mirror of
https://github.com/storytold/wordcraft.git
synced 2026-10-29 12:57:09 -06:00
Jeremy
72b8818ea6
The package is dual-scope, so the separate -windows-user MSI was the same package under a second name. Build and policy-check the single plain-named MSI before signing, which is the name every sibling app, the launcher and the shared windows-arm64 workflow use. Replace the loop test with one that checks the MSI is policy-checked once, before it is signed.
32 lines
2.1 KiB
Markdown
32 lines
2.1 KiB
Markdown
# Releasing WordCraft
|
|
|
|
The canonical recipe is [craftrules `release/playbook.md`](https://github.com/storytold/craftrules/blob/main/release/playbook.md);
|
|
this file has the WordCraft specifics.
|
|
|
|
1. Bump the version on `main`: `cargo xtask version set 0.2.0` (the one source of truth is
|
|
`[workspace.package] version`; the app shows it in `--version` and About, with the commit from
|
|
`WORDCRAFT_BUILD_SHA`).
|
|
2. Merge `main` into `release` and push. `.github/workflows/release.yml` builds:
|
|
|
|
| Platform | Artifacts | Signing |
|
|
|---|---|---|
|
|
| macOS | universal `WordCraft.app` in a `.dmg`, universal CLI zip | Developer ID + notarization (`APPLE_*` secrets) |
|
|
| Windows | x64, x86 and arm64 `.msi` (one dual-scope package: per-user by default, needs no admin rights; "Everyone on this computer" installs per machine) + portable `.zip` | Azure Trusted Signing (`AZURE_*` secrets) |
|
|
| Linux | x86_64 and aarch64 `.AppImage` (+ `.zsync` for AppImageUpdate), `.flatpak` bundle, `.deb`, `.rpm`, `.tar.gz`; Flathub manifest | checksums |
|
|
| Linux riscv64 | `.tar.gz` (cross-compiled on `ubuntu-24.04`, glibc >= 2.39; CLI smoke-tested under QEMU) | checksums |
|
|
| FreeBSD | x86_64 `.tar.gz` | checksums |
|
|
| Web | `wordcraft-web-<version>.zip` (static site: `index.html`, wasm, glue) | none |
|
|
|
|
3. The run drafts a GitHub Release `WordCraft v<version>` with `SHA256SUMS.txt`; review and publish it.
|
|
|
|
Signing secrets live in the repository's `release` environment (deployment branch: `release` only),
|
|
synced from the release manager's machine (`craftrules/release/signing-setup.md`). Missing secrets
|
|
produce unsigned builds with a warning, so forks still build.
|
|
|
|
Local packaging: `packaging/macos/package.sh --arch universal`, `packaging/windows/package.ps1`,
|
|
`packaging/linux/package.sh` (then `packaging/linux/flatpak-bundle.sh` for the Flatpak), `packaging/web/package.sh`.
|
|
|
|
Dry run: `gh workflow run release.yml --ref <branch>` builds the unsigned jobs (version, Linux,
|
|
Linux riscv64, Flatpak, FreeBSD, web) on any branch; the signing jobs are refused there by the `release`
|
|
environment's branch rule, so no draft release is made.
|