From 75be90d5e8ceea7a32803e31a25c6cfbaf904b3e Mon Sep 17 00:00:00 2001 From: Pedro Ivo Date: Sat, 8 Aug 2026 18:42:02 -0300 Subject: [PATCH] chore(release): prepare v0.15.9 --- AGENTS.md | 12 ++++++++++++ package.json | 2 +- 2 files changed, 13 insertions(+), 1 deletion(-) create mode 100644 AGENTS.md diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000000..2e9e574e71 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,12 @@ +# Repository instructions + +## Desktop release signing + +Every desktop CLI release must be signed with Minisign by the `release` GitHub Actions environment. The release workflow must read these environment secrets: + +- `VERBOO_DESKTOP_MINISIGN_SECRET_KEY_B64`: the complete Minisign secret-key file encoded as single-line base64. +- `VERBOO_DESKTOP_MINISIGN_PUBLIC_KEY`: the complete two-line Minisign public-key file. + +Before publishing a version, confirm that both secret names exist in the `release` environment and that the desktop signing job is enabled. A missing signing configuration must fail the release; never publish unsigned desktop CLI update assets. + +Never print, log, commit, upload as an artifact, or send the private key or its base64 value. Do not rotate or replace the signing pair as part of a routine release. Follow `docs/desktop-cli-distribution.md` for publishing, verification, rotation, and compromise handling. diff --git a/package.json b/package.json index f43d6d5d53..29c528e7b1 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@verboo/code", - "version": "0.15.8", + "version": "0.15.9", "description": "Verboo Code — coding agent for the Verboo platform", "type": "module", "bin": {