feat(release): Dreamforge desktop releases for macOS and Windows from GitHub Actions - #25
Merged
Merged
Conversation
…abled scripts/release-windows.bat <version> builds the NSIS installer through the existing build-windows-installer.bat with the updater configured (public key and endpoint via the upstream build-release-config.mjs delta, version patched into the same delta so no tracked file changes), lets Tauri sign the .exe with the fork's minisign key at ~/.tauri/dreamforge.key, writes latest.json with scripts/release-latest-json.py (refuses a version that is not newer than the published feed), and uploads exe + sig + latest.json to the rolling GitHub release dreamforge-desktop-latest on QuicksilverSlick/buzz. build-windows-installer.bat gains an optional TAURI_BUILD_ARGS passthrough so the release script does not need a second copy of it. tauri.release.conf.json is now ignored so release worktrees stay clean. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… GitHub Actions Releases move to CI so one publisher owns latest.json. .github/workflows/dreamforge-desktop-release.yml builds an ad-hoc signed app and DMG for aarch64 and x86_64 macOS (not notarized) and the NSIS installer for Windows, with the updater pointed at the rolling release dreamforge-desktop-latest and the committed public key desktop/src-tauri/dreamforge-updater.pub. A manual run with publish=true checks the version is newer than the published feed, writes latest.json for darwin-aarch64, darwin-x86_64 and windows-x86_64, and uploads everything, latest.json last. Pull requests touching the workflow only build. Without the TAURI_SIGNING_PRIVATE_KEY secret, builds skip updater artifacts and publish refuses. scripts/release-latest-json.py now takes one PLATFORM=SIG_FILE=URL triple per platform and refuses missing or empty signatures. scripts/release-windows.bat is removed and build-windows-installer.bat is back to origin/main, so local installer builds are unchanged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: QuicksilverSlick <russelledeming@gmail.com>
The updater signing key now reaches only manual runs on main: pull requests and dispatches from other branches build without updater archives, so unreviewed code never runs next to the key. Publishing refuses any ref but main, early in the build jobs and again in the publish job's condition. release-latest-json.py takes --pubkey and refuses a .sig whose minisign key ID differs from the committed public key, since tauri build only warns on a mismatched pair and every installed app would reject that release. --check validates the version before looking at the feed, so an empty or malformed version is refused before the first publish too; Set version now runs on every manual run instead of only when a version is given. Mac update archives carry the version (Dreamforge_<version>_<arch>.app.tar.gz), so uploading never replaces a file the live latest.json points at. The macOS config step runs --selftest, so pull requests that change the script test it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: QuicksilverSlick <russelledeming@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
Dreamforge desktop installers for macOS and Windows, built in GitHub Actions, with the in-app updater turned on. This replaces the local Windows-only script from the first commit on this branch, because two publishers would overwrite one
latest.json..github/workflows/dreamforge-desktop-release.ymlmacos-latest, as upstream does). BuildsDreamforge.appand a DMG, ad-hoc signed because Apple Silicon refuses to launch unsigned code. Not notarized, since there is no Apple Developer account.codesign --verify --deep --strictruns on every build.mainwithpublish=true. It checks the version is plainx.y.zand newer than the live feed, and that every.sigwas made by the key indesktop/src-tauri/dreamforge-updater.pub. Then it uploads DMGs, updater archives, the installer andlatest.jsonto the rolling releasedreamforge-desktop-latest, withlatest.jsonlast.main.scripts/release-latest-json.py: writes a multi-platformlatest.jsonfordarwin-aarch64,darwin-x86_64andwindows-x86_64, and matches each signature's key ID against the public key.--selftestruns in CI.desktop/src-tauri/dreamforge-updater.pub: the updater public key, IDD9DED66F367B9EA7. The private half stays on the owner's machine until it is added as theTAURI_SIGNING_PRIVATE_KEYsecret.desktop/src-tauri/.gitignore: ignores the generatedtauri.release.conf.json.Not built on macOS: the
mesh-llmfeature. Windows does not build it either.Before the first publish
Verified
release.yml.--selftestcovers version ordering, bad versions, and foreign, empty, junk and missing signatures. It also checks the committed key's ID.Known limits
xyz.block.buzz.app, the same as Block's Buzz, so a Mac with both apps installed shares their settings folder and keychain entries.🤖 Generated with Claude Code