cynarAI/evOo-local
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity
evOo-local/docs/desktop-release.md
cynarAI 6c7eed7580 Initial clean evOo-local from f00577b 
Fresh history cut from cynarAI/evoo antigravity-handoff/project-timeline
(Voice First + project timeline). Brand docs/titles as evOo; keep @rakazo/*
packages as tech debt. Excludes node_modules, caches, secrets, voice blobs.
2026-09-20 17:15:16 +02:00

2.0 KiB
Raw Blame History

Desktop releases

The release-desktop workflow builds, signs, notarizes, attests, and publishes the Electron app from a vMAJOR.MINOR.PATCH tag on main. Publishing the Docker images triggers from the same tag.

Repository secrets

macOS (required):

Secret Value
DESKTOP_MAC_CSC_LINK Base64 of the Developer ID Application certificate exported as .p12
DESKTOP_MAC_CSC_KEY_PASSWORD Password used when exporting the .p12
APPLE_API_KEY_ID App Store Connect API key ID (the XXXXXXXXXX in AuthKey_XXXXXXXXXX.p8)
APPLE_API_ISSUER Issuer ID shown on App Store Connect > Users and Access > Integrations
APPLE_API_KEY_P8 Contents of the AuthKey_*.p8 file

The API key needs the Developer role. The workflow writes it to a mode 600 file in the runner's temp directory for the packaging step and deletes it afterwards.

patches/app-builder-lib@26.15.3.patch carries electron-builder PR #10101: without it CSC_LINK signing fails while creating the temporary keychain. Drop the patch once an electron-builder release includes that fix.

Windows (optional):

Secret Value
DESKTOP_WIN_CSC_LINK Base64 of the Authenticode certificate as .p12/.pfx
DESKTOP_WIN_CSC_KEY_PASSWORD Its password

When DESKTOP_WIN_CSC_LINK is unset the Windows build and its release assets are skipped. macOS and Linux always build, and the release is only published when every platform that was built produced its installer and update feed.

Set a secret from a file without echoing it:

base64 -i devid.p12 | gh secret set DESKTOP_MAC_CSC_LINK
gh secret set APPLE_API_KEY_P8 < AuthKey_XXXXXXXXXX.p8

Cut a release

  1. Bump version in apps/desktop/package.json on main.
  2. Tag that commit v<version> and push the tag:
git tag v0.1.1
git push origin v0.1.1

The workflow refuses tags that do not match the desktop version, are not on main, or are not newer than the latest published release.