[FEATURE] Publish Homebrew-ready macOS release assets

[fettpl]

Feature Description

Publish Homebrew-ready macOS desktop release assets for vLLM Studio, starting with the existing Apple Silicon desktop build target.

This would let an outside contributor submit a proper Homebrew/homebrew-cask PR for a vllm-studio cask once a stable, public, Gatekeeper-compatible artifact is available.

Problem Statement

vLLM Studio appears suitable for a Homebrew cask from a notability and packaging-shape perspective, but the current GitHub Releases cannot be consumed by Homebrew Cask:

• Checked on 2026-06-13: the latest release is v1.48.0, published 2026-06-12 09:33:59 UTC, and it has no attached assets.
• The 10 latest GitHub Releases checked all have 0 assets.
• The repository already has Electron Builder config for arm64 macOS dmg and zip targets.
• package.json and frontend/package.json currently report 0.2.9, while releases are tagged as v1.x, which makes the release/app version relationship ambiguous for a cask.

Without a stable versioned DMG or ZIP, Homebrew cannot calculate a checksum, install the app, run audits, or validate zap paths.

Proposed Solution

Please publish stable macOS desktop artifacts on GitHub Releases with enough consistency for Homebrew Cask:

• Attach a signed and notarized Apple Silicon DMG or ZIP to stable GitHub Releases.
• Keep the asset public, versioned, and downloadable without authentication.
• Align the Git tag, desktop app version, release asset filename, and any update metadata.
• Confirm the canonical app bundle name is vLLM Studio.app.
• Confirm the canonical bundle identifier is org.vllm.studio.desktop.
• Confirm the initial official macOS artifact is Apple Silicon only, so the cask can use depends_on arch: :arm64.
• Document or confirm user-data locations that should be used for later Homebrew zap validation, especially ~/Library/Application Support/vLLM Studio.

Once that exists, I can prepare a Homebrew PR for:

• Token: vllm-studio
• Path: Casks/v/vllm-studio.rb
• Artifact: the stable GitHub Release DMG or ZIP
• livecheck: GitHub releases
• uninstall quit: "org.vllm.studio.desktop"

Alternatives Considered

• Opening a Homebrew issue first: Homebrew generally expects a cask PR once a stable artifact exists, so this would likely be noisy before the release asset blocker is resolved.
• Creating a private tap first: useful for early testing, but it would not solve the official distribution requirement or Homebrew Cask acceptance checks.
• Building from source in Homebrew: not appropriate for a GUI Electron app cask and would shift too much release responsibility to Homebrew users.

Additional Context

Relevant current repo facts:

• Release workflow currently appears to run semantic-release for tags and release notes only.
• Electron Builder config already defines macOS dmg and zip targets for arm64.
• App identity in source points to vLLM Studio and packaged user data under the Electron appData path.
• The repository appears to clear Homebrew's public notability threshold at the time of checking: 1138 stars, 1138 watchers, and 91 forks.

Homebrew-side validation I plan to run after assets exist:

• Download release artifact and calculate sha256.
• Mount/unpack and confirm vLLM Studio.app.
• Confirm architecture with lipo -archs.
• Verify signing/Gatekeeper with codesign and spctl.
• Run brew style --fix vllm-studio.
• Run brew audit --cask --online vllm-studio.
• Run brew audit --cask --new vllm-studio.
• Install via HOMEBREW_NO_INSTALL_FROM_API=1 brew install --cask vllm-studio.
• Launch the app, exercise first-run behavior, uninstall, reinstall, and test brew uninstall --zap --cask vllm-studio.

Disclosure: I used AI assistance to gather repository/release facts and draft this issue; I reviewed the results before submitting.

[fettpl]

cc @0xSero — CODEOWNERS lists you as the default maintainer, so I wanted to route this packaging-readiness request to you.

The short version: I can prepare the Homebrew Cask PR once stable public macOS assets exist, but Homebrew needs a downloadable signed/notarized DMG or ZIP with an app version that matches the release version. Could you confirm whether publishing the existing Apple Silicon desktop artifact to GitHub Releases is the intended path?

[fettpl]

Follow-up split after checking the current release state on 2026-06-20:

• ci(release): publish signed macOS desktop assets #147 tracks publishing signed macOS desktop assets from the release workflow.
• release: align desktop app version with GitHub release tags #148 tracks aligning desktop/package/app metadata versions with GitHub release tags.

Current state:

• Latest checked release is v1.49.1, published 2026-06-18.
• v1.49.1 still has 0 release assets, and the recent releases I checked also have no downloadable assets.
• package.json and frontend/package.json at v1.49.1 still report 0.2.9 while the GitHub tag is v1.49.1.
• Because of those two blockers, a valid Homebrew/homebrew-cask PR still cannot be submitted yet: Homebrew needs a public downloadable DMG/ZIP and a clear cask version that matches the released app.

Once #147 and #148 are resolved, the Homebrew side can move to drafting and validating Casks/v/vllm-studio.rb.

[0xSero]

Status roll-up for the Homebrew chain: #149 (version alignment) is approach-approved and just needs a rebase (CONTRIBUTING.md was consolidated into AGENTS.md, root check script changed); #150 needs rework so missing signing secrets skip the desktop-asset build instead of hard-failing every release, plus stable-named asset copies so releases/latest/download/Local-Studio-arm64.dmg keeps working — details on the PRs. Signing secrets configuration is on me. Once #149→#150 land and a signed/notarized release goes out with matching versions, the cask PR is unblocked.

[fettpl]

@0xSero maintainer follow-up is implemented:

• release: align desktop release versions #149 is rebased, Local Studio-aligned, mergeable, and ready for review.
• ci(release): publish macOS desktop assets #150 now degrades gracefully when signing secrets are absent, keeps semantic-release on Ubuntu, conditionally builds on macOS, and uploads both versioned updater files and stable site download aliases.

The remaining path is owner-controlled: merge #149 then #150, configure signing/notarization secrets, publish the first desktop-enabled release, and validate its signing/Gatekeeper behavior. The Homebrew cask remains correctly blocked only on that real public artifact validation.

[fettpl]

@0xSero current Homebrew-readiness state after v2.0.0: version alignment is confirmed and #149 needs no further change; public arm64 DMG/ZIP/updater assets now exist; #150 is updated in e4364a39 to match the published hyphenated updater names, add the stable ZIP alias, and reject uploads that fail codesign, stapler, or Gatekeeper validation. Remaining blocker: the published v2.0.0 DMG matches GitHub’s checksum and has correct 2.0.0/arm64/bundle metadata, but its app signature is invalid, Gatekeeper reports it unnotarized, and it has no stapled ticket. The stable DMG is identical and the stable ZIP alias is absent. Once replacement artifacts pass signing/notarization and clean-launch checks, we can proceed to the Homebrew cask PR.