[amondnet]

Summary

openhwp shipped v0.1.0 with no downloadable artifact. deno desktop had only ever been run locally, so there was nothing for users to install and nothing a Homebrew cask could point at. This adds the packaging pipeline and wires up distribution.

Triggered by the GitHub Release that release-please publishes. That event only fires because release-please now runs with an app token (#16) — under GITHUB_TOKEN it would not have, so this is a direct dependency on that fix.

Job	Does
build-macos	matrix build (arm64 + x86_64), sign, notarize, staple, upload artifact
release-assets	checksums → SHA256SUMS, attach all assets to the release
update-homebrew-cask	rewrite Casks/openhwp.rb in pleaseai/homebrew-tap
publish-jsr	namespace reservation — gated off, see below

Signing is simpler than expected

deno desktop signs macOS bundles itself. With desktop.macos.codesignIdentity set it signs the app including the CEF framework and its five helper apps, and applies Hardened Runtime plus a secure timestamp.

I verified this against a real local build rather than trusting the docs — helper identifiers come out correctly derived (dev.pleaseai.openhwp.helper, dev.pleaseai.openhwp.helper.gpu), so no hand-rolled inside-out codesign pass is needed. Only notarization is manual (notarytool + stapler).

The identity is injected in CI, not committed: with codesignIdentity in deno.json, any contributor without the certificate would fail to build.

Two build details worth knowing

• No universal-binary flag. arm64 and x86_64 build on separate runners (macos-14, macos-15-intel) and the cask carries both.
• CFBundleName follows the --output filename. I hit this locally: -o OpenHWP-probe.app produced an app literally named "OpenHWP-probe". So builds go to a per-arch directory and are renamed after, keeping the app named OpenHWP.

Signing degrades honestly rather than silently: with no certificate the build warns and produces an ad-hoc bundle, and the verify step fails if a certificate was supplied but the output is still ad-hoc.

Required before this can produce a distributable build

Secrets/variables on the repo or org:

Name	Kind
APPLE_CERTIFICATE_P12_BASE64, APPLE_CERTIFICATE_PASSWORD	secrets
APPLE_SIGNING_IDENTITY	variable — e.g. Developer ID Application: … (TEAMID)
APPLE_API_KEY_ID, APPLE_API_ISSUER_ID, APPLE_API_KEY_P8_BASE64	secrets (App Store Connect key for notarytool)

APP_ID and PRIVATE_KEY (tap token) already resolve for this repo.

JSR is deliberately gated off

jsr.io/@openhwp currently 404s, and the package would not be runnable anyway: apps/desktop is the shell entrypoint, and the studio bundle it requires is gitignored and therefore absent from the package — deno run jsr:@openhwp/desktop would exit with "studio bundle not found".

So the job is documented as namespace reservation and stays disabled behind JSR_PUBLISH_ENABLED. Create the scope, link this repo for OIDC, then set the variable. Shipping it ungated would fail every release.

Verification

• Workflow YAML parses; job graph and permissions checked per job.
• All six actions pinned to full 40-char SHAs (OSS policy).
• Cask reference copy passes ruby -c.
• deno fmt --check / deno lint pass.
• Local deno desktop build confirmed the bundle layout, ad-hoc signature, CEF framework + 5 helpers, and identifier derivation.
• Not verifiable pre-merge: the workflow only runs on release: published. workflow_dispatch with a tag is provided for a dry run against an existing release.

Checklist

• PR title follows Conventional Commits
• Tests added or updated — n/a, CI/packaging config
• Lint/format pass
• Documentation updated — rationale in the workflow header; cask copy under packaging/homebrew/
• No breaking change

---

Summary by cubic

Build and ship signed, notarized macOS installers on every published release, then update the Homebrew cask so users can install via downloads or brew install pleaseai/tap/openhwp. Runs after release-please creates a GitHub Release (enabled by the app-token fix in #16).

• New Features

  • Release workflow builds OpenHWP.dmg for darwin-arm64 and darwin-x64, verifies the .app signature, signs the .dmg with a timestamp, notarizes via notarytool, staples, uploads, and SHA256SUMS; hard-fails if signing or notary credentials are missing.
  • Attaches artifacts to the GitHub Release and rewrites pleaseai/homebrew-tap Casks/openhwp.rb with version and per-arch checksums; cask template passes brew audit (drops verified: on the url).
  • Adds gated JSR publish step (namespace reservation only) behind JSR_PUBLISH_ENABLED.

• Migration

  • Add secrets: APPLE_CERTIFICATE_P12_BASE64, APPLE_CERTIFICATE_PASSWORD, APPLE_API_KEY_ID, APPLE_API_ISSUER_ID, APPLE_API_KEY_P8_BASE64.
  • Add variable: APPLE_SIGNING_IDENTITY (e.g., Developer ID string).

^{Written for commit 6072a8e. Summary will update on new commits.}

[gemini-code-assist]

Code Review

This pull request adds a new Homebrew cask configuration file (openhwp.rb) for the OpenHWP desktop editor. The review feedback suggests two improvements: removing a relative directional reference ("below") in the comments to prevent future dangling references, and removing the redundant verified parameter from the url stanza since the download URL host matches the homepage host.

[greptile-apps]

Greptile Summary

The PR adds an automated macOS release pipeline.

• Builds architecture-specific signed and notarized disk images.
• Uploads release assets and checksums.
• Updates the Homebrew tap cask.
• Adds a disabled-by-default JSR publishing job and a reference cask template.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the workflow now exits before building or publishing when the signing certificate is absent.

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Adds fail-closed signing, notarization, release-asset upload, Homebrew cask updating, and gated JSR publishing; the previously reported unsigned-publication path is closed by rejecting absent signing credentials.
packaging/homebrew/openhwp.rb	Adds a reviewable reference copy of the generated architecture-aware Homebrew cask.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Release published or manual dispatch] --> B[Build arm64]
  A --> C[Build x86_64]
  B --> D[Sign and notarize DMG]
  C --> D
  D --> E[Upload artifacts and checksums]
  E --> F[Update Homebrew cask]
  E --> G{JSR publishing enabled?}
  G -->|Yes| H[Publish namespace package]
  G -->|No| I[Skip JSR publishing]

Loading

_{Reviews (3): Last reviewed commit: "fix(release): fail the build when signin..." | Re-trigger Greptile}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud