fix(release): make the Portal release build run, and correct the runbook order
- commit
- e96de5b92800b7d569dee4e9f1db8451af05edbf
- parent
- 4519001f4ef8765c47c331df5af43408acbb0a99
- parent
- 73d4319096e45db165aad83236380e0d2eba40da
- author
- FelineStateMachine <dami.etoile@gmail.com>
| M | .github/ | 5 | +++-- |
| M | docs/ | 19 | ++++++++++++------- |
| M | scripts/ | 3 | ++- |
@@ -102,9 +102,10 @@ jobs:
102102 - name: Build unsigned preview bundles103103 shell: bash104104 run: |105- cargo tauri build --locked --ci \105+ cargo tauri build --ci \106106 --target "${{ matrix.target }}" \107- --bundles "${{ matrix.bundles }}"107+ --bundles "${{ matrix.bundles }}" \108+ -- --locked108109 109110 - name: Collect preview artifacts and digests110111 id: collect@@ -143,7 +143,16 @@ The tag is `v0.1.0`, matching the version already in every workspace manifest.
143143 3. **Run Sigil Release with `build-candidate`** against the tag. It creates the144144 draft and attaches the unsigned candidate archive and its checksum.145145 146-4. **Sign offline.** Move the candidate bytes to the publisher machine,146+4. **Run Portal release** against the same tag. It builds, verifies, and147+ attests the ad-hoc macOS arm64 assets, and separately builds and attests the148+ unpublished preview matrix. The draft stays a draft.149+150+ Signing comes after this, not before. The Portal job refuses to start unless151+ the draft holds *exactly* the two Sigil candidate assets, and it names its152+ own result the five-asset **pre-signature** contract. Attaching the153+ `.minisig` first makes that precondition fail.154+155+5. **Sign offline.** Move the candidate bytes to the publisher machine,147156 independently confirm the tag commit, then:148157 149158 ```bash@@ -155,12 +164,8 @@ The tag is `v0.1.0`, matching the version already in every workspace manifest.
155164 --public-key-file /absolute/offline/path/sigil-minisign.pub156165 ```157166 158- Carry only the resulting `.minisig` back and attach it to the draft. Never159- use `--clobber`.160-161-5. **Run Portal release** against the same tag. It builds, verifies, and162- attests the ad-hoc macOS arm64 assets, and separately builds and attests the163- unpublished preview matrix. The draft stays a draft.167+ Carry only the resulting `.minisig` back and attach it to the draft, taking168+ the draft from five assets to six. Never use `--clobber`.164169 165170 6. **Run Sigil Release with `promote-signed-draft`.** It requires the exact166171 six-asset set, re-verifies both products against the same tag and commit,@@ -141,7 +141,8 @@ fi
141141 source "$HOME/.cargo/env"142142 (143143 cd "$repo_dir"144- cargo tauri build --locked --ci --target aarch64-apple-darwin --bundles app,dmg144+ # tauri-cli has no --locked flag; cargo args go after `--`.145+ cargo tauri build --ci --target aarch64-apple-darwin --bundles app,dmg -- --locked145146 )146147 147148 bundle_root="$repo_dir/target/aarch64-apple-darwin/release/bundle"