Skip to content

Commit d35e042

Browse files
subhasisbiswal012claude
subhasisbiswal012
and
claude
authored
feat(web): Vitreous download page + release/signing pipeline (#34)
* feat(web): download page — deep-research, 3 mockups, ASCII×liquid-glass site Adds the GitHub Pages download page work on the "balanced fusion" direction (Apple liquid glass + ASCII/dither terminal text-art). - docs/web/deep-research-webpage-design.md: exhaustive Firecrawl design research (14 query sets / 70 sources) + 3 design directions. - docs/web/mockups/: index chooser + direction-a/b/c.html + shared ascii.js (procedural ASCII-eye + Bayer-dither engine). - site/: real page on Direction B "Glass × Phosphor" (amber) — hero with the Eye-of-Horus brand mark baked to static ASCII, typed boot sequence, scrolling value ticker, interactive app showcase (7 themes × 6 real app screenshots, swappable by tab + theme swatch), feature cards, how-it-works, download band, footer. Respects reduced-motion + reduced-transparency. Pending (next): bigger + blinking hero eye, beam-wave Home videos per theme, publish first GitHub Release (wire download CTA) + enable Pages. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat(web): bigger, longer hero eye with natural converging blink Enlarge the hero Eye-of-Horus and stretch it into a wider almond (transform scale(1.5,1.18); font 7->8.6px). Add a blink: derive lid frames from the open ASCII by blanking eye-bulb rows so both lids converge to a center slit, then cycle them (static under prefers-reduced-motion). Horus tail stays put throughout. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat(web): live beam-wave videos in the app showcase (per theme) Home tab now plays the app's animated liquid-glass beam instead of a still — one seamless loop per theme. Captured by driving the packaged app over CDP at 1100x720 and scrubbing the beam CSS animations via the Web Animations API so each layer completes exactly one cycle per clip (frame 0 = loop point), then encoded to mp4 + webm. Showcase swaps the video src by theme; other tabs keep their stills; prefers-reduced-motion falls back to the Home still. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(web): slow showcase beam videos to match real app speed The loops played ~3.6x too fast (one full drift cycle in 5s). Recapture at 216 frames and encode at 12fps so each loop runs 18s — the beam layer's true CSS period — so the motion matches the live app. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat(web): ASCII water-wave band + showcase theme-name label Add an animated ASCII water band between the hero eye and the ticker: drifting ripple lines with twinkling glints on the crests (static under prefers-reduced-motion). Show the active theme's name beside the showcase swatches, with hover preview. Also use the public email on the footer (not the professional one). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * ci: add Windows installer build workflow + SignPath signing guide Add GitHub Actions workflow that builds the NSIS installer on a clean windows runner (the prerequisite for SignPath Foundation, which signs CI-built artifacts). Uploads the installer + auto-update metadata as an artifact; signing + release publishing are scaffolded in comments to finalize once SignPath approves the project. Document the full flow and the maintainer/owner steps in docs/signing-signpath.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat(web): add privacy policy page (no data collected) Local-first app collects no data; add an on-brand privacy.html stating this plainly (for the SignPath application's Privacy Policy URL and general transparency) and link it from the footer. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * ci: deploy download page to GitHub Pages from site/ on push to main Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
1 parent 4451fd7 commit d35e042

70 files changed

Lines changed: 1978 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/pages.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Deploy download page to GitHub Pages
2+
3+
# Publishes the static site in site/ to GitHub Pages on every push to main.
4+
# Repo Pages source must be set to "GitHub Actions" (configured once).
5+
6+
on:
7+
push:
8+
branches: [main]
9+
paths:
10+
- 'site/**'
11+
- '.github/workflows/pages.yml'
12+
workflow_dispatch:
13+
14+
permissions:
15+
contents: read
16+
pages: write
17+
id-token: write
18+
19+
concurrency:
20+
group: pages
21+
cancel-in-progress: true
22+
23+
jobs:
24+
deploy:
25+
runs-on: ubuntu-latest
26+
environment:
27+
name: github-pages
28+
url: ${{ steps.deployment.outputs.page_url }}
29+
steps:
30+
- uses: actions/checkout@v4
31+
- uses: actions/configure-pages@v5
32+
- uses: actions/upload-pages-artifact@v3
33+
with:
34+
path: site
35+
- id: deployment
36+
uses: actions/deploy-pages@v4

‎.github/workflows/release.yml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
name: Build Windows installer
2+
3+
# Builds the NSIS installer in CI on a clean runner. This is the prerequisite
4+
# for SignPath Foundation signing: SignPath signs artifacts produced by a
5+
# trusted CI, so the release build must run here (not on a dev machine).
6+
#
7+
# Triggers:
8+
# - workflow_dispatch: build on demand (Actions tab → Run workflow)
9+
# - push tag v*: build for a release (e.g. git tag v0.1.0 && git push --tags)
10+
#
11+
# Today this produces an UNSIGNED installer + auto-update metadata as a workflow
12+
# artifact. Signing + release publishing are added once SignPath approves the
13+
# project — see docs/signing-signpath.md.
14+
15+
on:
16+
workflow_dispatch:
17+
push:
18+
tags: ['v*']
19+
20+
permissions:
21+
contents: read
22+
23+
jobs:
24+
build:
25+
runs-on: windows-latest
26+
steps:
27+
- uses: actions/checkout@v4
28+
29+
- uses: actions/setup-node@v4
30+
with:
31+
node-version: '20'
32+
cache: 'npm'
33+
34+
- name: Install dependencies
35+
run: npm ci
36+
37+
- name: Build renderer/main (electron-vite)
38+
run: npx electron-vite build
39+
40+
- name: Package installer (electron-builder, unsigned, no publish)
41+
run: npx electron-builder --win --x64 --publish never
42+
43+
- name: Upload installer + update metadata
44+
uses: actions/upload-artifact@v4
45+
with:
46+
name: vitreous-windows-installer
47+
path: |
48+
release/*.exe
49+
release/latest.yml
50+
release/*.blockmap
51+
if-no-files-found: error
52+
53+
# ---------------------------------------------------------------------------
54+
# SIGNING (added after SignPath Foundation approval — see docs/signing-signpath.md)
55+
#
56+
# SignPath signs the artifact produced above, then we regenerate latest.yml +
57+
# .blockmap so electron-updater's hash matches the SIGNED installer (otherwise
58+
# auto-update breaks). Sketch of the additional job:
59+
#
60+
# sign:
61+
# needs: build
62+
# runs-on: ubuntu-latest
63+
# if: ${{ vars.SIGNPATH_ENABLED == 'true' }} # repo Variable, flip on when ready
64+
# steps:
65+
# - uses: actions/checkout@v4
66+
# - uses: signpath/github-action-submit-signing-request@v1
67+
# with:
68+
# api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
69+
# organization-id: ${{ vars.SIGNPATH_ORG_ID }}
70+
# project-slug: vitreous
71+
# signing-policy-slug: release-signing
72+
# github-artifact-id: ${{ needs.build.outputs.artifact-id }}
73+
# wait-for-completion: true
74+
# output-artifact-directory: signed/
75+
# - run: node scripts/update-release-metadata.mjs signed/ # patch latest.yml + blockmap
76+
# - # then attach signed exe + latest.yml + blockmap to the GitHub Release
77+
# ---------------------------------------------------------------------------

‎docs/signing-signpath.md‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# Code signing — SignPath Foundation (free OV for OSS)
2+
3+
Vitreous ships **unsigned** today, so Windows SmartScreen shows a one-time
4+
*"More info → Run anyway"* on first run. To remove that, we sign the installer
5+
with the **[SignPath Foundation](https://signpath.org/)** certificate — free for
6+
qualifying open-source projects. Publisher then reads **"SignPath Foundation"**.
7+
8+
## How it works (important)
9+
10+
SignPath is **not a `.pfx` you install locally.** It signs artifacts that were
11+
**built in a trusted CI**. The flow:
12+
13+
1. GitHub Actions builds the unsigned installer (`.github/workflows/release.yml`).
14+
2. The workflow submits the `.exe` to SignPath's cloud.
15+
3. SignPath signs it with the Foundation certificate and returns the signed file.
16+
4. We **regenerate `latest.yml` + `.blockmap`** so electron-updater's hash matches
17+
the *signed* installer (skipping this silently breaks auto-update).
18+
5. The signed installer + metadata are attached to the GitHub Release.
19+
20+
It's an **OV** certificate (not EV), so SmartScreen still builds reputation over
21+
the first downloads — but a signed build clears the warning far faster than
22+
unsigned, and identifies the publisher.
23+
24+
## Eligibility — where we stand
25+
26+
| Requirement | Status |
27+
|---|---|
28+
| Public GitHub repo | ✅ `subhasisbiswal012/Vitreous` |
29+
| OSI-approved license | ✅ MIT |
30+
| Built by a supported CI | ✅ GitHub Actions workflow added |
31+
| SignPath Foundation application approved | ⬜ **you must apply** |
32+
33+
> Note: SignPath Foundation reviews each project for legitimacy/relevance. A brand-new
34+
> project may be asked to show it's real and distributed — having this repo public, the
35+
> download page live, and a first (even unsigned) release available strengthens the
36+
> application. If they decline pre-release, publish one unsigned `0.1.0` first, then apply.
37+
38+
## What YOU need to do (one-time)
39+
40+
1. Go to **https://signpath.org/apply** and submit Vitreous (GitHub URL, MIT license).
41+
Use the **public email** `subhasis.biswal.hustle@gmail.com`.
42+
2. After approval, in the SignPath console:
43+
- Note your **Organization ID**.
44+
- Create a **Project** (slug `vitreous`) connected to the GitHub repo.
45+
- Create a **Signing Policy** (slug e.g. `release-signing`) using the Foundation cert.
46+
- Generate a **CI user API token**.
47+
3. In the GitHub repo → **Settings → Secrets and variables → Actions**, add:
48+
- Secret `SIGNPATH_API_TOKEN` = the API token.
49+
- Variable `SIGNPATH_ORG_ID` = your Organization ID.
50+
- Variable `SIGNPATH_ENABLED` = `true` (turns the signing job on).
51+
4. Tell me when that's done — I'll un-comment and finalize the `sign` job in
52+
`release.yml` (the scaffold is already there), wire the metadata regeneration
53+
script, and switch publishing to attach the **signed** artifacts.
54+
55+
## What the CI does (maintainer side, mostly done)
56+
57+
- `release.yml` builds the unsigned installer + `latest.yml` + `.blockmap` and
58+
uploads them as a workflow artifact (working now — testable via **Run workflow**).
59+
- The `sign` job (commented scaffold in `release.yml`) submits to SignPath, then a
60+
`scripts/update-release-metadata.mjs` step recomputes the sha512/size in
61+
`latest.yml` and regenerates the blockmap for the signed `.exe` before release.
62+
63+
## Status
64+
65+
- ✅ CI build workflow added (`.github/workflows/release.yml`).
66+
- ⬜ SignPath Foundation application (you) → secrets/variables → finalize `sign` job.
67+
- ⬜ Then: publish the first **signed** Release + point the download page CTA at it.

0 commit comments

Comments
 (0)