Files
dohooo__helmor/docs/release-secrets.md
Caspian 東澔 beeccae6c2 docs(windows): document Windows x64 support (#761)
* docs(windows): document Windows x64 support and gate Slack desktop import to macOS

- Update README, CLI/MCP, release, and secrets docs to cover the Windows
  x64 NSIS installer alongside the existing macOS DMG flow.
- Refresh CI workflow header comments to reference windows.yml /
  windows-release.yml instead of the old "macOS-only" notes.
- Marketing site: add Windows x64 download entry + asset picker, make the
  primary button download Apple Silicon directly.
- Gate Slack desktop import to macOS via isMac(); show a Windows-not-wired
  message and disable the button off-platform.

* ci(windows): drop tag-triggered NSIS release workflow

Remove windows-release.yml — the tag-triggered Windows NSIS release
publishing isn't working yet. The Windows x64 installer is still built
and validated on every PR/push by windows.yml (uploaded as a workflow
artifact); there is simply no automated GitHub Release publishing for
Windows for now.

Update the comments/docs that referenced windows-release.yml
(build.yml, publish.yml, release-plan.yml, local-release.md,
release-secrets.md) to describe the CI-artifact-only state instead of a
dangling workflow.
2026-06-08 23:50:35 -07:00

1.8 KiB

Release Secrets

Configure these GitHub repository secrets before running the macOS release workflow.

Required for release creation

  • GITHUB_TOKEN
    • Provided automatically by GitHub Actions
    • Must have contents: write permission in the workflow

Required for Tauri updater signing

  • TAURI_SIGNING_PRIVATE_KEY
    • Contents of your Tauri updater private key
  • TAURI_SIGNING_PRIVATE_KEY_PASSWORD
    • Password used when generating the updater private key
  • HELMOR_UPDATER_PUBKEY
    • Public key embedded into the app at build time
  • HELMOR_UPDATER_ENDPOINTS
    • Comma-separated updater endpoint list
    • Stable-only default:
      • https://github.com/dohooo/helmor/releases/latest/download/latest.json

macOS release publication uses the official tauri-action. It uploads the signed updater bundle and generates the latest.json manifest consumed by Helmor's updater.

Required for macOS signing and notarization

  • APPLE_CERTIFICATE
    • Base64-encoded .p12 export of your Developer ID Application certificate
  • APPLE_CERTIFICATE_PASSWORD
    • Password used when exporting the .p12
  • APPLE_SIGNING_IDENTITY
    • Example: Developer ID Application: Your Name (TEAMID)
  • APPLE_ID
    • Apple Developer account email
  • APPLE_PASSWORD
    • App-specific password used for notarization
  • APPLE_TEAM_ID
    • Apple Developer Team ID

Local-only files created during setup

The repository now uses ignored *.local files for local release setup:

  • tauri-updater-private-key.local
  • tauri-updater-private-key.local.pub
  • tauri-updater-password.local

The macOS release flow imports the Developer ID Application certificate into a temporary keychain before the build starts so nested vendor binaries can be re-signed consistently both locally and on GitHub Actions.

Keep the private key and password out of source control and back them up securely.