feat(release): tag-driven release and install#60
Merged
Conversation
A VERSION source of truth (the .app's CFBundleShortVersionString and the CLI version follow it), scripts/release.sh (a guarded cut: semver ahead of the last tag, clean main, CI green; then bump, commit, tag, push), and .github/workflows/release.yml (on the tag: build the .app + CLI, the fence static + bundle gates and the non-SEP tests, a tag-pinned source tarball + ad-hoc .app zip + SHA256SUMS, notes from the commits, the GitHub Release, then the Homebrew formula bump as a PR). Formula/simenclave.rb builds from source and ad-hoc signs; locally built is never quarantined and the Secure Enclave works ad-hoc. scripts/install.sh is the curl|sh path. The README records the Gatekeeper reality. make release VERSION=x.y.z drives it. The interposer is never built or shipped.
Split the portable lane into commitlint (always-on, the required check) and lint (biome, path-filtered to the JS/TS/JSON tree). Gate the macos build on native, build, and script paths, and skip the fence on docs-only changes. A README edit no longer spends a macOS runner; the required commitlint check still gates every PR.
Drop the Gatekeeper and no-notarization rationale from the README install section. The two install commands and a one-line note are enough; the reasoning is not the reader's concern.
The formula bump pointed at GitHub's auto-generated archive, which SHA256SUMS does not cover, so the published checksums protected nothing the formula consumed. Point the url at the release-attached git-archive tarball and reuse its SHA256SUMS entry, so the formula and the checksums pin the same byte-stable artifact. Also: set -e in build-menubar-app.sh so a failed copy cannot yield a signed-but-partial bundle; derive a numeric CFBundleShortVersionString so a prerelease tag stays a valid plist version; allow a -prerelease suffix in the cut guard and mark prerelease releases; and guard install.sh to follow a version tag, not an arbitrary branch ref.
Set VERSION and its mirrors (the CLI constant, package.json) to the first release tag. The bundle reports 1.0.0, the CLI and package report 1.0.0-beta.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tag-driven release: cut a tag, the workflow builds, gates, and publishes. One version source (
VERSION); the helper bundle, the CLI, andpackage.jsonread or mirror it.What's here
scripts/release.sh(make release VERSION=x.y.z) cuts the release: semver (optionally-prerelease), onmain, clean tree, tag free, ahead of the last tag, CI green on HEAD. BumpsVERSIONand the mirrors, commits, tags, pushes..github/workflows/release.ymlruns on av*tag: asserts the tag equalsVERSION, builds the.appand CLI ad-hoc, gates them through the fence (static and--bundle) and the non-SEP tests, then packages a tag-pinned source tarball, an ad-hoc.appzip, andSHA256SUMS, publishes the release, and opens the Homebrew formula bump PR.Formula/simenclave.rbbuilds from source. Theurlpoints at the release-attached tarball, the oneSHA256SUMScovers, and the bump reuses that published checksum, so the formula and the checksums pin the same artifact. The interposer is never built or shipped here.scripts/install.shis thecurl | shpath: clones a validated version tag and builds locally.CI
The portable lane is split into commitlint (always-on, the required check) and lint (biome, path-filtered). The macOS build runs only on native, build, and script changes; the fence skips docs-only changes. A docs change no longer fires the macOS runner.
Hardening folded in
SHA256SUMS).build-menubar-app.shruns underset -e, so a failed copy cannot produce a signed-but-partial bundle;CFBundleShortVersionStringis numeric even for a prerelease tag.install.shonly follows avX.Y.Ztag, not an arbitrary branch ref.Custody gate: PASS (dev tool, the developer's own Mac SEP, no user keys or funds). Fence: static and bundle both pass on the built
.app.Cuts
v1.0.0-betaonce merged.