chore(release): truthful release path — CI-only + byte5 signing - #145
Merged
Conversation
aiui releases run exclusively in GitHub Actions (release-macos.yml, workflow_dispatch) on a macOS runner — Developer-ID signing + notarization via App Store Connect API key, exactly like every other devhost project (zaplex, nexgenvideo). There is no local release path. The old script's "documented emergency fallback" framing + local-keychain prerequisites repeatedly derailed session agents into "build it on your MacBook" — signing material lives in Actions secrets, not a local keychain, and the maintainer's Mac is not a build host. Replace the body with a stub that refuses and points at the workflow so the fiction can't be read as a real path again.
Add a Releases section so a context-empty session hits the truth at the point of action: macOS releases run in GitHub Actions via release-macos.yml (workflow_dispatch), never locally, never on the maintainer's Mac — identical to zaplex/nexgenvideo. Signing material is in Actions secrets; scripts/release.sh is a refusing stub, not a path.
aiui is a byte5ai repo, so it signs with the byte5 Apple Developer account (org rule: byte5ai -> byte5, iret77/high5-ventures -> high5). The signing identity itself comes from the byte5ai MACOS_CERTIFICATE secret; this only corrects the release-notes provenance string, which still claimed "high5 ventures GmbH" — carried over from the pre-standard era when aiui was signed with the high5 cert (v0.4.x–v0.8.2).
iret77
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
release-macos.yml(PR #144) is already a correct, complete, standard-conforming CI release — Developer-ID signing + notarization on amacos-14runner, the same host-adminmacos-sign.ymlpattern that zaplex/nexgenvideo run daily. The pipeline is not the problem.The problem is the false statements sitting next to it, carried over from the pre-standard era and repeatedly derailing session agents:
scripts/release.shstayed a runnable "documented emergency fallback" with local-keychain prerequisites → agents read it and pushed "build it on your MacBook". Signing material lives in Actions secrets, not a local keychain, and the maintainer's Mac is not a build host.What
scripts/release.sh→ refusing stub. Prints the correctgh workflow run release-macos.ymlinvocation (incl. validate-first) and exits 1. No local build path remains to be mistaken for a real one.AGENTS.md→ new Releases section stating the truth at the point of action: macOS release =release-macos.yml(workflow_dispatch), in GitHub Actions, never local, never on the maintainer's Mac; signing material is in Actions secrets;release.shis a stub, not a path.release-macos.yml→ release-notes provenancehigh5 ventures GmbH→byte5 GmbH. Workflow logic untouched; the signing identity itself comes from the byte5aiMACOS_CERTIFICATEsecret (byte5 Developer ID).Release runway
Cargo.toml,tauri.conf.json, andpyproject.tomlare already at 0.8.3. After this merges, cutting v0.8.3 is one dispatch — no local step:Prerequisite: the byte5ai
MACOS_*/TAURI_SIGNING_PRIVATE_KEY*/UV_PUBLISH_TOKENsecrets must be visible to this repo (org- or repo-level). zaplex proves the byte5 material exists; confirm withgh secret list.