| name | release |
| description | Cut and publish a Blurt release (build, sign, notarize, staple, DMG, GitHub). Use when the user asks to ship/release a new version. User-invoked only — it has real side effects (notarization, git tags, GitHub release). |
| disable-model-invocation | true |
Releasing Blurt
The release pipeline lives in scripts/. Run it from the repo root. Confirm
the target version with the user before publishing — publishing is hard to undo.
Preconditions (verify first)
- Clean working tree on an up-to-date
main (releases ship from main).
- Notary profile
blurt-notary is stored in the dedicated signing keychain
(xcrun notarytool store-credentials blurt-notary --keychain ~/Library/Keychains/blurt-signing.keychain-db …).
The build pins every notary call to that keychain, so a profile stored only in
login (or an incidental keychain like electron-builder's) will not be found.
- Developer ID signing identity present in the keychain.
Steps
- Bump the version —
scripts/release-bump.sh updates the marketing version
and build number in App/Blurt/project.yml, regenerates the project, and
opens a PR (versions land on main via PR — main is branch-protected).
- Build + sign + notarize —
scripts/release-build.sh does the whole Apple
path: xcodebuild Release → sign nested code including any embedded
frameworks (each must get --options runtime --timestamp, or notarization
rejects it) → notarize → staple → DMG → verify.
- Publish —
scripts/release-publish.sh creates the GitHub release and
uploads Blurt.dmg (the README's download link points at
releases/latest/download/Blurt.dmg).
scripts/release.sh orchestrates the above end-to-end; prefer it unless
debugging a single stage.
Guardrails / gotchas
- Run
scripts/check.sh green before releasing — same gate as CI.
- Notarization rejects any nested mach-o/framework lacking a secure
timestamp; the build re-signs frameworks for this reason — don't remove that.
- After a release, verify the DMG mounts and the app is stapled
(
xcrun stapler validate).
- The post-build install step copies to
/Applications (TCC needs a stable path);
don't redirect it to DerivedData//tmp.
Read the script you're about to run before running it, surface what it will do,
and get a go-ahead for the publish step.