fix: use absolute paths for binary and zip file in notarization process in GitHub Actions workflow

Author: sophatvathana

.github/workflows/release.yml

@@ -105,7 +105,7 @@ jobs:
         if: runner.os == 'macOS'
         shell: bash
         run: |
-          BINARY="target/${{ matrix.target }}/release/rohas"
+          BINARY="$GITHUB_WORKSPACE/target/${{ matrix.target }}/release/rohas"
           if [ -f "$BINARY" ]; then
             APPLE_ID="${{ secrets.APPLE_ID }}"
             APPLE_TEAM_ID="${{ secrets.APPLE_TEAM_ID }}"
@@ -115,10 +115,10 @@ jobs:
               echo "Warning: Notarization credentials not set, skipping notarization"
             else
               # Create a zip file for notarization (required format)
-              NOTARIZE_ZIP="target/${{ matrix.target }}/release/rohas-notarize.zip"
-              cd "target/${{ matrix.target }}/release"
-              zip "rohas-notarize.zip" rohas
-              cd - > /dev/null
+              # Use absolute path to avoid any path resolution issues
+              NOTARIZE_ZIP="$GITHUB_WORKSPACE/target/${{ matrix.target }}/release/rohas-notarize.zip"
+              cd "$GITHUB_WORKSPACE/target/${{ matrix.target }}/release"
+              zip -j "rohas-notarize.zip" rohas
               
               # Submit for notarization
               xcrun notarytool submit "$NOTARIZE_ZIP" \
@@ -127,13 +127,12 @@ jobs:
                 --password "$APPLE_APP_PASSWORD" \
                 --wait
               
-              # Extract the binary from the notarized zip (it will still be signed)
-              cd "target/${{ matrix.target }}/release"
-              unzip -o "rohas-notarize.zip" rohas
-              cd - > /dev/null
+              # Staple the notarization ticket to the binary
+              xcrun stapler staple "$BINARY"
               
-              # Verify the binary is still signed
+              # Verify the binary is signed and stapled
               codesign --verify --verbose "$BINARY"
+              xcrun stapler validate "$BINARY"
               
               # Clean up the temporary zip file
               rm -f "$NOTARIZE_ZIP"