chore(release): macOS + Linux packaging and release workflow#76
Merged
Conversation
Package Studio via `native package` and automate a GitHub release on tag push — the packaging foundation for the 0.5.0 launch. - .github/workflows/release.yml: on a v* tag, a matrix builds the macOS package (.app → ad-hoc-signed .dmg) and the Linux package (.tar.gz) via `native build` + `native package --archive`, gated by `native doctor` (strict on macOS); a publish job downloads both and cuts the GitHub release with generated notes. Least-privilege token (contents: write only on the publish job); the tag/repo reach `gh` through the environment, not interpolated into the script, so a crafted tag can't inject shell. - RELEASING.md: the release runbook (bump version, changelog, tag, verify) plus the macOS ad-hoc "right-click → Open" note and the local packaging command; notarization + the menu-bar monitor are called out as post-0.5. Verified locally: `native package --target macos --signing adhoc --archive` produces a launchable studio.app + .dmg (arm64, adhoc codesign), and the packaged binary runs both its GUI and `ci` faces. release.yml is valid YAML. Ad-hoc signing per the 0.5.0 scope decision; notarization is deferred. Closes #70.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First S6 issue: the packaging + release foundation for the 0.5.0 launch.
What's here
.github/workflows/release.yml— on av*tag push, a matrix builds the macOS package (.app→ ad-hoc-signed.dmg) and the Linux package (.tar.gz) vianative build+native package --archive, gated bynative doctor(strict on macOS). Apublishjob downloads both artifacts and cuts the GitHub release with generated notes.RELEASING.md— the release runbook (bump version → changelog → tag → verify), the macOS ad-hoc right-click → Open note, and the local packaging command.Decisions (from the S6 kickoff)
RELEASING.md.Security
permissions: contents: readat the top;contents: writeonly on thepublishjob (least privilege).gh release create(built-in CLI, no third-party release action). The tag and repo reach the script throughenv:, never interpolated into therun:body, so a crafted tag name can't inject shell.Verification
native package --target macos --signing adhoc --archive→ a launchablestudio.app+studio-<ver>-macos-ReleaseFast.dmg(arm64,adhoccodesign verified).ci(exit 0) faces.release.ymlis valid YAML; archive globs confirmed against the SDK's naming (*.dmg/*.tar.gzinzig-out/package/).Closes #70.