[sproctor]

Description

packageDistributionForCurrentOS fails on Linux and Windows when the build configures macOS notarization and also lists a macOS format such as TargetFormat.Dmg. A release matrix that shares one environment across its runners hits this on every non-macOS job. This change disables notarization tasks off macOS, the same way their package tasks are already disabled.

Minimal reproduction

plugin-build/plugin/src/test/.../tasks/AbstractNotarizationTaskTest.kt, in this PR:

val task = ProjectBuilder.builder().build().tasks
    .create("notarizeDmg", AbstractNotarizationTask::class.java, TargetFormat.Dmg)
assertEquals(currentOS == OS.MacOS, task.enabled)

End to end, on any non-macOS host, with this in the app's build and NOTARY_PWD set to anything non-empty:

nucleus.application {
    nativeDistributions {
        targetFormats(TargetFormat.Dmg, TargetFormat.Deb)
        macOS {
            notarization {
                appleID.set("someone@example.com")
                password.set(providers.environmentVariable("NOTARY_PWD"))
                teamID.set("ABCDE12345")
            }
        }
    }
}

./gradlew packageDistributionForCurrentOS

Setup: nucleus-3.0 at d975bba (first seen on 3.0.0-dev-202611011507), GitHub ubuntu-latest, ubuntu-24.04-arm and windows-latest runners, reproduced locally on Ubuntu.

Actual result:

* What went wrong:
A problem was found with the configuration of task ':desktopApp:notarizeDmg' (type 'AbstractNotarizationTask').
  Type 'dev.nucleusframework.desktop.application.tasks.AbstractNotarizationTask' property 'inputDir' specifies directory '.../desktopApp/build/compose/binaries/main/dmg' which doesn't exist
    An input file was expected to be present but it doesn't exist

Expected: the build packages the current OS's formats and leaves the macOS ones alone.

Root cause and fix

Notarization tasks are registered for every format compatible with macOS, whatever the host, and packageDistributionForCurrentOS depends on all of them. Off macOS the matching package task is disabled (enabled = targetFormat.isCompatibleWithCurrentOS), so it never creates inputDir. The notarization task's only gate is the onlyIf that checks credentials. With credentials set it passes, and Gradle then fails validating the missing directory.

AbstractNotarizationTask now applies the same isCompatibleWithCurrentOS gate in its init, so the JVM, store and GraalVM registrations are all covered. A disabled task is skipped before input validation. The task names stay registered, so build scripts that refer to notarizeDmg keep working.

Testing

On Ubuntu Linux, JVM pipeline:

• AbstractNotarizationTaskTest: before, fails with expected:<false> but was:<true>. After, passes.
• A real app (warlock, at the commit that failed in its release run) with NOTARY_PWD=dummy, run with --include-build against this branch: before, packageDistributionForCurrentOS fails with the error above. After, BUILD SUCCESSFUL, with packageDmg and notarizeDmg both SKIPPED.
• :plugin:test and :plugin:ktlintCheck pass.

./gradlew preMerge does not pass, and it stops before finishing. It fails on two things this PR doesn't touch: detekt in FlathubRepository.kt:216 and AbstractGenerateFlathubRepositoryTask.kt:135, and ktlint in examples/lab/app/build.gradle.kts:234.

Not tested: Windows (it takes the same code path, and the failure there was the same), a real notarization on macOS (isCompatibleWithCurrentOS is true there, so nothing changes), and the GraalVM packaging tasks.

Checklist

• Targets nucleus-3.0
• Feature: discussed first in a GitHub discussion (linked above)
• One change, no unrelated reformatting
• ./gradlew preMerge passes
• Public API has KDoc, apiDump committed if the API changed
• I understand every line of this change and can answer review questions about it, whether or not AI tools were used
• Breaking change (explain above)

🤖 Generated with Claude Code