Jens/ForgeFlow-Public
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Publish curated ForgeFlow source from 63022ccf9a37242d573297c8ce7f15db61acc34e
ForgeFlow quality gate / secret-scan (push) Successful in 4s
Details
ForgeFlow signed release / release (push) Failing after 18m45s
Details
ForgeFlow quality gate / quality (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
Public Source Publisher committed 2026-09-30 21:27:28 +00:00
1 parent bdfcc1585d
commit 04cbfccbdb
19 files changed
+233 -77
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/UPDATING.md
+5 -5
View File
@@ -14,13 +14,13 @@ Update a source checkout through Git instead:
4. run `npm ci --ignore-scripts` and review the dependency lifecycle allowlist;
5. run `npm run check` before starting ForgeFlow.
The in-app updater remains available for signed packaged Windows releases.
The in-app updater remains available for signed packaged Windows releases. Version 0.10.16 migrates the default endpoint from `Jens/ForgeFlow` to `Jens/ForgeFlow-Public` after a bridge release from the legacy repository. A separately configured update repository is preserved.
## Packaged Windows updates
ForgeFlow uses authenticated Gitea release assets when running from the installer or portable executable. The updater selects the artifact that matches the current installation mode and requires its `.sha256` sidecar. From version 0.10.13 onward it also requires an Ed25519-signed release manifest. The embedded public key verifies that manifest before ForgeFlow trusts the artifact name, byte length, exact source commit or SHA-256 digest. The digest is checked again immediately before applying the update.
`Publish-ForgeFlow-Release.ps1` treats source and binaries as one release transaction. It pushes the validated source, builds the exact published commit and uploads eight required assets:
A version bump in the curated `ForgeFlow-Public` source starts the Windows quality, build, signing and release workflow. It publishes eight required assets:
- `ForgeFlow-Setup-<version>-win-x64.exe`
- `ForgeFlow-Setup-<version>-win-x64.exe.sha256`
@@ -31,9 +31,9 @@ ForgeFlow uses authenticated Gitea release assets when running from the installe
- `ForgeFlow-<version>-release-manifest.json`
- `ForgeFlow-<version>-release-manifest.json.sig`
Run `npm run signing:setup` once on the release workstation. The private Ed25519 key stays outside the repository in ForgeFlow's user-data folder. This independent publisher signature is free; optional Authenticode can still be added later for Windows reputation.
The release workflow uses the same Ed25519 private key that signed the legacy releases, stored as a repository-scoped Gitea Actions secret. Only the public key is committed. `npm run signing:setup` remains available for a local recovery build; do not generate a replacement key for existing installations. Authenticode can still be added separately for Windows reputation.
Use `-SkipBinaryRelease` only when intentionally publishing source without enabling packaged auto-update.
The reviewed source sync runs for every merge to the private canonical repository. Source-only changes do not produce another Windows release. `workflow_dispatch` can retry a failed binary publication for the current public commit.
When the source was already pushed without a binary release, run the recovery publisher from Windows:
@@ -64,6 +64,6 @@ Set-ExecutionPolicy -Scope Process Bypass
.\Publish-ForgeFlow-Release.ps1
```
The script installs dependencies, runs the complete quality gate, clones `git@gitea.itworx.tech:Jens/ForgeFlow.git` into a temporary folder, mirrors the validated source without `.git`, `node_modules`, `dist` or release archives, commits it and pushes `main`. It then compares local `HEAD` with `git ls-remote`, builds the exact published checkout and uploads all binaries, checksums and signed release evidence to the matching Gitea release. Publication fails when either the source commit, publisher signature or any required asset cannot be verified.
The manual script is a recovery path for an extracted, reviewed `ForgeFlow-Public` source export. It installs dependencies, runs the quality gate, verifies the exact published source commit, builds the Windows artifacts and uploads the signed release evidence. Publication fails when the source commit, publisher signature or required assets cannot be verified. An already published version is immutable; use a new version for later source changes.
Keep the currently installed older ForgeFlow source folder untouched until the built-in updater test is complete.