Skip to content

fix(release): use notarization broker #110

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
trsdn merged 6 commits into from
Sep 22, 2026
Merged

fix(release): use notarization broker #110

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
f3d8087
fix(release): use notarization broker
trsdn Sep 22, 2026
c7c78c1
fix(release): harden draft smoke dispatch
trsdn Sep 22, 2026
4ea06f2
fix(release): correct smoke nonce generation
trsdn Sep 22, 2026
e8dbcbd
fix(release): bind canonical checksum files
trsdn Sep 22, 2026
40f96f5
fix(release): reject malformed checksum entries
trsdn Sep 22, 2026
a574524
test(release): avoid evaluating publication source
trsdn Sep 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions .github/github-app.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,11 @@ instructions: |

The rules that are most often broken:

1. Never add a build-attestation policy to UpdateManager and never attest the
update DMG. It crashes shipped apps (see #31).
2. Never publish a release, create or move tags, or change repository settings.
1. Never add a build-attestation policy to UpdateManager and never attest
either OpenWritr DMG. They share one digest and can crash shipped apps
(see #31).
2. Never publish a release, create or move tags, dispatch the notarization
broker, run the publication handoff, or change repository settings.
3. Never log transcript text, audio, prompts, or API keys.

Validate with `swift build -c release -Xswiftc -warnings-as-errors`, `swiftlint lint --strict`, and `swift test` before proposing any change.
Expand Down
9 changes: 9 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,3 +34,12 @@ jobs:

- name: Test
run: swift test

- name: Validate release tooling
run: |
bash -n scripts/*.sh
bash scripts/test_publish_broker_release.sh
PYTHONPATH=scripts python3 -m unittest discover -s scripts -p 'test_*.py'
python3 -m py_compile \
scripts/extract_release_notes.py \
scripts/verify_broker_artifacts.py
Loading
Loading