Publish a GitHub release with the DMG for each shipped desktop version
iamnbutler opened ·
Canary publishing currently uploads the signed DMG and Sparkle feed to R2, but creates no GitHub release. The Desktop release workflow only has contents:read.
Add a versioned GitHub release for each published desktop channel/version, attach the verified signed DMG, mark canaries as prereleases, and keep build-only runs unpublished. Pin the tag to the manifest source revision and handle retries without replacing existing release bytes. Keep R2 as the Sparkle update host.
Reported by @iamnbutler while dogfooding Ace. Related: #7, #5.
iamnbutlermentionedlast month on GitHub
iamnbutlersubscribedlast month on GitHub
iamnbutlerreferenced this in [Meta] Dogfood Ace end to end #5last month on GitHub
iamnbutlerreferenced this in [Meta] Prepare wider desktop distribution #7last month on GitHub
iamnbutlerreferenced this in fix(desktop): publish versioned GitHub releases with signed DMGs #198last month on GitHub
iamnbutlerreferenced this in chore(desktop): prepare canary 0.0.18 #199last month on GitHub
- IA
Shipped and verified end to end in Canary 0.0.18: https://github.com/githubnext/ace2/actions/runs/37639979472. The new workflow automatically published https://github.com/githubnext/ace2/releases/tag/desktop-canary-v0.0.18 with the DMG attached before committing the Sparkle feed. GitHub and R2 downloads match the signed CI manifest (SHA-256 `75110e9d891ecc2d384cffeb0b0c575598c27dc2ad5c6e1b05406ef1199eace6`); public feed matches the signed CI feed and serves 0.0.18 with no-store. The GitHub-downloaded DMG passes local stapled-ticket validation and Gatekeeper as Notarized Developer ID.
Also backfilled all ten previously shipped canaries (0.0.7–0.0.16) from original CI artifacts, checking each against existing public bytes. 0.0.17 was build-only and remains unpublished.