Skip to content

RELEASING.md

Latest commit

 

History

History
52 lines (34 loc) · 1.34 KB

RELEASING.md

File metadata and controls

52 lines (34 loc) · 1.34 KB
Raw

Releasing

Web

Web deploy is automatic on push to master via deploy-pages.yml.

Desktop

Desktop artifacts are produced for Windows, macOS, and Linux on push and pull request to master by build-desktop.yml.

Each push to master also generates:

  • SHA256SUMS.txt for artifact integrity checks.
  • A GitHub artifact attestation (SLSA provenance) for the .exe and checksum file.

Native installer packaging is produced by package-desktop.yml on version tags (v*) and manual runs:

  • Windows: portable .exe
  • Linux: .deb
  • macOS: .app.zip (app bundle zipped for transport)

On version tags, package-desktop.yml now also publishes those packaged artifacts directly to the corresponding GitHub Release.

Signed Windows release publishing is handled by release-desktop-signed.yml on version tags (v*). It requires:

  • WINDOWS_CERT_BASE64 secret
  • WINDOWS_CERT_PASSWORD secret

The workflow will fail early if these secrets are missing to avoid unsigned production releases.

For tagged releases:

  1. Update CHANGELOG.md.
  2. Create and push a version tag:
git tag v0.1.0
git push origin v0.1.0

  1. Wait for the release workflows to publish the packaged desktop assets.

  2. Verify artifact integrity and provenance before distribution:

gh attestation verify <artifact-path-or-uri> --repo OptimumAF/WhatShouldIPlay