2.2 KiB
Releasing ForgeFlow
ForgeFlow releases are built only from a clean, reviewed commit on Node 22 LTS.
Quality gate
npm ci
npm run quality
npm audit --omit=dev --audit-level=high
Windows build — no paid services required
ForgeFlow is a personal/internal tool. The supported release path therefore has no certificate, Azure or other paid-service dependency:
npm run dist:win
Run npm run signing:setup once on the release workstation. It stores the
private Ed25519 key outside the repository and writes only its public key into
the packaged app. npm run dist:win then produces the installer and portable
executable, SHA-256 sidecars, CycloneDX SBOM, provenance and an Ed25519-signed
manifest bound to the exact source commit. The updater verifies the pinned
publisher key before trusting the artifact digest and verifies that digest again
immediately before replacing the installed executable.
Windows can display an Unknown publisher warning for an unsigned installer.
That warning concerns public publisher reputation; it does not prevent ForgeFlow
from installing or using its checksum-verified in-app updates. Authenticode can
be added later as an optional distribution convenience, but is not required for
correct operation.
Atomic publication
npm run release:binary keeps the Gitea release in draft state while uploading
the installer, portable executable, two checksums, provenance, SBOM, signed
manifest and signature. It only publishes after all eight assets are present. A
failed upload leaves a draft rather than exposing an incomplete updater target.
The optional signing acceptance fixture can still validate the complete local Authenticode chain without purchasing or retaining a certificate:
npm run test:signing
This disposable fixture signs installer, portable, update-helper and uninstaller stand-ins, requires an RFC 3161 timestamp, and proves rejection of a missing timestamp, wrong publisher and a modified binary. Its certificate is removed from the current-user certificate store after the test.
The disposable test certificate is removed from the current-user certificate store after the test and is never used for a published build.