Repository navigation
sign win binaries and msis, split release into per-platform workflows - #130
Conversation
Signed-off-by: Peter Jausovec <peter.jausovec@solo.io>
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
Production release orchestration and code-signing changes require a successful end-to-end release run and human verification.
Review effort: Balanced
Findings: None
What changed in this PR
Splits release automation by platform and adds Authenticode signing for Windows executables and MSI installers.
Changes:
- Introduces reusable Linux, macOS, and Windows release workflows.
- Builds, signs, verifies, packages, and smoke-tests Windows artifacts.
- Adds Tauri build-only/bundle-only modes and upgrades the CLI to 2.12.0.
| File | Description |
|---|---|
frontend/pnpm-lock.yaml |
Locks Tauri CLI 2.12.0. |
frontend/desktop/package.json |
Upgrades the Tauri CLI dependency. |
frontend/desktop/scripts/package-tauri.mjs |
Adds Windows packaging modes. |
frontend/desktop/scripts/package-windows.mjs |
Separates compilation from MSI bundling. |
frontend/desktop/scripts/package-windows.test.mjs |
Tests the new packaging modes. |
.github/workflows/release.yml |
Coordinates platform-specific workflows and final release. |
.github/workflows/release-linux.yml |
Extracts Linux artifacts and controller publishing. |
.github/workflows/release-macos.yml |
Extracts macOS binary and installer builds. |
.github/workflows/release-windows.yml |
Adds Windows signing and installer validation. |
.github/scripts/verify-windows-version.ps1 |
Verifies embedded release versions. |
.github/scripts/verify-windows-signature.ps1 |
Validates signatures, signer, and timestamps. |
Files not reviewed (1)
- frontend/pnpm-lock.yaml: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Signed-off-by: Peter Jausovec <peter.jausovec@solo.io>
|
@copilot resolve the merge conflicts in this pull request |
# Conflicts: # frontend/desktop/package.json Co-authored-by: peterj <11080940+peterj@users.noreply.github.com>
Resolved the conflict and merged |
Co-authored-by: peterj <11080940+peterj@users.noreply.github.com>
ilackarms
left a comment
ilackarms
left a comment
There was a problem hiding this comment.
Thanks for splitting the release by platform. I compared the Linux and macOS workflows against the previous jobs and they look like faithful extractions, and the sign-then-bundle-then-sign-then-smoke-test flow for Windows hangs together (the --no-binary-patching flag is a good catch). A couple of small follow-ups below. Also, frontend/desktop/WINDOWS_INSTALLER.md still says the MSI is unsigned and lists production signing as a to-do; could we update it to describe the new flow? Since the manual-dispatch guard prevents exercising this from the branch, a dispatch from main with skip_github_release after merge would be a good way to validate signing before the next tag.
|
@copilot resolve the merge conflicts in this pull request |
# Conflicts: # .github/workflows/release.yml Co-authored-by: peterj <11080940+peterj@users.noreply.github.com>
Merged the latest |
Co-authored-by: peterj <11080940+peterj@users.noreply.github.com>
No description provided.