Repository navigation
ci: add release workflow for tagged builds - #12
Open
fairbearlab wants to merge 2 commits into
Open
fairbearlab wants to merge 2 commits into
fairbearlab wants to merge 2 commits into
Conversation
Triggered on v* tags (validated as 3-part semver; Go tooling here rejects 4-part versions). Builds the universal Go engine binary and Swift release app via `make bundle`, zips the .app, generates SHA256 checksums, and publishes them to a GitHub Release with generated notes. Mirrors ci.yml's SHA-pinned actions and least-privilege permissions (contents: write scoped to the release job only). The app is unsigned/un-notarized for now (no signing setup exists in this repo); code signing and notarization are tracked as a follow-up. Closes the "Add GitHub Actions release workflow" TODO. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… publish
- Tag must match VERSION and Info.plist CFBundleShortVersionString; a
mismatch previously only warned and would ship an app reporting the
old version.
- Ad-hoc sign and verify the .app: the unsigned bundle fails
`codesign -v` ("code has no resources but signature indicates they
must be present"), which Gatekeeper reports as "damaged" on download.
- Publish via `gh release upload --clobber` when the release already
exists so re-runs after a partial upload don't fail.
- Pass step outputs through env instead of inline expressions.
- Add a TODO for Developer ID signing + notarization (the PR said it was
tracked but no entry existed); update CHANGELOG/TODOS notes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/release.yml: on av*tag push, validates the tag is a strict 3-part semver (vX.Y.Z) and fails fast with a clear error if it has a 4th segment or any suffix — this repo's Go tooling rejects 4-part versionsmake bundle(same stepsmake bundleruns locally), zips the resulting.app, generates aSHA256SUMS.txt, and publishes both to a GitHub Release with--generate-notesactions/checkoutandactions/setup-go(same pins asci.yml), workflow-levelpermissions: contents: readwithcontents: writescoped only to the release job (noharden-runnersince no other workflow here uses it)TODOS.mdand adds aCHANGELOG.mdentry under UnreleasedFollow-ups (out of scope here)
Test plan
actionlint(viago run github.com/rhysd/actionlint/cmd/actionlint@latest) passes clean on the new workflowmake bundlesucceeds (universal Go binary + Swift release build + bundle assembly)zip -r -X -qproduces a clean archive (no__MACOSX/AppleDouble cruft, unlikeditto) andshasum -a 256checksum generation worksv*tag → Release created) — not run, since this PR intentionally does not push any tags.github/workflows/codeql.yml(open PR fix(ci): keep codeql-action init and analyze on the same version #11 already modifies it)Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com