Build pkg again (#457)

* Build .pkg again

Last time it broke in #441. The theory is that notarization of the `.pkg` before after notarizaation of the binary was breaking validation on Apple side.

This attempt does build the .pkg before we do all the dance with gon ang goreleaser.

* codesign deep

* Move back to before hooks

.ci/create-pkg.sh

@@ -6,6 +6,10 @@ export VERSION="${CIRRUS_TAG:-0}"
 
 mkdir -p .ci/pkg/
 cp .build/arm64-apple-macosx/release/tart .ci/pkg/tart
+codesign --sign "Developer ID Application: Cirrus Labs, Inc. (9M2P8L4D89)" \
+  --options=runtime --deep \
+  --entitlements Resources/tart-prod.entitlements --force \
+  .ci/pkg/tart
 cp Resources/embedded.provisionprofile .ci/pkg/embedded.provisionprofile
 pkgbuild --root .ci/pkg/ --identifier com.github.cirruslabs.tart --version $VERSION \
   --scripts .ci/pkg/scripts \

.goreleaser.yml

@@ -4,6 +4,7 @@ before:
   hooks:
     - .ci/set-version.sh
     - swift build -c release --product tart
+    - ./.ci/create-pkg.sh
 
 builds:
   - builder: prebuilt
@@ -29,6 +30,8 @@ archives:
 
 release:
   prerelease: auto
+  extra_files:
+    - glob: ./.ci/Tart-{{ .Tag }}.pkg
 
 brews:
   - name: tart