mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
116 lines
3.6 KiB
Markdown
116 lines
3.6 KiB
Markdown
# Releasing Sprout Desktop
|
|
|
|
This document describes how to create a new OSS release of the Sprout
|
|
desktop app.
|
|
|
|
---
|
|
|
|
## Prerequisites
|
|
|
|
- **Write access** to the `block/sprout` GitHub repository. Only
|
|
collaborators with push permissions can trigger the release workflow.
|
|
- The following **GitHub Actions secrets** must be configured on the repo
|
|
(Settings > Secrets and variables > Actions):
|
|
|
|
| Secret | Purpose |
|
|
|--------|---------|
|
|
| `SPROUT_UPDATER_PUBLIC_KEY` | Tauri updater public key (minisign) |
|
|
| `TAURI_SIGNING_PRIVATE_KEY` | Tauri updater private key (used to sign the update archive) |
|
|
| `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` | Password for the private key |
|
|
|
|
---
|
|
|
|
## Creating a Release
|
|
|
|
1. Go to **Actions > Release** in the GitHub UI:\
|
|
`https://github.com/block/sprout/actions/workflows/release.yml`
|
|
|
|
2. Click **"Run workflow"**.
|
|
|
|
3. Fill in the inputs:
|
|
- **version** — a semver version string, e.g. `0.4.0` or `1.0.0-beta.1`.
|
|
Do not include a `v` prefix.
|
|
- **ref** — the branch, tag, or commit SHA to build from. Defaults to
|
|
`main`.
|
|
|
|
4. Click **"Run workflow"** to start the build.
|
|
|
|
The workflow will:
|
|
|
|
- Validate the version string
|
|
- Check out the specified ref
|
|
- Patch the version into `package.json`, `tauri.conf.json`, and `Cargo.toml`
|
|
- Build all sidecar binaries (`sprout-acp`, `sprout-mcp`,
|
|
`git-credential-nostr`)
|
|
- Build the Tauri desktop app with updater signing enabled
|
|
- Create a versioned GitHub release (`v0.4.0`) with the `.dmg` installer
|
|
- Update the rolling `sprout-desktop-latest` release with the signed
|
|
update archive and `latest.json` manifest for the auto-updater
|
|
|
|
---
|
|
|
|
## What Gets Published
|
|
|
|
Each release produces two GitHub releases:
|
|
|
|
1. **`v<version>`** (e.g. `v0.4.0`) — the user-facing release with the
|
|
`.dmg` installer. This is what users download manually.
|
|
|
|
2. **`sprout-desktop-latest`** — a rolling pre-release used by the Tauri
|
|
auto-updater. Contains `latest.json`, the signed `.tar.gz` archive,
|
|
and its `.sig` signature. Users should not download from this release
|
|
directly.
|
|
|
|
---
|
|
|
|
## Platform Support
|
|
|
|
The release workflow currently builds for **macOS ARM64 only**
|
|
(`darwin-aarch64`). Intel Mac (`darwin-x86_64`) support would require
|
|
adding a matrix build to the workflow.
|
|
|
|
## Code Signing (macOS)
|
|
|
|
OSS release builds use **ad-hoc code signing** (`signingIdentity: "-"`)
|
|
rather than a Developer ID certificate. This means the app is not
|
|
notarized by Apple.
|
|
|
|
On first launch, macOS Gatekeeper will block the app with a "damaged" or
|
|
"unidentified developer" message. Users can bypass this by
|
|
**right-clicking the app > Open** (or via System Settings > Privacy &
|
|
Security). After the first launch the app will open normally.
|
|
|
|
---
|
|
|
|
## Auto-Updater
|
|
|
|
The desktop app checks for updates by fetching `latest.json` from the
|
|
`sprout-desktop-latest` release:
|
|
|
|
```
|
|
https://github.com/block/sprout/releases/download/sprout-desktop-latest/latest.json
|
|
```
|
|
|
|
When a new version is available, the app downloads the signed archive,
|
|
verifies the signature against the embedded public key, and applies the
|
|
update.
|
|
|
|
---
|
|
|
|
## Troubleshooting
|
|
|
|
### Build fails at "Validate version"
|
|
The version string must be valid semver: `MAJOR.MINOR.PATCH` with an
|
|
optional pre-release suffix (e.g. `1.0.0-beta.1`). Do not include a `v`
|
|
prefix.
|
|
|
|
### Build fails at "Build Tauri app"
|
|
Check that the signing secrets are configured correctly. The build
|
|
requires `TAURI_SIGNING_PRIVATE_KEY` and
|
|
`TAURI_SIGNING_PRIVATE_KEY_PASSWORD` to be set.
|
|
|
|
### Auto-updater reports "no update available"
|
|
Verify that the `sprout-desktop-latest` release exists and contains a
|
|
valid `latest.json`. If the user is on Intel Mac, no update will be
|
|
found (ARM64 only).
|