Repository navigation
Add tag-driven release workflow producing AOT binaries - #55
Merged
Merged
Conversation
Triggered by `v*` tag (or workflow_dispatch with an existing tag). Matrix builds AOT single-file binaries on native runners for the six supported RIDs, tarballs/zips them with a .sha256 sidecar, and uploads to a draft GitHub Release. macOS signing + notarization auto-enable when APPLE_* secrets are present; without them the macOS tarballs ship unsigned (Gatekeeper quarantine on download). Required secrets are documented in AGENTS.md. Blocks #41 (Homebrew tap), #43 (Windows), #44 (Linux) — they all consume the artifacts this workflow produces. Closes #45
So we can validate the matrix build / tarball / sha256 / artifact upload on this PR before merging. Skips the release job and macOS sign/notarize/spctl steps on PR runs. Remove this trigger before merge.
Apple's last Intel Mac shipped in 2020 and recent macOS releases drop support for the older Intel models. The osx-x64 publish was also hanging on macos-13 runners. Apple Silicon only going forward.
- Remove the temporary pull_request trigger from release.yml now that the matrix is verified green on PR #55. - Bump checkout v4→v6, setup-dotnet v4→v5, upload-artifact v4→v7, download-artifact v4→v8 in release.yml; same checkout/setup-dotnet bumps in ci.yml. Clears the Node.js 20 deprecation annotation (forced to Node 24 from 2026-06-16).
jamescrosswell
marked this pull request as ready for review
May 31, 2026 03:13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/release.ymltriggered byv*tag push (orworkflow_dispatchagainst an existing tag). Matrix builds AOT single-file binaries on native runners for all six RIDs (osx-arm64,osx-x64,linux-x64,linux-arm64,win-x64,win-arm64), archives +.sha256s each, and uploads them to a draft GitHub Release for manual review/publish.APPLE_CERT_BASE64/APPLE_CERT_PASSWORD/APPLE_SIGNING_IDENTITY— Developer ID Application.p12+ identity forcodesign.APPLE_ID/APPLE_TEAM_ID/APPLE_APP_PASSWORD—notarytool submitcredentials (app-specific password from appleid.apple.com).Notes
ubuntu-24.04-arm/windows-11-armrunners — native AOT, no cross-compile.gh release create … --draftso each tag produces a draft release you publish manually after sanity-checking the artifacts.Closes #45. Unblocks #41 (Homebrew tap), #43 (Windows distribution), #44 (Linux distribution).
🤖 Generated with Claude Code