Tag triggers the release workflow (workflows/release.yml):
git tag v1.2.0
git push --tags
- CI gate (lint, types, test) runs on Ubuntu first
- Build runs on
macos-14(arm64), publishes to GitHub Releases as draft - Publish the draft via
gh release edit vX.Y.Z --draft=false - Tag must be
vX.Y.Z(semver withvprefix). Version injected from tag automatically.
- Provider: GitHub Releases (
config/nativephp.phpdefaults togithub) repo/ownerdefaults hardcoded in config becausecleanup_env_keysstripsGITHUB_*from bundled.env- electron-updater reads
latest-mac.ymlfrom the latest published (non-draft) release - Auto-update uses the
.zipartifact;.dmgis for manual download
Add these secrets to enable signing and notarization:
CSC_LINK- base64-encoded Developer ID.p12certificateCSC_KEY_PASSWORD- certificate passwordNATIVEPHP_APPLE_ID- Apple ID emailNATIVEPHP_APPLE_ID_PASS- app-specific passwordNATIVEPHP_APPLE_TEAM_ID- Apple Developer Team ID
notarize.js already handles notarization when these are present. Pass them as env: in the build step.