Skip to content

Publish signed releases only after both architectures pass - #2

Merged
deverman merged 2 commits into
masterfrom
codex/atomic-signed-release
Jul 12, 2026
Merged

deverman merged 2 commits into
masterfrom
codex/atomic-signed-release

Conversation

@deverman

Copy link
Copy Markdown
Owner

Summary

  • validate before signed packaging
  • stage ARM64 and Intel artifacts privately with GitHub Actions
  • publish exactly once only after both architecture jobs succeed
  • verify all four expected ZIP/checksum assets before release creation
  • support an explicit GitHub prerelease flag
  • clean certificate and temporary keychain material even after failure

Validation

  • workflow YAML parses successfully
  • release tool fails before packaging when notarization credentials are present without CODESIGN_IDENTITY
  • existing ARM64 and x86_64 packaging checks remain covered by the merged release-hardening work

@deverman
deverman merged commit aa80d2b into master Jul 12, 2026
2 checks passed
@deverman
deverman deleted the codex/atomic-signed-release branch August 2, 2026 03:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant