gsadmin/pulse
1
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-10-23 12:15:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Run the release signing preflight every Monday

Browse Source 
The nightly release rehearsal dispatched this check until it was switched
off with the release steward on 4 October 2026, so nothing now runs it
before a release. A lapsed Apple developer agreement, a revoked notary key
or an expiring Developer ID certificate would first show up as a failed
release candidate, as it did for v6.4.6-rc.1 on 2 October. A weekly run
finds them first, and the certificate check's 30-day margin leaves weeks
to renew. It builds and publishes nothing.
This commit is contained in:
rcourtman
2026-10-06 13:40:39 +01:00
parent 92d946d057
commit 401c22db1d
2 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/README.md
+4 -4
View File
@@ -154,10 +154,10 @@ nothing; results are in the job log and step summary. Run
it locally (`PULSE_REHEARSAL_ENGINE=podman` on hosts without Docker).
`release-signing-preflight.yml` checks that the macOS release signing path
would work, without building or publishing anything. It runs on manual
dispatch from `main`; the nightly release rehearsal that used to dispatch it
was switched off with the release steward on 4 October 2026. On a `macos-15`
runner it imports
would work, without building or publishing anything. It runs every Monday at
06:23 UTC and on manual dispatch from `main`. The schedule replaces the nightly
release rehearsal that dispatched it until that rehearsal was switched off with
the release steward on 4 October 2026. On a `macos-15` runner it imports
the Developer ID certificate into a throwaway keychain, requires the configured
identity to be valid for code signing and at least 30 days from expiry, signs
and verifies a probe binary with a secure timestamp, and reads the Apple notary
.github/workflows/release-signing-preflight.yml
+8 -4
View File
@@ -3,16 +3,20 @@ name: Release Signing Preflight
# the dispatch answer is lost.
run-name: ${{ format('Release signing preflight (no release build or publication){0}', inputs.request_id && format(' [{0}]', inputs.request_id) || '') }}
# Dispatch this from main to find a lapsed Apple developer agreement, a revoked
# notary key or an expiring Developer ID certificate before a release candidate
# fails on it. The maintainer's nightly release rehearsal (pulse-dev-infra
# This finds a lapsed Apple developer agreement, a revoked notary key or an
# expiring Developer ID certificate before a release candidate fails on it. It
# runs every Monday and can be dispatched from main at any time. The
# maintainer's nightly release rehearsal (pulse-dev-infra
# pulse-maintainer-release-rehearsal) dispatched it until that rehearsal was
# switched off with the release steward on 4 October 2026.
# switched off with the release steward on 4 October 2026. The weekly schedule
# replaces it, and the certificate check's 30-day margin leaves weeks to renew.
# On 2 Oct 2026 v6.4.6-rc.1 failed notarization because the agreement was
# unsigned. This signs only a throwaway probe binary on the runner; it builds,
# notarizes, uploads and publishes nothing. The certificate and notary checks
# are independent, so one run names every broken credential.
on:
schedule:
- cron: '23 6 * * 1'
workflow_dispatch:
inputs:
request_id: