ForgeFlow/docs/RELEASING.md

Releasing ForgeFlow

ForgeFlow releases are built only from a clean, reviewed commit on Node 22 LTS.

Quality gate

npm ci
npm run quality
npm audit --omit=dev --audit-level=high

Signed Windows build

Production signing is fail-closed. Configure electron-builder's Authenticode certificate through its supported CSC environment variables, then set:

$env:FORGEFLOW_SIGNED_RELEASE = '1'
$env:FORGEFLOW_EXPECTED_PUBLISHER = 'CN=Exact Legal Publisher, O=Exact Legal Organization, C=BE'
npm run dist:win

Both installer and portable executable must have a valid Authenticode signature, the expected publisher and a timestamp. The build also creates SHA-256 files, a CycloneDX SBOM and a provenance document containing commit and build ID.

Without FORGEFLOW_SIGNED_RELEASE=1, local builds may be unsigned for development testing but must never be published as production releases.

Atomic publication

npm run release:binary keeps the Gitea release in draft state while uploading the installer, portable executable, two checksums, provenance and SBOM. It only publishes after all six assets are present. A failed upload leaves a draft rather than exposing an incomplete updater target.

The publisher check is an exact subject match, not a substring match. Before a production certificate is available, validate the complete local chain with:

npm run test:signing

This disposable fixture signs installer, portable, update-helper and uninstaller stand-ins, requires an RFC 3161 timestamp, and proves rejection of a missing timestamp, wrong publisher and a modified binary. Its certificate is removed from the current-user certificate store after the test.

The production Authenticode certificate and exact legal publisher identity are PENDING_HUMAN_INPUT; all surrounding build and verification code is complete.