This is the shortest repeatable path to produce downloadable installers and publish them for users.
- Signing secrets configured in GitHub Actions:
CSC_LINK,CSC_KEY_PASSWORDAPPLE_ID,APPLE_APP_SPECIFIC_PASSWORD,APPLE_TEAM_IDWIN_CSC_LINK,WIN_CSC_KEY_PASSWORDLINUX_SIGNING_KEY
desktop-releaseworkflow green on default branch.
git checkout main
git pull --ff-only
git tag v0.1.0
git push origin v0.1.0- GitHub Actions runs
.github/workflows/desktop-release.ymlon the tag. - Required matrix targets:
- macOS
x64,arm64 - Windows
x64 - Linux
x64,arm64
- macOS
- The workflow publishes a GitHub Release with installer files and integrity files.
- Confirm release assets include installers for all required targets.
- Confirm
release-manifest.jsonandchecksums.txtare attached. - Confirm
validate-release-evidencejob passed. - Confirm signing/notarization gate passed for each target.
- Complete MANUAL_SIGNOFF_TEMPLATE.md:
- One human run on macOS, Windows, and Linux
- First-run setup + recording/transcription/note generation sanity
- Update RELEASE_READINESS_CHECKLIST.md with evidence links.
- Announce release only when all blockers are green.