[GH-ISSUE #17] Automate verified DMG packaging and draft release preparation #16

New Issue

2026-10-23T18:09:17+02:00

jayanezj commented

2026-10-23 18:09:17 +02:00

Originally created by @jayanezj on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/jayanezj/traccar-client-macos/issues/17

Goal

Reuse validated local packaging in a separate GitHub Actions workflow that prepares reviewable release candidates without publishing automatically.

Scope

Reuse the build/sign/package verification commands from PROTO-016 rather than maintaining independent packaging logic.
Trigger release preparation from versioned tags and support an explicit candidate validation run. Check tag/app version consistency and build the exact candidate commit with a recorded toolchain.
Run the applicable build/test gates on the candidate commit before creating release assets; do not infer success from a previous green run on another commit.
Verify arm64 architecture, minimum OS, bundle/product identity and ad hoc app signature. Generate the DMG and SHA-256 checksum and attach them with English release notes to a draft release.
Keep normal CI read-only; grant release write access only to the trusted draft-creation job. Use no paid Apple credentials, notarization, personal token or Bitwarden signing key.
Make retries safe: do not overwrite a published version or duplicate a draft blindly. Document manual review, publication and manual DMG upgrade procedures. Automatic application updates remain post-MVP.

Acceptance criteria

A failed test, signature/architecture check or version mismatch prevents draft preparation.
Candidate artifacts identify their exact commit and toolchain and pass the same checks as local packages.
A dry validation path creates artifacts without creating a release or publishing anything.
After separate authorization, the draft path is demonstrated; the release remains unpublished for maintainer review.
Documentation distinguishes development artifacts, draft releases and public releases. Intermediate milestones do not require tags or releases.

Validation

First validate reusable commands locally. Validate hosted execution and draft creation only after the repository and those actions are authorized. Record unavailable remote evidence as pending; writing a workflow is not evidence that it ran. Public release publication is a later explicit maintainer action.

Dependencies

Originally created by @jayanezj on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/jayanezj/traccar-client-macos/issues/17 ## Goal Reuse validated local packaging in a separate GitHub Actions workflow that prepares reviewable release candidates without publishing automatically. ## Scope - Reuse the build/sign/package verification commands from [PROTO-016](https://github.com/jayanezj/traccar-client-macos/issues/16) rather than maintaining independent packaging logic. - Trigger release preparation from versioned tags and support an explicit candidate validation run. Check tag/app version consistency and build the exact candidate commit with a recorded toolchain. - Run the applicable build/test gates on the candidate commit before creating release assets; do not infer success from a previous green run on another commit. - Verify arm64 architecture, minimum OS, bundle/product identity and ad hoc app signature. Generate the DMG and SHA-256 checksum and attach them with English release notes to a draft release. - Keep normal CI read-only; grant release write access only to the trusted draft-creation job. Use no paid Apple credentials, notarization, personal token or Bitwarden signing key. - Make retries safe: do not overwrite a published version or duplicate a draft blindly. Document manual review, publication and manual DMG upgrade procedures. Automatic application updates remain post-MVP. ## Acceptance criteria - [ ] A failed test, signature/architecture check or version mismatch prevents draft preparation. - [ ] Candidate artifacts identify their exact commit and toolchain and pass the same checks as local packages. - [ ] A dry validation path creates artifacts without creating a release or publishing anything. - [ ] After separate authorization, the draft path is demonstrated; the release remains unpublished for maintainer review. - [ ] Documentation distinguishes development artifacts, draft releases and public releases. Intermediate milestones do not require tags or releases. ## Validation First validate reusable commands locally. Validate hosted execution and draft creation only after the repository and those actions are authorized. Record unavailable remote evidence as pending; writing a workflow is not evidence that it ran. Public release publication is a later explicit maintainer action. ## Dependencies - [PROTO-002](https://github.com/jayanezj/traccar-client-macos/issues/2) - [PROTO-016](https://github.com/jayanezj/traccar-client-macos/issues/16)

jayanezj added this to the M5 - Distribution and MVP acceptance milestone 2026-10-23 18:09:17 +02:00

jayanezj added the area:ci priority:high type:task labels 2026-10-23 18:09:17 +02:00

jayanezj referenced this issue

2026-10-23 18:09:17 +02:00

[GH-ISSUE #16] Package an ad hoc signed DMG and validate installation and upgrades #18

jayanezj referenced this issue

2026-10-25 11:00:18 +01:00

[GH-ISSUE #3] Implement initial configuration and local identity persistence #2

jayanezj referenced this issue

2026-10-25 11:00:20 +01:00

[PR #24] [MERGED] Persist receiver configuration and device identity #24

jayanezj added type:task and removed type:task labels 2026-10-30 18:01:12 +01:00