Updater plugin with signed artifacts (minisign), latest.json composed by
release CI, update prompt in-app. Endpoints: download.opencoworker.app
with GitHub Releases fallback. Version 0.1.2.
Desktop releases live in the app-v* tag namespace (v* belongs to the
Python library), so the release workflow must trigger on it; bump the
app version to 0.1.1 (rename, PDF preview, approval/todo polish,
sidecar-leak and session-persistence fixes since 0.1.0).
Co-authored-by: Devika <dr.drp8226@gmail.com>
macos-13 is GitHub's last Intel runner image and is deprecated: the
first release run's Intel job sat queued for 4.5+ hours without
starting, and the release job (needs: build) waits on every matrix
entry, so a starved Intel queue blocks publishing entirely. Apple
Silicon and Windows remain; revisit Intel only on real user demand.
Tauri's bundler signs and notarizes during `tauri build` when the
APPLE_* env vars are present, so the packaging scripts are unchanged;
the release workflow now passes them through from repo secrets
(APPLE_CERTIFICATE/_PASSWORD, APPLE_SIGNING_IDENTITY, and the
notarytool App Store Connect key as APPLE_API_KEY/_ISSUER/
_KEY_CONTENT, written to a runner-temp .p8). Runs without the secrets
degrade cleanly to unsigned builds (empty vars are unset so Tauri
doesn't treat them as config).
src-tauri/entitlements.plist grants
com.apple.security.cs.disable-library-validation, required under the
hardened runtime by the PyInstaller onefile sidecar: it extracts the
Python shared library (signed by a different Team ID) at runtime, and
library validation refuses to load it otherwise (dlopen: "mapping
process and mapped file (non-platform) have different Team IDs").
Verified locally: signed app passes codesign --verify --strict, the
signed sidecar boots and serves /v1/health.
.github/workflows/release.yml builds the desktop installers by calling
the same packaging scripts developers run locally:
- matrix: macos-latest (Apple Silicon .dmg), macos-13 (Intel .dmg),
windows-latest (.msi + NSIS setup .exe)
- provisions Node 20, stable Rust (+ cache), Python 3.12 venv at
platform/.venv with the package, PyInstaller, typer/tzdata, and a
.pth for the repo-root aisuite package (mirrors local dev)
- tag push v* -> draft GitHub Release with all installers attached;
manual runs upload workflow artifacts only
- every installer is also uploaded under a stable name so the website
can deep-link releases/latest/download/<name>
- builds remain unsigned; signing/notarization slots in later without
touching the build scripts
build_dmg.sh now derives VERSION from tauri.conf.json (single source
of truth) instead of hardcoding it.
This will be invoked by the GitHub workflow
each time a release is cut. This is part of
the pre-work for creating release automation.
Ignore the integration test using mark.
Rohit C Prasad