ForgeFlow/docs/RELEASING.md

Releasing ForgeFlow

ForgeFlow releases are built only from a clean, reviewed commit on Node 22 LTS.

Quality gate

npm ci
npm run quality
npm audit --omit=dev --audit-level=high

Windows build — no paid services required

ForgeFlow is a personal/internal tool. The supported release path therefore has no certificate, Azure or other paid-service dependency:

npm run dist:win

Run npm run signing:setup once on the release workstation. It stores the private Ed25519 key outside the repository and writes only its public key into the packaged app. npm run dist:win then produces the installer and portable executable, SHA-256 sidecars, CycloneDX SBOM, provenance and an Ed25519-signed manifest bound to the exact source commit. The updater verifies the pinned publisher key before trusting the artifact digest and verifies that digest again immediately before replacing the installed executable.

Windows can display an Unknown publisher warning for an unsigned installer. That warning concerns public publisher reputation; it does not prevent ForgeFlow from installing or using its checksum-verified in-app updates. Authenticode can be added later as an optional distribution convenience, but is not required for correct operation.

Atomic publication

npm run release:binary keeps the Gitea release in draft state while uploading the installer, portable executable, two checksums, provenance, SBOM, signed manifest and signature. It only publishes after all eight assets are present. A failed upload leaves a draft rather than exposing an incomplete updater target.

The optional signing acceptance fixture can still validate the complete local Authenticode chain without purchasing or retaining a certificate:

npm run test:signing

This disposable fixture signs installer, portable, update-helper and uninstaller stand-ins, requires an RFC 3161 timestamp, and proves rejection of a missing timestamp, wrong publisher and a modified binary. Its certificate is removed from the current-user certificate store after the test.

The disposable test certificate is removed from the current-user certificate store after the test and is never used for a published build.