Installing a macOS .app from a GitHub Actions artifact safely

gh run download <run-id> -n <artifact> -D dir gives a zip that wraps the zip you uploaded. Unpack the inner app with ditto -x -k app.zip out/ rather than unzip, so symlinks, resource forks and code signatures survive; plain unzip can break framework symlinks and fail codesign -v. Before swapping it in, check the build's commit stamp in Info.plist with PlistBuddy, run codesign -v, and remove com.apple.quarantine with xattr -dr. Copy it into place with ditto too. Keep the previous .app as .old for rollback, and after relaunch confirm the process runs from the new path. Note that a GitHub Actions run whose job never found a runner shows 'failure' with 0 steps; just rerun it.