From 7cc6de70193f2a2c35896605930aab697c3e47b4 Mon Sep 17 00:00:00 2001 From: Jamie Ruderman Date: Tue, 15 Sep 2026 15:33:31 -0700 Subject: [PATCH] fix(ci): refuse a signed build that is not on a tag --- .github/workflows/build-electron.yml | 10 ++++++++++ RELEASE.md | 8 ++++++-- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-electron.yml b/.github/workflows/build-electron.yml index b556572f2..4bcdc0578 100644 --- a/.github/workflows/build-electron.yml +++ b/.github/workflows/build-electron.yml @@ -39,6 +39,16 @@ jobs: version: ${{ steps.version.outputs.VERSION }} release_repo: ${{ steps.repo.outputs.RELEASE_REPO }} steps: + # Only a tag build publishes; a signed branch build paid for 24 eSigner signatures and discarded them (2026-09-15). + - name: Refuse to sign a build that cannot publish + if: github.ref_type != 'tag' && !inputs.skip_signing + env: + REF_TYPE: ${{ github.ref_type }} + REF_NAME: ${{ github.ref_name }} + run: | + echo "::error::skip_signing is off but this run is on $REF_TYPE '$REF_NAME'. Only a tag build publishes, so the signatures would be paid for and thrown away. Re-run from the version tag, or leave skip_signing checked." + exit 1 + - name: Check out Git repository uses: actions/checkout@v4 diff --git a/RELEASE.md b/RELEASE.md index 08e45ae59..7c9953db8 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -58,8 +58,12 @@ Then push the commit and the tag `npm version` created. ## 2. Desktop: build -Run **Build / Electron** (`workflow_dispatch`) — `brand` defaults to `remoteit`, -and **uncheck `skip_signing`** for a real release, since it defaults to `true`. +Run **Build / Electron** (`workflow_dispatch`) **from the version tag** — in +"Use workflow from", switch to Tags and pick `vN.N.N`, not `main`. `brand` +defaults to `remoteit`; **uncheck `skip_signing`** for a real release, since it +defaults to `true`. Only a tag build creates the draft and publishes into it; a +branch build compiles and discards everything, so with `skip_signing` off the +`prepare` job refuses to start rather than pay for signatures nobody receives. A `prepare` job first resolves the release repository for the selected brand (`brands//config.ts` — `cachengo` publishes to `cachengo/desktop`) and