Task/m1 packaging 4 release - #66
Merged
Merged
Conversation
…s at that commit .github/workflows/release.yml runs on v* tags: the tag must name the workspace version; ubuntu-24.04 and a pinned macos-15 each run verify, package, the install-surface smoke and the disposable-account smoke on the tagged commit; the release job merges the two checksum manifests, re-checks every line, and creates the draft a human publishes. MACOS_MINIMUM becomes 15.0, the pinned image's major (Q16). verify-release's multi-platform line points at the workflow; README carries the install command, the support claim and uninstall; scheduled.yml's weekly macOS run is named regression evidence only. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Upz8uJ32B4RyE1AkthMQJX
…rget, not the runner The release runner is pinned to macos-15 because macos-14 is marked deprecated, and Q16 as written would have made the support claim 15.0. The founder ruled that the runner's major does not bound what the build supports: MACOS_MINIMUM is 14.0, the deployment target the binaries compile against, verified on the pinned image. Recorded in the grill's Amendments with the Q16 row marked; README says macOS 14 or later. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Upz8uJ32B4RyE1AkthMQJX
…rral Q7 froze com.poordeveloper.corral; the founder changed it while the bundle is still unreleased. The plist template and the key the package smoke asserts follow. The Q7 transcript is left as it was and the Amendments section is the authority, which also carries the consequence for the notification probe: "the real bundle identity" it must use is this one. Now is the free moment — TCC keys authorization on the identifier, so a change after the probe would discard every grant it established. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Upz8uJ32B4RyE1AkthMQJX
…API key The key is a JSON file carrying issuer_id, key_id and private_key, read with plutil so no new dependency enters the release path, and defaulted to the maintainer's ~/.p12/api-key.json so a signed build notarizes without being told. notarytool wants the private key as a file, so the field is rebuilt into one inside a 0700 directory that goes away with the script and never lands in dist/. Only read beside a Developer ID identity: an ad-hoc bundle cannot be notarized, so an ad-hoc run — which is what verify-release does — ignores the key entirely. Stapling is validated rather than assumed, because a ticket that is issued but not attached leaves a machine offline from Apple seeing an unnotarized app. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Upz8uJ32B4RyE1AkthMQJX
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Class:
Reason:
Escalation triggers:
Goal
Non-goals
Evidence
Compatibility
Risk / staging
Does this change touch: