feat(release): release-grade packaging — generated icon, signing tiers, release assets, app CI lane (Event 179)#163
Merged
Conversation
…eady signing tiers, release-assets workflow, app CI lane (Event 179) - Icon as a reproducible artifact: app/icon/make_icns.swift draws the Gate mark (brackets + operator dot, the console's palette) with CoreGraphics and emits the full iconset + icns — no design blob without a source; verified by eye at 512px and 16px. Wired via CFBundleIconFile. - Signing tiers, inert without certs: EPISTEME_SIGN_APP_ID / _INSTALLER_ID / EPISTEME_NOTARY_PROFILE upgrade unsigned → signed → notarized in scripts/build_app_pkg.sh; signing targets the STAGED copy (attribute-stripping must precede signing, never follow it). The hardened-runtime-vs-wry check is named as the first post-enrollment task. - AppleDouble hygiene, measured honestly: ditto strips the removable class; com.apple.provenance is SIP-protected and re-stamped on every local write — local pkgs ALWAYS carry its 11-byte entries, documented as unavoidable rather than promised away. Release artifacts are CI-built. - release-assets.yml: workflow_dispatch today (the E163 bot-token class blocks release:published until the operator's PAT exists — documented in the file); builds wheel + pkg on macos-latest, runs the SAME privacy gate as clean-install, attaches with contents:write. - ci.yml app-build job: the shell finally has a build gate (cargo cache). No Python changes; suite 1844+91; docs lint clean.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The program's release-grade lane, credential-ready and inert without the operator's Apple enrollment:
app/icon/make_icns.swiftdraws the Gate mark (CoreGraphics; committed icns is reproducible from source). Eyeballed at 512px/16px.build_app_pkg.sh; signs the STAGED copy (strip-then-sign ordering); hardened-runtime-vs-wry named as the first post-enrollment check.com.apple.provenanceis SIP-protected + re-stamped on write, so local pkgs always carry its 11-byte entries — documented as unavoidable, not promised away (the E176 nit's honest closure).workflow_dispatchworks today;release: publishedactivates once release-please gets the operator PAT (E163 class, documented in-file).Verification
Suite 1844+91 unchanged (no Python changes) · docs lint clean · pkg rebuilt with icon in Resources · icon renders verified visually.
Operator gates (unchanged, named)
Apple Developer enrollment (/yr) · release-please PAT · distribution channel (PyPI vs GH releases).