Repository navigation
Release workflow; check the pinned toolchain against the compile service - #24
Merged
Merged
Conversation
The template-firmware check pins the compile service's toolchain, but nothing noticed if the service moved on: its builds of edited sketches would then differ from the bundled firmware, and the pins would be stale. The compile service now reports its cores and libraries in /health (PinBench/compile-service#7); a new job compares every pinned version with it, on each change and weekly. It passes today, and a wrong pin is reported as drift. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
windows/packaging/installer.iss says it is built by release.yml, and tools/release_metadata.dart writes the appcasts and latest.json the updater polls, but no release workflow existed, so there has never been a release and the download page has nothing to list. On a vX.Y.Z tag it builds the three desktop targets (the same steps as ci.yml's build-desktop), packages a .dmg, the Inno Setup installer and a .tar.gz, writes the updater's files and SHA256SUMS.txt, and drafts a release to publish by hand. Build number X*10000+Y*100+Z, so Sparkle's comparison only goes up. A pull request touching the release machinery runs it as a trial without releasing. Unsigned until there are signing certificates; the release notes say how to open the app meanwhile. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The release trial failed on macOS: "No profiles for 'dev.pinbench.app' were found". The Release target signs automatically with the team's identity, and CODE_SIGNING_ALLOWED=NO as a plain environment variable never reaches xcodebuild; Flutter passes FLUTTER_XCODE_* through as build settings, so those are what turn signing off (here and in ci.yml's build-desktop, which had the same problem but runs only on native changes). An unsigned app does not run on Apple silicon, so the release signs it ad hoc, with the release entitlements less keychain-access-groups, which needs a provisioning profile (an app claiming it without one is killed at launch; it serves the pro edition's sign-in, absent from this build), verifies the signature, and launches it for 15 s. Tried on a Mac first: a universal app, a valid ad hoc signature, running after 15 s. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two commits.
Add the release workflow the updater and installer were built for.
windows/packaging/installer.isssays it's built byrelease.yml, andtools/release_metadata.dartwrites the appcasts andlatest.jsonthe updater polls, but no release workflow existed, so there has never been a release. On avX.Y.Ztag it builds macOS, Windows and Linux (the same steps asci.yml's build-desktop), packages a.dmg, the Inno Setup installer and a.tar.gz, writes the updater's files andSHA256SUMS.txt, and creates a draft release for you to publish. The build number isX*10000+Y*100+Z, so Sparkle's comparison only goes up. This PR runs it as a trial (it touches the workflow): all three builds plus assembly, without releasing. The build is unsigned until there are certificates, and the release notes say how to open it.Check the pinned toolchain against the compile service. The compile service's
/healthnow lists its cores and libraries (PinBench/compile-service#7, deployed). A new job compares every versiontemplate-firmware.ymlpins with it, on each change and weekly. It passes against the live service, and a wrong pin is reported as drift.🤖 Generated with Claude Code