Skip to content

RELEASE_PROCESS.md

Latest commit

 

History

History
78 lines (51 loc) · 3.3 KB

RELEASE_PROCESS.md

File metadata and controls

78 lines (51 loc) · 3.3 KB
Raw

Release Process

OLManager releases are maintainer-owned and source-first until signing/notarization and binary packaging policy is finalized.

Branch flow

  1. Community work merges into development.
  2. Maintainer opens a release PR from development to main.
  3. Release PR verifies versions, changelog, release notes, provenance, and required checks.
  4. After merge to main, maintainer creates a version tag or runs release dispatch.
  5. Release workflow creates source archive artifacts, platform bundles, checksums, and the Tauri updater manifest.

Release PR checklist

  • package.json version is correct.
  • src-tauri/Cargo.toml version is correct.
  • src-tauri/tauri.conf.json version is correct.
  • CHANGELOG.md has a dated release section.
  • Release notes mention unsigned/signed artifact status.
  • Data provenance changes are documented.
  • docs/INHERITED_DOCS_AUDIT.md is complete, or release notes explicitly disclose remaining unaudited inherited docs.
  • Required PR checks frontend-install and rust-check pass.
  • Manual experimental checks have been run and reviewed, or remaining failures are explicitly documented in release notes: frontend-full-experimental and rust-full-experimental.
  • No production Tauri bundle build is required by PR CI.

Version sync

The project version must stay aligned across:

  • package.json
  • src-tauri/Cargo.toml
  • src-tauri/tauri.conf.json

The release workflow verifies these values before producing source artifacts.

Tags

Use semantic version tags with a v prefix, for example:

v0.2.1
v0.3.0

Artifacts

Releases publish source archives, SHA-256 checksums, platform bundles, and latest.json for the Tauri updater endpoint:

https://github.com/OpenLeagueManager/OLManager/releases/latest/download/latest.json

Updater releases require Ed25519 signatures generated by tauri-plugin-updater; unsigned bundles are not valid updater inputs. Installer-level OS signing/notarization is still separate and can be added later when maintainers configure those certificates.

Hotfixes

Hotfixes may branch from main and target main only when the issue cannot wait for normal development promotion. After the hotfix release, back-merge main into development immediately.

Update signing

OLManager uses tauri-plugin-updater with Ed25519 bundle signing to verify update integrity.

Required repository secrets:

  • TAURI_SIGNING_PRIVATE_KEY — the private key generated by tauri signer generate.
  • TAURI_SIGNING_PRIVATE_KEY_PASSWORD — optional password protecting the private key.

The corresponding public key is embedded in src-tauri/tauri.conf.json under plugins.updater.pubkey. The release workflow signs bundles during npm run tauri build, pairs each updater artifact with its .sig, generates latest.json, and uploads it to the GitHub release. If signed updater artifacts are missing, the workflow fails instead of publishing a broken manifest.

Installer signing and notarization placeholders

Potential future secrets for OS-level trust:

  • Apple Developer ID certificate and notarization credentials.
  • Windows code-signing certificate.
  • Linux package signing key.

Do not add real secret names or credentials until maintainers decide the release policy.