From 531faf1c4f035920527f95ec437ecb048b4df5ac Mon Sep 17 00:00:00 2001 From: Eve Bot Date: Wed, 1 Jul 2026 21:55:30 -0700 Subject: [PATCH] Refresh v3 release handoff status --- docs/desktop-product-plan.md | 13 ++++---- docs/macos-public-release-handoff.md | 48 +++++++++++++++++----------- docs/v3-readiness.md | 47 ++++++++++++++------------- 3 files changed, 59 insertions(+), 49 deletions(-) diff --git a/docs/desktop-product-plan.md b/docs/desktop-product-plan.md index d9ac5c75..4c45a62b 100644 --- a/docs/desktop-product-plan.md +++ b/docs/desktop-product-plan.md @@ -244,9 +244,9 @@ downloads its named `apm-desktop-` artifact set, and runs the same local release acceptance checks against that download. Publish dispatch now carries the accepted dry-run ID into the workflow, and the workflow itself validates that `accepted_run_id` before attaching assets to a GitHub Release. -The remote environment exists now, but public distribution still requires the -desktop workflow to reach the remote default branch, configured environment -secrets, and a first verified workflow run. The first +The remote environment and desktop workflow exist now, but public distribution +still requires configured environment secrets, the release tag to point at the +final release commit, and a first verified workflow run. The first install/update/uninstall/troubleshooting policy is documented in `docs/macos-release-runbook.md`: DMG install, manual app replacement for updates, deleting `/Applications/apm.app` for app uninstall, and preserving @@ -474,10 +474,9 @@ installers. Its helper and rollback gates now carry designed artifact details for `com.apm.pkg-helper` and `service/privileged-install-receipts.json`, and core now has a non-mutating typed receipt-store scaffold for that path while execution stays disabled. -Remaining Phase 21 work centers on publishing the desktop release workflow to -the remote default branch, configuring signed/notarized release credentials, -running the desktop release workflow successfully, and implementing future -runtime execution. +Remaining Phase 21 work centers on configuring signed/notarized release +credentials, retagging the final release commit, running the desktop release +workflow successfully, and implementing future runtime execution. ## v3.0 Non-Goals diff --git a/docs/macos-public-release-handoff.md b/docs/macos-public-release-handoff.md index 3b6c773c..28b4b24a 100644 --- a/docs/macos-public-release-handoff.md +++ b/docs/macos-public-release-handoff.md @@ -6,7 +6,11 @@ already proven locally and what still requires external Apple/GitHub release state. Last local checkpoint: 2026-07-02. Latest evidence JSON generated at -`2026-07-02T04:12:34.277Z`. +`2026-07-02T04:46:13.184Z`. + +Post-merge CI passed on `main` commit +`037b3a1eeb091b5a3c1ccff27ba0168f89158859` in GitHub Actions run +`28566100125`. ## Proven Locally @@ -47,9 +51,11 @@ That command proves: The latest local evidence hashes are: - `apm-0.1.1-macos-app.zip`: - `e0239e946f8380d37e2e073ab75574f8e835183de2bfc9d8e277b27c0caa97b3` + `35ee27c5d7d4dadb2aa8880dcb76f26a0d83638922810db119c9d42123078849` - `apm_0.1.1_aarch64.dmg`: - `f069abe5929f22189a19eb08f876827c5de0e6d24fb5e7fb6fc35b943a668787` + `dd974de8e38ae1db62a6011136b421dca1ed66c45793aa27e0a4c4705020fdce` +- `apm-0.1.1-desktop.sha256`: + `002851bc4b3acd97c7c24bfa610d05e5a93a7b9bfe2f217e7161c190880aca20` Current local preview artifacts: @@ -78,20 +84,23 @@ selection and verification without opening anything. ## Current External Blockers -As of the latest check: - -- GitHub Actions for `andreanjos/apm` sees only `CI` and `Release`; it does not - yet see `.github/workflows/desktop-release.yml` on the remote default branch. -- The `macos-desktop-release` GitHub Environment exists, but its secret - inventory count is `0`. -- The existing `v0.1.1` tag does not point at the current local release commit; - move/recreate the tag after the release commit lands, or pass - `--expected-commit ` only for an intentional older release. When an - explicit expected commit is supplied, the readiness report names both the - expected tag target and the current tag target. -- The local worktree still has uncommitted v3 changes while this handoff is - being prepared; commit or stash them before dispatching the Desktop Release - workflow because the workflow builds the release tag, not local files. +As of the latest post-merge check: + +- GitHub Actions for `andreanjos/apm` sees the merged + `.github/workflows/desktop-release.yml` on the remote default branch. +- The local release worktree check passes with the current ignored preview + artifacts left out of Git. +- The `macos-desktop-release` GitHub Environment exists, but all eight required + signing/notarization secret names are still missing. +- The existing `v0.1.1` tag points at `e11943192307`, not the merged release + foundation commit `037b3a1eeb09`; move/recreate the tag after the final + release commit lands, or pass `--expected-commit ` only for an + intentional older release. When an explicit expected commit is supplied, the + readiness report names both the expected tag target and the current tag + target. +- No completed `publish=false` `Desktop Release` dry run exists yet for + `v0.1.1` at `037b3a1eeb09`, so workflow artifact acceptance fails until the + first signed dry run completes. - Local release acceptance against preview artifacts fails as expected because preview artifacts are not Developer ID signed, not Gatekeeper accepted, and not stapled. @@ -182,8 +191,9 @@ npm run release:macos:github-secrets -- --repo andreanjos/apm --apply npm run verify:v3:local ``` -2. Merge and push `.github/workflows/desktop-release.yml` to the remote default - branch so GitHub Actions can see `Desktop Release`. +2. Confirm `.github/workflows/desktop-release.yml` is visible on the remote + default branch. This is currently proven by the post-merge release status + check. 3. Configure and verify the `macos-desktop-release` secrets: diff --git a/docs/v3-readiness.md b/docs/v3-readiness.md index aa2e9157..c4672ef7 100644 --- a/docs/v3-readiness.md +++ b/docs/v3-readiness.md @@ -8,6 +8,9 @@ done when current files or verification commands prove the behavior exists. Last verified on 2026-07-02: +- GitHub Actions `CI` run `28566100125` passed on merged `main` commit + `037b3a1eeb091b5a3c1ccff27ba0168f89158859`, including Build, Clippy, and + Test. - `cd apps/apm-desktop && npm run verify:v3:local` - `cd apps/apm-desktop && npm run verify:v3:local -- --help` - `cargo test --workspace` @@ -51,13 +54,11 @@ Last verified on 2026-07-02: `andreanjos/apm`, but none of the eight required signing/notarization secret names are configured there yet. - `cd apps/apm-desktop && npm run release:macos:workflow-check` currently fails - because the local worktree has uncommitted v3 changes, GitHub cannot see - `.github/workflows/desktop-release.yml` on the remote default branch yet, the - same eight environment secrets are missing, and the existing `v0.1.1` tag - does not point at the current local release commit. + because the same eight environment secrets are missing and the existing + `v0.1.1` tag does not point at the current merged release foundation commit. - `cd apps/apm-desktop && npm run release:macos:status -- --repo andreanjos/apm --tag v0.1.1` - currently reports local preflight passing, with local worktree cleanliness, - remote workflow visibility, all eight environment secrets, and the stale + currently reports local preflight, local evidence, local worktree, and remote + workflow visibility passing, with all eight environment secrets and the stale `v0.1.1` tag still blocking public release readiness; it also prints concrete next steps for those blockers, including the existing ignored `../../.env.release.local` template when present, an explicit fix step when @@ -99,18 +100,20 @@ Last verified on 2026-07-02: upload/template work, workflow dispatch, or artifact acceptance. The main release gate also accepts `--help` before those preflight/build checks. - `cd apps/apm-desktop && npm run release:macos:workflow-accept -- --repo andreanjos/apm` - currently fails because GitHub cannot see `.github/workflows/desktop-release.yml` - on the remote default branch yet, so no matching Desktop Release run can be - discovered and accepted. + currently fails because no completed `publish=false` `Desktop Release` dry + run exists for `v0.1.1` at the merged release foundation commit, so no + matching same-commit artifact set can be accepted yet. - `node apps/apm-desktop/build-tools/macos-release-acceptance.mjs --version 0.1.1` currently reaches the real local `desktop-release/` inventory/evidence set, but fails as expected because the local preview artifacts are ad-hoc signed, lack Developer ID Application authority/TeamIdentifier, and are not stapled. -- Latest local release evidence was regenerated at `2026-07-02T04:12:34.277Z`: +- Latest local release evidence was regenerated at `2026-07-02T04:46:13.184Z`: `apm-0.1.1-macos-app.zip` SHA-256 - `e0239e946f8380d37e2e073ab75574f8e835183de2bfc9d8e277b27c0caa97b3`, + `35ee27c5d7d4dadb2aa8880dcb76f26a0d83638922810db119c9d42123078849`, `apm_0.1.1_aarch64.dmg` SHA-256 - `f069abe5929f22189a19eb08f876827c5de0e6d24fb5e7fb6fc35b943a668787`. + `dd974de8e38ae1db62a6011136b421dca1ed66c45793aa27e0a4c4705020fdce`, + and `apm-0.1.1-desktop.sha256` SHA-256 + `002851bc4b3acd97c7c24bfa610d05e5a93a7b9bfe2f217e7161c190880aca20`. ## Status Summary @@ -251,8 +254,8 @@ Last verified on 2026-07-02: dry-run/upload/check/status sequence without secret values. The file-writing path uses private permissions and refuses to overwrite an existing local env file. All required environment secrets are still missing, the manual desktop - workflow is not visible on GitHub yet, and the first signed/notarized - workflow run is not yet proven. The release status/workflow checks also + workflow is visible on GitHub, and the first signed/notarized workflow run is + not yet proven. The release status/workflow checks also reject a dirty local worktree and stale release tag before dispatch, because the workflow checks out the tag it is asked to build and cannot include uncommitted local changes. `release:macos:status` now exposes those blockers @@ -285,15 +288,13 @@ Last verified on 2026-07-02: ## Remaining v3.0 Work -1. Merge/push `.github/workflows/desktop-release.yml` so GitHub Actions can see - the manual desktop workflow, fill and source the existing ignored - `../../.env.release.local` template, pass `npm run release:macos:github-secrets`, - apply them with `--apply` so the - remote secret inventory is verified, commit or stash local changes before - dispatch, retag the merged release commit or pass `--expected-commit ` - plus `--allow-dirty` for an intentional old committed release, pass - `npm run release:macos:workflow-check`, run the manual signed/notarized - desktop workflow with `publish=false`, and pass +1. Fill and source the existing ignored `../../.env.release.local` template, + pass `npm run release:macos:github-secrets`, apply them with `--apply` so + the remote secret inventory is verified, keep the local release worktree + clean before dispatch, retag the final merged release commit or pass + `--expected-commit ` plus `--allow-dirty` for an intentional old + committed release, pass `npm run release:macos:workflow-check`, run the + manual signed/notarized desktop workflow with `publish=false`, and pass `npm run release:macos:workflow-accept` against the completed same-commit matching run before dispatching `publish=true` with `--accepted-run-id` or the workflow `accepted_run_id` input.