My final artifact is a dmg. I emit it as part of the app build, in my very first CI stage on Mac, and immediately upload for notarization before the build job ends. Then, in parallel to tests, I have a separate job that checks the dmg for common issues, then waits for notarization and staples it.