fix(KAN-65): resume release publication with CI credentials

.github/workflows/macos-release.yml

@@ -12,6 +12,14 @@ on:
         description: "Existing protected macos-vMAJOR.MINOR.PATCH tag on main"
         required: true
         type: string
+      mode:
+        description: "Build a release or resume publishing existing verified artifacts"
+        required: true
+        default: build
+        type: choice
+        options:
+          - build
+          - resume
 
 permissions:
   contents: read
@@ -49,8 +57,10 @@ jobs:
         env:
           REQUESTED_TAG: ${{ inputs.tag }}
           MACOS_RUNNER: ${{ vars.MACOS_RUNNER }}
+          RELEASE_MODE: ${{ inputs.mode || 'build' }}
         run: |
           set -Eeuo pipefail
+          [[ "${RELEASE_MODE:-build}" == build || "${RELEASE_MODE:-build}" == resume ]] || { echo 'Invalid release mode.' >&2; exit 1; }
           if [[ "$GITHUB_EVENT_NAME" == workflow_dispatch ]]; then
             [[ "$GITHUB_REF" == refs/heads/main ]] || { echo 'Dispatch this workflow from main.' >&2; exit 1; }
             tag="$REQUESTED_TAG"
@@ -80,6 +90,7 @@ jobs:
   release:
     name: Sign, notarize, verify and publish macOS
     needs: prepare
+    if: ${{ inputs.mode != 'resume' }}
     # Gitea resolves runner labels before outputs from prepare are available.
     runs-on: ${{ vars.MACOS_RUNNER }}
     timeout-minutes: 120
@@ -224,3 +235,42 @@ jobs:
               finally:
                   shutil.rmtree(directory)
           PY
+
+  resume:
+    name: Resume verified release publication
+    needs: prepare
+    if: ${{ github.event_name == 'workflow_dispatch' && inputs.mode == 'resume' }}
+    runs-on: ${{ vars.MACOS_RUNNER }}
+    timeout-minutes: 15
+    env:
+      RELEASE_TAG: ${{ needs.prepare.outputs.tag }}
+      RELEASE_METADATA_DIRECTORY: release-source/native
+    steps:
+      - name: Check out current publishing tools
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Check out validated release metadata
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.prepare.outputs.commit }}
+          path: release-source
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22
+
+      - name: Verify existing artifacts and resume publication
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}
+          AWS_EC2_METADATA_DISABLED: "true"
+          AWS_REQUEST_CHECKSUM_CALCULATION: when_required
+          AWS_RESPONSE_CHECKSUM_VALIDATION: when_required
+        run: |
+          aws --version | grep '^aws-cli/2\.' || { echo 'Install AWS CLI v2 permanently on this runner.' >&2; exit 1; }
+          node native/publish-macos.mjs resume