TZGyn/prompt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 20 Wiki Activity

Fail the release script when notarization does not happen

Browse Source 
A missing key or a skipped notarization used to exit 0 with a sha256,
which made an unnotarized build look publishable. Releases now fail
loudly unless spctl confirms a notarized build, and the skip flag warns
that its output must not be published.

💘 Generated with Crush

Assisted-by: Crush:kimi-k3
This commit is contained in:
TZGyn
2026-10-08 10:06:25 +08:00
parent 466c49e4b0
commit 88780f7701
2 changed files with 35 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENTS.md
+19 -8
View File
@@ -105,15 +105,26 @@ Bundle id is `dev.tzgyn.prompt`.
## Release process
1. `./release.sh <version>` — builds, zips `Prompt.app` to `dist/Prompt.zip`,
and prints its sha256 (it does not tag or upload). Notarizes when the
`PROMPT_NOTARY_*` env vars (or the shared Kapture App Store Connect key at
`~/.config/kapture/AuthKey_K5KXMMSB28.p8`) are present; set
`PROMPT_SKIP_NOTARY=1` to skip.
Notarization is **required**: an unnotarized build is not a release. Never
publish one, and never suggest quarantine workarounds (`xattr -dr
com.apple.quarantine`, `brew install --cask --no-quarantine`). `release.sh`
enforces this — it fails if it cannot notarize, and refuses to print a sha256
unless `spctl` reports `source=Notarized Developer ID`. `PROMPT_SKIP_NOTARY=1`
exists only for a local dev build and prints a "NOT FOR PUBLICATION" warning.
1. `./release.sh <version>` — builds, notarizes, staples, zips `Prompt.app` to
`dist/Prompt.zip`, and prints its sha256 (it does not tag or upload). Uses
the `PROMPT_NOTARY_*` env vars, defaulting to the shared Kapture App Store
Connect key at `~/.config/kapture/AuthKey_K5KXMMSB28.p8`.
2. Commit and push `main`.
3. `tea releases create --tag v<version> --asset dist/Prompt.zip --repo TZGyn/prompt --login gitea.tzgyn.dev`.
4. Bump `version`/`sha256` in `~/.cache/homebrew-tap/Casks/prompt.rb`, push,
then `git -C /opt/homebrew/Library/Taps/tzgyn/homebrew-tap pull --ff-only`.
3. `tea releases create --tag v<version> --title "Prompt <version>" --note "<what changed>" --asset dist/Prompt.zip --repo TZGyn/prompt --login gitea.tzgyn.dev`.
4. Add/update `~/.cache/homebrew-tap/Casks/prompt.rb` (`version` + `sha256`),
push the tap, then
`git -C /opt/homebrew/Library/Taps/tzgyn/homebrew-tap pull --ff-only` and
`brew audit --cask tzgyn/tap/prompt`.
5. Verify by downloading the release asset back, comparing the sha256 with the
cask, and unzipping with `ditto -x -k` (not `unzip`, which adds `._*` files
and breaks the signature check) then `spctl -a -vv Prompt.app`.
**Always print the upgrade script after any release or version bump:**