chore: add release CI, OpenSpec validation, and signing - #7
Merged
Conversation
Add openspec/specs/lineage/spec.md with the formal requirements and scenarios, and expand the README with features, install, test, build, and release-with-self-update sections mirroring InstantNotes.
Add the Tauri updater and process plugins, wired to the public release endpoint and verified against the bundled minisign public key. The dashboard window checks on launch and every 6 hours; Settings shows the current version and lets the user install an update and relaunch. Checks fail silently when offline or no release exists.
Add .github/workflows/release.yml (a tag-triggered signed build that publishes a draft release with the updater manifest), validate.yml (the org OpenSpec check), CODEOWNERS, and scripts/make-update-manifest.sh for local releases. The minisign signing secrets are configured on the repo.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The updater can verify and install releases, but nothing produced signed releases or enforced the org PR format. Without CI there is no repeatable way to ship, and the in-app updater has nothing to poll. This is the release machine.
What Changes
.github/workflows/release.yml: on av*tag it builds on macOS arm64, signs with the minisign key, and publishes a draft release includinglatest.jsonfor the updater..github/workflows/validate.yml: enforces the OpenSpec issue/PR format via the org reusable workflow..github/CODEOWNERSso PRs auto-request the developers team.scripts/make-update-manifest.shfor buildinglatest.jsonfrom a local signed build.TAURI_SIGNING_PRIVATE_KEYandTAURI_SIGNING_PRIVATE_KEY_PASSWORD(set out of band; private key held outside the repo).ADDED Requirements
Requirement: Signed Release Pipeline
Pushing a
v*tag SHALL build, sign, and publish a draft GitHub release for Apple Silicon that includes the updater manifest, and the signing key MUST come from repo secrets and MUST NOT live in the repository.Scenario: Tag produces a signed draft release
vX.Y.Ztaglatest.jsonVerification
1.1
.github/workflows/release.ymltriggers onv*tags and usestauri-apps/tauri-actionwith the signing env.1.2
.github/workflows/validate.ymlcalls the org OpenSpec validator on issue and PR open/edit.2.1
gh secret listshowsTAURI_SIGNING_PRIVATE_KEYandTAURI_SIGNING_PRIVATE_KEY_PASSWORD.3.1
scripts/make-update-manifest.shis executable and referencesLineage.app.tar.gzand theJam-Sw/lineageendpoint.4.1 Pushing a tag yields a draft release with the dmg, the
.app.tar.gz, its.sig, andlatest.json.