF_TYPE: ${{ github.ref_type }}
-        run: test "$REF_TYPE" = tag
+        run: |
+          if [[ "$REF_TYPE" != tag ]]; then
+            echo "::error::Run this workflow from a version tag such as v1.3.0, not a branch."
+            exit 1
+          fi
+          bash scripts/check_version.sh "$RELEASE_TAG"
+          bash scripts/release_notes.sh "$RELEASE_TAG" > /dev/null
       - uses: maxim-lobanov/setup-xcode@v1
         with:
           xcode-version: latest-stable
@@ -36,31 +48,34 @@ jobs:
       - name: Require passing tests including actual model inference
         run: xcodebuild test -project Isolate.xcodeproj -scheme Isolate -destination 'platform=macOS,arch=arm64' -derivedDataPath build/DerivedData -only-testing:IsolateTests CODE_SIGNING_ALLOWED=NO
       - name: Package release with bundled model
-        env:
-          RELEASE_TAG: ${{ github.ref_name }}
         run: bash scripts/package_release.sh "$RELEASE_TAG"
+      - name: Write release notes
+        run: bash scripts/release_notes.sh "$RELEASE_TAG" > dist/RELEASE_NOTES.md
       - name: Create draft for manual review
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3.0.3
         with:
+          name: Isolate ${{ github.ref_name }}
+          body_path: dist/RELEASE_NOTES.md
           files: |
             dist/Isolate.dmg
-            dist/Isolate-${{ github.ref_name }}.dmg
             dist/Isolate-${{ github.ref_name }}-macOS.zip
             dist/SHA256SUMS.txt
           fail_on_unmatched_files: true
-          generate_release_notes: true
           draft: true
-          body: |
-            Apple Silicon · macOS 14+
-            Includes the validated Core ML separation model.
-
-            These CI artifacts are ad-hoc signed and are not notarized. Before publishing,
-            complete the platform and distribution checks in RELEASE.md. Download the DMG,
-            drag Isolate into Applications, and follow Apple's Privacy & Security guidance
-            if macOS requests explicit approval.
+      - name: Summarize maintainer checks
+        run: |
+          {
+            echo "### Draft release ${RELEASE_TAG} created"
+            echo "The artifacts are ad-hoc signed and not notarized. Before publishing, work through the publication checks in RELEASE.md,"
+            echo "then set the Homebrew cask's version and sha256 from the published Isolate.dmg."
+            echo
+            echo '```'
+            cat dist/SHA256SUMS.txt
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
       - name: Preserve test results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: release-test-results
           path: build/DerivedData/Logs/Test/*.xcresult

.gitignore

@@ -8,13 +8,14 @@ build/
 !default.mode2v3
 *.perspectivev3
 !default.perspectivev3
-xcuserdata
+xcuserdata/
 *.xccheckout
 *.moved-aside
 DerivedData
 *.hmap
 *.ipa
 *.xcuserstate
+*.xcresult
 
 # SwiftPackageManager
 .build/
@@ -28,14 +29,14 @@ Manifest.lock
 *.swp
 *~.nib
 
-# Other
-xcuserdata/
-
-# CoreML Model Binaries (>100MB)
+# CoreML Model Binaries (>100MB) and archives made from them
 *.mlmodelc
 *.mlpackage
 *.mlmodel
+/HTDemucs*
 
 # Distribution Artifacts
 dist/
+*.dmg
+*.zip
 Assets/AppIcon.iconset/