Publish only the two desktop installers - #47
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Releases now expose only the unsigned Windows installer and signed/notarized macOS DMG. Integrations remain bundled, and the pinned corresponding 7-Zip source and existing notices are included inside both installers.
The updater verifies GitHub asset size and SHA-256 metadata instead of downloading separate checksum files. Candidate/publication checks require exactly two assets, verify their bytes against GitHub digests, and preserve both real-machine hash attestations. Private draft lookup uses release IDs; previous-installer downloads are authenticated, and a first release correctly handles the missing baseline.
Validation: 47 script contract tests, six focused updater tests, strict native-services Clippy, workflow PowerShell/Bash syntax checks, and a Windows packaging smoke that includes the pinned source passed. Full local pnpm release:check passed on Rust 1.98.0: workspace tests, strict lint, audits, and optimized app build. The final Windows installer also built successfully with the verified corresponding source included. Hosted platform CI must pass before merge. No live release, repository identity, or product version was changed.