Two defects blocked the first release; neither had ever been executed. `cargo tauri build --locked` is not a valid invocation. tauri-cli 2.11.3 has no `--locked` flag on `build`; cargo arguments go after `--`. All four Portal jobs died with "unexpected argument '--locked' found" before compiling anything, in both `scripts/package-macos-client.sh` and the preview matrix. `docs/release-credentials.md` also had signing and the Portal build in the wrong order. The Portal job refuses to start unless the draft holds exactly the two Sigil candidate assets, and calls its own output the five-asset *pre-signature* contract, so the enforced order is build → Portal → sign → promote. The runbook said sign → Portal, which makes the Portal precondition fail on a draft that already carries the .minisig. Following the document was enough to wedge the release.
- commit
- 73d4319096e45db165aad83236380e0d2eba40da
- parent
- 4519001f4ef8765c47c331df5af43408acbb0a99
- author
- Dami <dami.etoile@gmail.com>
| M | .github/ | 5 | +++-- |
| M | docs/ | 19 | ++++++++++++------- |
| M | scripts/ | 3 | ++- |
@@ -102,9 +102,10 @@ jobs:
102102 - name: Build unsigned preview bundles103103 shell: bash104104 run: |105- cargo tauri build --locked --ci \105+ cargo tauri build --ci \106106 --target "${{ matrix.target }}" \107- --bundles "${{ matrix.bundles }}"107+ --bundles "${{ matrix.bundles }}" \108+ -- --locked108109 109110 - name: Collect preview artifacts and digests110111 id: collect@@ -143,7 +143,16 @@ The tag is `v0.1.0`, matching the version already in every workspace manifest.
143143 3. **Run Sigil Release with `build-candidate`** against the tag. It creates the144144 draft and attaches the unsigned candidate archive and its checksum.145145 146-4. **Sign offline.** Move the candidate bytes to the publisher machine,146+4. **Run Portal release** against the same tag. It builds, verifies, and147+ attests the ad-hoc macOS arm64 assets, and separately builds and attests the148+ unpublished preview matrix. The draft stays a draft.149+150+ Signing comes after this, not before. The Portal job refuses to start unless151+ the draft holds *exactly* the two Sigil candidate assets, and it names its152+ own result the five-asset **pre-signature** contract. Attaching the153+ `.minisig` first makes that precondition fail.154+155+5. **Sign offline.** Move the candidate bytes to the publisher machine,147156 independently confirm the tag commit, then:148157 149158 ```bash@@ -155,12 +164,8 @@ The tag is `v0.1.0`, matching the version already in every workspace manifest.
155164 --public-key-file /absolute/offline/path/sigil-minisign.pub156165 ```157166 158- Carry only the resulting `.minisig` back and attach it to the draft. Never159- use `--clobber`.160-161-5. **Run Portal release** against the same tag. It builds, verifies, and162- attests the ad-hoc macOS arm64 assets, and separately builds and attests the163- unpublished preview matrix. The draft stays a draft.167+ Carry only the resulting `.minisig` back and attach it to the draft, taking168+ the draft from five assets to six. Never use `--clobber`.164169 165170 6. **Run Sigil Release with `promote-signed-draft`.** It requires the exact166171 six-asset set, re-verifies both products against the same tag and commit,@@ -141,7 +141,8 @@ fi
141141 source "$HOME/.cargo/env"142142 (143143 cd "$repo_dir"144- cargo tauri build --locked --ci --target aarch64-apple-darwin --bundles app,dmg144+ # tauri-cli has no --locked flag; cargo args go after `--`.145+ cargo tauri build --ci --target aarch64-apple-darwin --bundles app,dmg -- --locked145146 )146147 147148 bundle_root="$repo_dir/target/aarch64-apple-darwin/release/bundle"