fix: sign Codex code-mode host with JIT entitlements (#937) #704
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Plan | |
| # Changesets/action flow, adapted for our bun workspace layout: | |
| # | |
| # 1. A feature PR with `.changeset/*.md` merges to main. | |
| # → changesets/action opens/updates the "chore(release): version | |
| # packages" PR (version bump + CHANGELOG, consuming changeset files). | |
| # | |
| # 2. Maintainer merges that "version packages" PR. | |
| # → changesets/action runs the `publish:` command below, which is | |
| # `bun run release:tag` — a custom script that reads the root | |
| # package.json version and creates a single `v<version>` git tag. | |
| # → Why NOT `changeset tag`: once we added `apps/marketing` to the | |
| # workspace, `@manypkg/get-packages` flips changesets into monorepo | |
| # mode and tags become `<name>@<version>` (e.g. `helmor@0.2.0`), | |
| # which (a) doesn't match publish.yml's `tags: v*` trigger and | |
| # (b) additionally tags `@helmor/marketing@...` which we don't want. | |
| # | |
| # 3. The tag push triggers `publish.yml` for signed/notarized macOS DMGs, | |
| # macOS updater artifacts, and the Windows NSIS installer, which attach | |
| # them to the GitHub Release. | |
| # | |
| # Why PAT instead of GITHUB_TOKEN: GitHub suppresses workflow runs for | |
| # pushes authored by GITHUB_TOKEN (recursion guard). A PAT-authored tag | |
| # push does fire downstream workflows, which is how publish.yml knows to | |
| # build. | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: | |
| - main | |
| concurrency: | |
| group: release-plan-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| env: | |
| CI: true | |
| jobs: | |
| release-plan: | |
| name: Create release PR or publish | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| token: ${{ secrets.HELMOR_RELEASE_PAT }} | |
| - name: Setup JS toolchain | |
| uses: ./.github/actions/setup-js | |
| - name: Verify release config tooling | |
| run: bun run release:verify | |
| - name: Create release PR or tag + release | |
| uses: changesets/action@v1 | |
| with: | |
| version: bun run release:version | |
| publish: bun run release:tag | |
| commit: "chore(release): version packages" | |
| title: "chore(release): version packages" | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.HELMOR_RELEASE_PAT }} |