- Updated the release workflow to include signing of macOS .app tarballs with the Tauri updater key, ensuring integrity for installed clients.
- Modified the upload script to handle the signing process and added error handling for missing signing keys.
- Removed Linux x86_64 asset handling from the updater manifest to streamline the release process.
These changes improve the security and reliability of macOS artifact uploads in the release workflow.
Split monolithic inline bash from release.yml and release-packages.yml
into standalone scripts under scripts/release/ for easier debugging
and manual execution.
New scripts:
- bump-version.js: version bumping across package.json/tauri/Cargo
- stage-sidecar.sh: stage + verify sidecar binary for Tauri bundler
- sign-and-notarize-macos.sh: macOS code signing and notarization
- repackage-dmg.sh: re-create and notarize DMG post-signing
- upload-macos-artifacts.sh: re-upload notarized artifacts to release
- package-cli-tarball.sh: package CLI binary into release tarball
- build-linux-arm64.sh: build Linux arm64 CLI tarball
- update-homebrew.sh: render and commit Homebrew formula to tap
- build-apt-packages.sh: build .deb packages and apt repository
- publish-npm.sh: stamp version and publish npm package
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>