Hand the release pipeline to asc notarize

.gitignore

@@ -10,6 +10,3 @@ DerivedData/
 
 # Your signing identity — copy Config/Local.xcconfig.example to create this
 Config/Local.xcconfig
-
-# Your notarization credentials — copy Config/notary.env.example to create this
-Config/notary.env

Makefile

@@ -13,9 +13,11 @@ install:
 	./scripts/install.sh
 
 # A signed, notarized, stapled DMG. Runs on this machine, never in CI, so the
-# Developer ID certificate stays here.
+# Developer ID certificate stays here. The pipeline itself lives in the
+# account-level tool (github.com/max1874/apple-developer, `asc`); this repo
+# only builds the .app, `asc notarize` takes over from build/TypeSwitch.app.
 release:
-	./scripts/release.sh
+	asc notarize type-switch
 
 clean:
 	rm -rf build

README.md

@@ -176,14 +176,10 @@ that order, so the situation cannot arise. A build refuses to run at all if it
 would overwrite a path something is running from.
 
 `make release` runs on a maintainer's own machine rather than in CI, so the
-Developer ID certificate never leaves it. It reads the notarization
-credentials from `Config/notary.env`, which is gitignored; create it once from
-the example and fill in the three values that come with an App Store Connect
-API key:
-
-```sh
-cp Config/notary.env.example Config/notary.env
-```
+Developer ID certificate never leaves it. This repo only builds the app; the
+signing, notarization, stapling, and DMG steps are the `asc notarize` command
+from the maintainer's account-level tooling, which also holds the App Store
+Connect credentials. Nothing about the account lives in this repo.
 
 ## Known limitations
 

README.zh-Hans.md

@@ -154,12 +154,9 @@ make clean     # 清掉 build/
 这种状态就不会出现；而构建时如果发现有进程正从将被覆盖的路径运行，会直接停下来。
 
 `make release` 只在维护者自己的机器上跑，不进 CI，所以 Developer ID 证书不会离开
-本机。公证凭证从 `Config/notary.env` 读，这个文件已 gitignore；照样例复制一份，填上
-App Store Connect API key 自带的那三个值：
-
-```sh
-cp Config/notary.env.example Config/notary.env
-```
+本机。这个仓库只负责构建 app；签名、公证、装订、打 DMG 这几步是维护者账号级工具里的
+`asc notarize` 命令，App Store Connect 的凭据也在那边。这个仓库里没有任何账号相关的
+东西。
 
 ## 已知限制
 

scripts/build-app.sh

@@ -2,7 +2,7 @@
 # Builds TypeSwitch.app into build/ and leaves it there.
 #
 # Signing follows Config/TypeSwitch.xcconfig, so this produces the same
-# development build Xcode does. For a distributable build, use release.sh.
+# development build Xcode does. For a distributable build, use `make release`.
 set -eu
 
 project_dir=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)