6c7eed7580
Fresh history cut from cynarAI/evoo antigravity-handoff/project-timeline (Voice First + project timeline). Brand docs/titles as evOo; keep @rakazo/* packages as tech debt. Excludes node_modules, caches, secrets, voice blobs.
56 lines
2.0 KiB
Markdown
56 lines
2.0 KiB
Markdown
# Desktop releases
|
|
|
|
The `release-desktop` workflow builds, signs, notarizes, attests, and publishes
|
|
the Electron app from a `vMAJOR.MINOR.PATCH` tag on `main`. Publishing the
|
|
Docker images triggers from the same tag.
|
|
|
|
## Repository secrets
|
|
|
|
macOS (required):
|
|
|
|
| Secret | Value |
|
|
| --- | --- |
|
|
| `DESKTOP_MAC_CSC_LINK` | Base64 of the `Developer ID Application` certificate exported as `.p12` |
|
|
| `DESKTOP_MAC_CSC_KEY_PASSWORD` | Password used when exporting the `.p12` |
|
|
| `APPLE_API_KEY_ID` | App Store Connect API key ID (the `XXXXXXXXXX` in `AuthKey_XXXXXXXXXX.p8`) |
|
|
| `APPLE_API_ISSUER` | Issuer ID shown on App Store Connect > Users and Access > Integrations |
|
|
| `APPLE_API_KEY_P8` | Contents of the `AuthKey_*.p8` file |
|
|
|
|
The API key needs the Developer role. The workflow writes it to a mode 600 file
|
|
in the runner's temp directory for the packaging step and deletes it afterwards.
|
|
|
|
`patches/app-builder-lib@26.15.3.patch` carries electron-builder PR #10101:
|
|
without it `CSC_LINK` signing fails while creating the temporary keychain. Drop
|
|
the patch once an electron-builder release includes that fix.
|
|
|
|
Windows (optional):
|
|
|
|
| Secret | Value |
|
|
| --- | --- |
|
|
| `DESKTOP_WIN_CSC_LINK` | Base64 of the Authenticode certificate as `.p12`/`.pfx` |
|
|
| `DESKTOP_WIN_CSC_KEY_PASSWORD` | Its password |
|
|
|
|
When `DESKTOP_WIN_CSC_LINK` is unset the Windows build and its release assets
|
|
are skipped. macOS and Linux always build, and the release is only published
|
|
when every platform that was built produced its installer and update feed.
|
|
|
|
Set a secret from a file without echoing it:
|
|
|
|
```sh
|
|
base64 -i devid.p12 | gh secret set DESKTOP_MAC_CSC_LINK
|
|
gh secret set APPLE_API_KEY_P8 < AuthKey_XXXXXXXXXX.p8
|
|
```
|
|
|
|
## Cut a release
|
|
|
|
1. Bump `version` in `apps/desktop/package.json` on `main`.
|
|
2. Tag that commit `v<version>` and push the tag:
|
|
|
|
```sh
|
|
git tag v0.1.1
|
|
git push origin v0.1.1
|
|
```
|
|
|
|
The workflow refuses tags that do not match the desktop version, are not on
|
|
`main`, or are not newer than the latest published release.
|