docs: align release and recovery guidance

2026-07-29 16:31:24 +02:00
parent 4708367b66
commit 4555023f87
5 changed files with 87 additions and 4 deletions
@@ -0,0 +1,39 @@
+# Releasing ForgeFlow
+
+ForgeFlow releases are built only from a clean, reviewed commit on Node 22 LTS.
+
+## Quality gate
+
+```powershell
+npm ci
+npm run quality
+npm audit --omit=dev --audit-level=high
+```
+
+## Signed Windows build
+
+Production signing is fail-closed. Configure electron-builder's Authenticode
+certificate through its supported CSC environment variables, then set:
+
+```powershell
+$env:FORGEFLOW_SIGNED_RELEASE = '1'
+$env:FORGEFLOW_EXPECTED_PUBLISHER = 'exact certificate subject fragment'
+npm run dist:win
+```
+
+Both installer and portable executable must have a valid Authenticode signature,
+the expected publisher and a timestamp. The build also creates SHA-256 files, a
+CycloneDX SBOM and a provenance document containing commit and build ID.
+
+Without `FORGEFLOW_SIGNED_RELEASE=1`, local builds may be unsigned for development
+testing but must never be published as production releases.
+
+## Atomic publication
+
+`npm run release:binary` keeps the Gitea release in draft state while uploading
+the installer, portable executable, two checksums, provenance and SBOM. It only
+publishes after all six assets are present. A failed upload leaves a draft rather
+than exposing an incomplete updater target.
+
+The production Authenticode certificate and legal publisher identity are
+`PENDING_HUMAN_INPUT`; all surrounding build and verification code is complete.