fix(ci): retry workspace version bump on macos

.github/workflows/build-and-upload.yml

@@ -61,7 +61,21 @@ jobs:
 
       - name: Set workspace versions
         if: ${{ inputs.set_versions && inputs.version != '' }}
-        run: npm version ${VERSION} --workspaces --include-workspace-root --no-git-tag-version --allow-same-version
+        shell: bash
+        env:
+          NPM_CONFIG_FETCH_RETRIES: 5
+          NPM_CONFIG_FETCH_RETRY_MINTIMEOUT: 20000
+          NPM_CONFIG_FETCH_RETRY_MAXTIMEOUT: 120000
+        run: |
+          set -euo pipefail
+          for attempt in 1 2 3; do
+            if npm version "${VERSION}" --workspaces --include-workspace-root --no-git-tag-version --allow-same-version; then
+              exit 0
+            fi
+            echo "npm version failed (attempt $attempt/3); retrying..." >&2
+            sleep $((attempt * 10))
+          done
+          exit 1
 
       - name: Install dependencies
         run: npm ci --workspaces --include=optional
@@ -84,9 +98,12 @@ jobs:
           fi
 
           release_root="packages/electron-app/release"
-          shopt -s nullglob globstar
-
-          apps=("$release_root"/**/CodeNomad.app)
+          # macOS GitHub runners ship /bin/bash 3.2 which doesn't support `shopt -s globstar`.
+          # Use find to locate built app bundles instead of ** globs.
+          apps=()
+          while IFS= read -r -d '' app; do
+            apps+=("$app")
+          done < <(find "$release_root" -type d -name 'CodeNomad.app' -print0)
           if [ "${#apps[@]}" -eq 0 ]; then
             echo "No CodeNomad.app found under $release_root" >&2
             exit 1
@@ -111,6 +128,13 @@ jobs:
           set -euo pipefail
           shopt -s nullglob
 
+          # Dev CI builds typically don't have a macOS signing identity available.
+          # When no identity is present, electron-builder skips signing and strict verification will fail.
+          if security find-identity -p codesigning -v | grep -q "0 valid identities found"; then
+            echo "No valid macOS codesigning identity found; skipping codesign verification"
+            exit 0
+          fi
+
           tmp_dir=$(mktemp -d)
           trap 'rm -rf "$tmp_dir"' EXIT