From 86d9d5d2e4176c9462f83927c2a2fd49701de7d2 Mon Sep 17 00:00:00 2001 From: ShadowfetchStudio <209457103+ShadowfetchStudio@users.noreply.github.com> Date: Sat, 17 Oct 2026 16:06:04 -0400 Subject: [PATCH 1/2] Release: start the macOS and Flatpak builds after publishing The 2.2.0 release was published by release.yml's GITHUB_TOKEN, and GitHub does not let such an event start other workflows, so release-macos.yml and release-flatpak.yml never ran on `release: published` (they were started by hand). The publish job now dispatches both for the tag it published (actions: write; no secrets), and the workflow test checks it. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release-flatpak.yml | 3 +++ .github/workflows/release-macos.yml | 3 +++ .github/workflows/release.yml | 12 +++++++++++- scripts/test-native-release-signing.mjs | 4 ++++ 4 files changed, 21 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-flatpak.yml b/.github/workflows/release-flatpak.yml index 832c8a5d..22ef5dfb 100644 --- a/.github/workflows/release-flatpak.yml +++ b/.github/workflows/release-flatpak.yml @@ -5,6 +5,9 @@ name: Flatpak release # attached to the published GitHub release with # ShadowCode__flatpak.sha256. Pull requests already build the # Flatpak in ci.yml; this runs only for releases. +# release.yml dispatches this after it publishes (its GITHUB_TOKEN-made +# release does not trigger `release: published`); a release published by +# hand still does. on: release: types: [published] diff --git a/.github/workflows/release-macos.yml b/.github/workflows/release-macos.yml index 2403e554..ccad755d 100644 --- a/.github/workflows/release-macos.yml +++ b/.github/workflows/release-macos.yml @@ -5,6 +5,9 @@ name: macOS release # The images are ad-hoc signed, not notarized: GitHub is the distribution # channel. On pull requests that touch macOS packaging this only builds and # smoke-tests the app (nothing is uploaded). +# release.yml dispatches this after it publishes (its GITHUB_TOKEN-made +# release does not trigger `release: published`); a release published by +# hand still does. on: release: types: [published] diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 02918d0c..a17969cf 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -254,7 +254,8 @@ jobs: timeout-minutes: 30 permissions: contents: write - actions: read + # actions: write starts the macOS and Flatpak workflows after publishing. + actions: write steps: - name: Checkout independently approved publication tooling and public trust uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 @@ -280,6 +281,15 @@ jobs: env: GH_TOKEN: ${{ github.token }} run: node scripts/publish-native-release.mjs "$RUNNER_TEMP/signed-download/x86_64" release/trust "$RUNNER_TEMP/signed-download/aarch64" + # A release this job publishes with GITHUB_TOKEN does not trigger other + # workflows' `release: published`; a dispatch does. They build from the + # tag and attach the macOS images and Flatpak bundles. + - name: Start the macOS and Flatpak builds for this release + env: + GH_TOKEN: ${{ github.token }} + run: | + gh workflow run release-macos.yml --repo "$GITHUB_REPOSITORY" --ref "$GITHUB_REF_NAME" -f tag="$GITHUB_REF_NAME" + gh workflow run release-flatpak.yml --repo "$GITHUB_REPOSITORY" --ref "$GITHUB_REF_NAME" -f tag="$GITHUB_REF_NAME" # Signed APT repository on GitHub Pages (gh-pages branch, path apt/). Only # the .deb that passed publisher authentication is indexed; the repository # signing key is a separate OpenPGP key held in the protected environment. diff --git a/scripts/test-native-release-signing.mjs b/scripts/test-native-release-signing.mjs index 0bf7eeb8..179a9071 100644 --- a/scripts/test-native-release-signing.mjs +++ b/scripts/test-native-release-signing.mjs @@ -140,6 +140,10 @@ test('release workflow separates untrusted build from protected signing and writ assert.match(publication, /artifact-ids: \$\{\{ needs.sign.outputs.artifact-id \}\}/); assert.match(publication, /needs: \[configuration, build, sign\]/); assert.match(publication, /contents: write/); assert(!/SIGNING_KEY|secrets\./.test(publication)); + // After publishing, the macOS images and Flatpak bundles are built from the tag. + assert.match(publication, /actions: write/); + assert.match(publication, /gh workflow run release-macos\.yml [^\n]*-f tag="\$GITHUB_REF_NAME"/); + assert.match(publication, /gh workflow run release-flatpak\.yml [^\n]*-f tag="\$GITHUB_REF_NAME"/); assert.equal([...workflow.matchAll(/secrets\.NATIVE_RELEASE_SIGNING_KEY_PEM/g)].length, 1); assert.match(apt, /needs: \[configuration, sign, publish\]/); assert.match(apt, /environment: \$\{\{ needs.configuration.outputs.environment \}\}/); assert.match(apt, /artifact-ids: \$\{\{ needs.sign.outputs.artifact-id \}\}/); From e93590ce111d2804b41e82815905b6e59f7dfbd9 Mon Sep 17 00:00:00 2001 From: ShadowfetchStudio <209457103+ShadowfetchStudio@users.noreply.github.com> Date: Sat, 17 Oct 2026 17:07:42 -0400 Subject: [PATCH 2/2] Docs: 2.2.0 is the published release (run 39059462934) Published October 17, 2026 from 444e75f: all 15 gates on both targets, signing, publication and the APT repository. The macOS images and the Flatpak bundles were attached by their workflows, started by hand for this release; the release notes for the process are updated. Co-Authored-By: Claude Opus 5.5 --- docs/FLAGSHIP_IMPLEMENTATION.md | 2 +- docs/MACOS_PORT_ESTIMATE.md | 2 +- docs/RELEASE_AUTHENTICATION.md | 6 +++++- docs/RELEASING.md | 2 +- 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/docs/FLAGSHIP_IMPLEMENTATION.md b/docs/FLAGSHIP_IMPLEMENTATION.md index 2a37cc52..3448b87b 100644 --- a/docs/FLAGSHIP_IMPLEMENTATION.md +++ b/docs/FLAGSHIP_IMPLEMENTATION.md @@ -4,7 +4,7 @@ Goal: a dependable, easy-to-use native workspace combining supported vendor logi Baseline: `e371baaa4c690527173a322f7e0e1cfae4db329a`. Implementation branch: `flagship/reliability-foundation`. Preserve the existing architecture and provider integrations. The complete [acceptance specification](FLAGSHIP_ACCEPTANCE_SPEC.md) remains in scope; this ledger is not a narrowed definition of completion. -Current release checkpoint (October 11, 2026): **2.1.0 is published and installed** ([run 38169859337](https://github.com/ShadowfetchStudio/ShadowCode/actions/runs/38169859337), attempt 3: all 15 gates on x86_64 and aarch64, signing, publication and the signed APT repository passed from `a32c2af`; installed here with the authenticated installer, first-window check passed). Earlier pending statements below describe their historical checkpoints. Broader physical desktop, GPU endurance and live provider lifecycle acceptance remain open. +Current release checkpoint (October 17, 2026): **2.2.0 is published and installed** ([run 39059462934](https://github.com/ShadowfetchStudio/ShadowCode/actions/runs/39059462934), attempt 1: all 15 gates on x86_64 and aarch64, signing, publication and the signed APT repository passed from `444e75f`; macOS `.dmg` for Apple silicon and Intel and the Flatpak bundles attached by their release workflows; installed here with the authenticated installer, first-window check passed). Earlier pending statements below describe their historical checkpoints. Broader physical desktop, GPU endurance and live provider lifecycle acceptance remain open. ## 1.0.1 window fix diff --git a/docs/MACOS_PORT_ESTIMATE.md b/docs/MACOS_PORT_ESTIMATE.md index 9c65ae70..26c1a1e7 100644 --- a/docs/MACOS_PORT_ESTIMATE.md +++ b/docs/MACOS_PORT_ESTIMATE.md @@ -1,6 +1,6 @@ # macOS port: build estimate -Status: ShadowCode builds, installs and runs as a macOS app and is released on GitHub (see Progress). The estimate below is the original one. Figures are judgement from a source survey +Status: released. ShadowCode 2.2.0 (October 17, 2026) is the first release with macOS disk images for Apple silicon and Intel (see Progress). The estimate below is the original one. Figures are judgement from a source survey (~135k lines of Rust in `native/core` and `src-tauri`), not measurements. ## Summary diff --git a/docs/RELEASE_AUTHENTICATION.md b/docs/RELEASE_AUTHENTICATION.md index 3176b184..f541eaa9 100644 --- a/docs/RELEASE_AUTHENTICATION.md +++ b/docs/RELEASE_AUTHENTICATION.md @@ -4,7 +4,11 @@ The helpers in `scripts/native-release-auth.mjs` and `scripts/verify-native-rele The Bash verifier loads `scripts/native-release-auth-lib.sh` from its own script directory. Keep both reviewed code files together in the trusted tooling bundle; do not obtain the library from the candidate download or source metadata as shell code. The installer uses the same reviewed routines for current candidates and signed historical receipts; it never sources release metadata as code. -## Published release: 2.1.0 +## Published release: 2.2.0 + +[Version 2.2.0](https://github.com/ShadowfetchStudio/ShadowCode/releases/tag/v2.2.0) was published on October 17, 2026 from `444e75f13c3512d57c226b39d6edf59fdb08a4c6` by [run 39059462934](https://github.com/ShadowfetchStudio/ShadowCode/actions/runs/39059462934) (attempt 1), for x86_64 and aarch64. Before approving the signing review, all 15 receipts of each target were checked: passed for that commit, run and attempt, no required skips, exit status 0, script digests matching the tagged gate definitions for that architecture, and artifact hashes matching the handoff files. The published packages are byte-identical to the verified handoff; the authenticated installer installed it over 2.1.0 on the release machine and its first-window check passed. The APT repository lists 2.2.0 for amd64 and arm64 and verifies with `gpgv` against the key recorded in `release/trust/APT-SIGNING-KEY`. The macOS disk images and Flatpak bundles were then built from the tag by `release-macos.yml` and `release-flatpak.yml` and attached with their SHA-256 files; they are not covered by the publisher signature. Those two workflows had to be started by hand for 2.2.0 (a release published with `GITHUB_TOKEN` does not trigger them); from the next release the publish job dispatches them. + +## Earlier published release: 2.1.0 [Version 2.1.0](https://github.com/ShadowfetchStudio/ShadowCode/releases/tag/v2.1.0) was published on October 11, 2026 from `a32c2af917b30d7104c4d12aa6a343e73dabb4f6` by [run 38169859337](https://github.com/ShadowfetchStudio/ShadowCode/actions/runs/38169859337) (attempt 3), for x86_64 and, for the first time, aarch64. Before approving the signing review, all 15 receipts of each target were checked: passed for that commit, run and attempt, no required skips, and script digests matching the tagged gate definitions for that architecture. All four packages verify with `verify-native-release.sh` against the tracked trust bundle; the authenticated installer installed it over the existing copy on the release machine, and its new first-window check passed. The APT repository at `https://shadowfetchstudio.github.io/ShadowCode/apt` is signed by the key recorded in `release/trust/APT-SIGNING-KEY` and verifies with `gpgv`. diff --git a/docs/RELEASING.md b/docs/RELEASING.md index e6e3b1ab..e38683ab 100644 --- a/docs/RELEASING.md +++ b/docs/RELEASING.md @@ -1,6 +1,6 @@ # Release procedure -The most recent documented release is [**2.1.0**](https://github.com/ShadowfetchStudio/ShadowCode/releases/tag/v2.1.0), published on October 11, 2026 from `a32c2af` by [run 38169859337](https://github.com/ShadowfetchStudio/ShadowCode/actions/runs/38169859337) (attempt 3) with all 15 gates on both x86_64 and aarch64, protected signing, publication and the signed APT repository passing. Attempt 1 stopped when one aarch64 unit test (a stale-socket check in `native/core/src/control.rs`) failed once on the hosted ARM runner; it passes in CI. Re-running only the failed job would have mixed attempts, which signing refuses, so the whole run was re-run and the `v2.1.0` tag was not moved. Updating version files or +The most recent documented release is [**2.2.0**](https://github.com/ShadowfetchStudio/ShadowCode/releases/tag/v2.2.0), published on October 17, 2026 from `444e75f` by [run 39059462934](https://github.com/ShadowfetchStudio/ShadowCode/actions/runs/39059462934) (attempt 1) with all 15 gates on both x86_64 and aarch64, protected signing, publication and the signed APT repository passing. The macOS disk images (Apple silicon and Intel) and the Flatpak bundles were attached afterwards by `release-macos.yml` and `release-flatpak.yml`, dispatched by hand because a release published with `GITHUB_TOKEN` does not trigger other workflows; `release.yml` now dispatches them itself. Before it, [**2.1.0**](https://github.com/ShadowfetchStudio/ShadowCode/releases/tag/v2.1.0), published on October 11, 2026 from `a32c2af` by [run 38169859337](https://github.com/ShadowfetchStudio/ShadowCode/actions/runs/38169859337) (attempt 3). Updating version files or these instructions does not publish or sign a release. Bind final build, test and authentication receipts to the exact candidate before publication.