mirror of
https://github.com/Ark0N/Codeman.git
synced 2026-11-14 02:29:33 +01:00
Codeman maintainer
ea23445ad7
A dispatch with -f tag=<any tag> built that tag, and sign then ran the tag's sign-macos.sh with the Developer ID key unlocked and the notary login in its environment. Nothing checked the tag: xterm-zerolag-input@0.1.7 would have put Codeman.dmg on that package's release, and a tag on a commit that never reached master would have run unreviewed scripts with the secrets. build and sign now each check their own checkout before anything else runs: the tag must read codeman@x.y.z (or aicodeman@x.y.z, which a failed rename leaves) and GitHub's compare of master with the checked-out commit must say behind or identical. The check is inline, since a script from the checkout would be the tag's own code. Release's own call (a push, not a dispatch) and the branch dry run are unchanged. The header says why a master-only Environment would not close this path, and release.yml's macos-app job now says that any permission a called job asks for must be granted there too, or Release fails at startup. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>