40 lines
1.3 KiB
Markdown
40 lines
1.3 KiB
Markdown
# Releasing ForgeFlow
|
|
|
|
ForgeFlow releases are built only from a clean, reviewed commit on Node 22 LTS.
|
|
|
|
## Quality gate
|
|
|
|
```powershell
|
|
npm ci
|
|
npm run quality
|
|
npm audit --omit=dev --audit-level=high
|
|
```
|
|
|
|
## Signed Windows build
|
|
|
|
Production signing is fail-closed. Configure electron-builder's Authenticode
|
|
certificate through its supported CSC environment variables, then set:
|
|
|
|
```powershell
|
|
$env:FORGEFLOW_SIGNED_RELEASE = '1'
|
|
$env:FORGEFLOW_EXPECTED_PUBLISHER = 'exact certificate subject fragment'
|
|
npm run dist:win
|
|
```
|
|
|
|
Both installer and portable executable must have a valid Authenticode signature,
|
|
the expected publisher and a timestamp. The build also creates SHA-256 files, a
|
|
CycloneDX SBOM and a provenance document containing commit and build ID.
|
|
|
|
Without `FORGEFLOW_SIGNED_RELEASE=1`, local builds may be unsigned for development
|
|
testing but must never be published as production releases.
|
|
|
|
## Atomic publication
|
|
|
|
`npm run release:binary` keeps the Gitea release in draft state while uploading
|
|
the installer, portable executable, two checksums, provenance and SBOM. It only
|
|
publishes after all six assets are present. A failed upload leaves a draft rather
|
|
than exposing an incomplete updater target.
|
|
|
|
The production Authenticode certificate and legal publisher identity are
|
|
`PENDING_HUMAN_INPUT`; all surrounding build and verification code is complete.
|