From 90d38a23baaef149c73e4b4f8d3de5ee097dc20a Mon Sep 17 00:00:00 2001 From: Doug Martin Date: Thu, 23 Jul 2026 05:38:05 -0400 Subject: [PATCH] docs: note the release-secrets 1Password bundle for maintainers [REPORT-77] Point maintainers at cc-data-release-secrets.zip in the Developer Admin 1Password vault, which can re-create the GitHub Actions secrets the signed release needs (restore, rotate, or onboard a new maintainer). Kept high-level: no contents, since this is a public repo. --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index d6b5de7..51bca4a 100644 --- a/README.md +++ b/README.md @@ -90,6 +90,8 @@ go build ./... Releases are built with goreleaser on native GitHub Actions runners per platform, with a Homebrew formula for install (`brew install concord-consortium/tap/cc-data`). Note that `brew uninstall` removes only the binary; run `cc-data uninstall` first to remove the Claude skill, the `~/.claude/CLAUDE.md` pointer, and (optionally) your stored credentials. Your datasets are never removed automatically — `cc-data uninstall` prints where they remain. +The macOS signing/notarization and Homebrew-tap credentials the release needs live in this repo's GitHub Actions secrets. Maintainers can re-create those secrets from `cc-data-release-secrets.zip` in the **Developer Admin** 1Password vault, which bundles the credentials and a script that sets them. It exists so the release secrets can be restored, rotated, or handed to a new maintainer without redoing the Apple and GitHub setup from scratch (the tap push token in particular is a fine-grained GitHub PAT that must be rotated at least yearly). + A direct browser download of a macOS binary triggers a one-time online Gatekeeper check on first run (the binaries are notarized but not stapled); a `brew install` carries no quarantine, so Gatekeeper does not assess it. The client/server seam is a versioned HTTP contract (`/api/v1/...`) against the Concord report server; this repo shares no code with it.