Skip to content

ci(release): release from tags through release.yml - #3506

Merged
datlechin merged 19 commits into
mainfrom
ci/release-from-tags
Oct 18, 2026
Merged

datlechin merged 19 commits into
mainfrom
ci/release-from-tags

Conversation

@datlechin

@datlechin datlechin commented Oct 18, 2026 •

Copy link
Copy Markdown
Member

Why

Step 23 of the release rewrite, the cutover: a v* tag builds, notarizes and publishes the app and every registry plugin through release.yml. Merges in the freeze window with steps 20-23.

Change

  • Adds release.yml, pages.yml, withdraw.yml, scripts/release/notarize.sh, ExportOptions.plist, describe in package.sh plugins, the apple-signing rewrite for the App Store Connect key and setup-xcode require-release.
  • Versions come from the tag (0.0.0-dev locally). What's New is written at build time from CHANGELOG.md.
  • Changelog: 69 [Unreleased] entries become changelog.d/ fragments; check-changelog.py runs in Repo Hygiene and PR title, which skips the one PR that creates changelog.d/.
  • govulncheck moves to Repo Hygiene's HANA step.
  • Deletes build.yml, build-plugin.yml, build-release.sh, create-dmg.sh, build-plugin.sh, the plugin re-release scripts, Version.xcconfig, WhatsNew.md, release-flags.json, .github/scripts/ and the old scripts/ci release helpers.
  • Rewrites RELEASING.md, the release skill, plugin-registry.json (keyed by target) and the CI, plugin, bridge, storage and changelog rules.

After the merge (maintainer)

  • Delete REGISTRY_DEPLOY_KEY, and APPCAST_DEPLOY_KEY from release.
  • Set SPARKLE_PRIVATE_KEY in release from the step 2 file.
  • Delete deploy keys 164352986 and 166622419; rm ~/.ssh/tablepro_release*.
  • Set bypass_actors: [] on ruleset 23957966.

Verified

  • Build, AllPlugins and 35 tests in 6 suites; WhatsNewContentTests changed on purpose (no bundled notes now means no link).
  • build.sh app --unsigned 490 s, package.sh app 87 s, build.sh plugins --unsigned 172 s cold, package.sh plugins 10 s (26 plugins described).
  • What's New in a sandboxed build: nothing at 0.0.0-dev, WhatsNew.md at 0.81.0.
  • Signed probe (step 18), blocked: codesign with "Developer ID Application: Dat Ngo Quoc (D7HJ5TFYCU)" hung on the login keychain's private key prompt and was killed after 90 s. The keychain is unlocked and timestamp.apple.com answers, so build.sh plugins was not run signed. Needs "Always Allow" on that prompt, or security set-key-partition-list -S apple-tool:,apple:,codesign: -s.
  • build.sh app signed: skipped. This Mac has no Developer ID profile for com.TablePro, only the Apple Development "Mac Team Provisioning Profile: com.TablePro".
  • notarize.sh: skipped. No TablePro notarytool keychain profile yet, since the App Store Connect key is not on this Mac.

Not in this PR

…pipeline

# Conflicts:
#	.github/workflows/build-plugin.yml
#	.github/workflows/build.yml
#	scripts/release-plugin-for-shipped-app.sh
…into ci/release-from-tags

# Conflicts:
#	CHANGELOG.md
# Conflicts:
#	.claude/rules/ci.md
#	.claude/rules/plugin-system.md
#	CHANGELOG.md
@datlechin
datlechin marked this pull request as ready for review October 18, 2026 06:18
@datlechin
datlechin merged commit 3694666 into main Oct 18, 2026
7 checks passed
@datlechin
datlechin deleted the ci/release-from-tags branch October 18, 2026 06:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant