`scripts/release-mac.sh` still targeted the retired Gitea release flow: it
looked for `.gitea/workflows/release.yml`, keyed off GITEA_SERVER/REPO_OWNER,
and created/uploaded assets with `tea`. Releases are GitHub-only now, so the
script uploads with `gh release upload --clobber` (a locally signed DMG pair
supersedes the CI-built ones, which the next draft publish then ships).
Also corrects the release docs, which contradicted each other: AGENTS.md said
macOS is built manually and never in CI, while README said CI signs it. In
reality the `release.yml` macOS jobs sign + notarize when the APPLE_* secrets
are present and log a `notice` when they are not — so the checklist now says to
read the run output before publishing a draft (verified on v0.8.1: stapler
validate + spctl report `source=Notarized Developer ID`), lists the local
`scripts/release-mac.sh` as the fallback, and documents the cask bump that the
`release: published` event triggers.
The "keep versions in sync" checklist was also incomplete and had already been
the source of drift: it missed `desktop/src-tauri/Cargo.lock` (only the
`gridline` entry — the sqlx family shares 0.8.x), `www/public/landing.js`, the
site changelog, `bundle-config.test.ts`, the two README banners and the
MAINTENANCE comment.
GitHub is the source of truth; Gitea (origin) is a just-in-case copy that had
drifted two commits behind. Rather than require a credential on GitHub's side
or convert the repo to a read-only Gitea mirror, wire it into the local
workflow:
- scripts/mirror-gitea.sh — pushes prod + all tags to the Gitea remote
(--branches for every branch). Refuses to push to a GitHub remote, prints
what it did, exits non-zero when the mirror could not be updated.
- scripts/hooks/pre-push — git has no post-push hook, so the mirror runs before
a push that includes prod/main or a tag; skips other remotes, deletions and
its own recursion.
- scripts/hooks/post-merge — refreshes the mirror after `git pull`/merge on
prod, which is how a PR squash-merged on GitHub reaches the mirror.
- scripts/install-git-hooks.sh — one-time per clone; sets
core.hooksPath=scripts/hooks so the hooks stay versioned with the repo.
Mirror failures are warnings: a Gitea outage never blocks a push to GitHub.
AGENTS.md documents the setup plus the GitHub-only release flow.
Verified: script + hooks exercised for the prod/tag case, the feature-branch
skip, the Gitea-remote skip and the recursion guard; the mirror is idempotent
(no-op when already in sync).
tauri-action notarizes and staples the .app but never the .dmg wrapping it, so
Gatekeeper rejected the downloaded DMG as "Unnotarized Developer ID" even
though the app inside was fine:
spctl --assess --type open --context context:primary-signature -v \
Gridline_0.8.0_aarch64.dmg
-> rejected, source=Unnotarized Developer ID
Gatekeeper assesses the DMG itself when a user opens the download, so the app
being notarized does not save the mount. Submit each DMG to the same notary
service and staple the ticket into it.
- release.yml: new macOS-only step after tauri-action replaces each uploaded
DMG with its stapled copy. Assets are replaced via the release ID because the
GitHub releases/tags endpoint 404s for drafts, so uploading by tag cannot
work while the release is still a draft.
- release-mac.sh: same notarize + staple pass for the local/Gitea path before
upload, respecting GRIDLINE_SKIP_NOTARIZE.
- README: state that both the .app and the .dmg carry a stapled ticket.
* chore: bump version to 0.7.5 (Task 1.1)
* feat(db): pure object DDL/search/depend builders (Task 1.2)
* feat(models): ObjectSearchHit, DependencyInfo, PgToolPaths, tool source fields (Task 1.3)
* feat(backup): bundle-aware pg tool resolution, system-first fallback (Task 2.1)
* feat(objects): schema CRUD commands + integration test (Task 2.2)
* feat(objects): search_objects command (current-schema, all types) (Task 2.3)
* feat(objects): get_object_ddl for all browsable types (Task 2.4)
* feat(objects): pg_depend object dependencies + schema contents (Task 2.5)
* feat(ipc): register object management commands (Task 3.1)
* feat(ipc): frontend wrappers + types for object management (Task 3.2)
* feat(build): declare bundled pg_tools resources (Task 3.3)
* test(capabilities): lock objects capability PG-only for search/ddl/dependencies (Task 3.4)
* feat(ui): Cmd+K object search palette in DB viewer (Task 4.1)
* feat(ui): schema CRUD menu + dependency dialog (Task 4.2)
* feat(ui): copy-as-DDL + dependency view context menu in Objects (Task 4.3)
* feat(ui): dependency check before table drop + bundled-tool status (Task 4.4)
* docs: v0.7.5 release notes + status table + bundled-tools (Task 5.1)
* ci: build/verify bundled pg client tools per platform before tauri build (Task 5.2)
* fix(objects): report pg_rewrite dependencies as the dependent view (pg_class)
pg_depend records view dependencies via the view's internal rewrite rule
(classid = pg_rewrite). The user-facing dependent object is the VIEW itself,
so map that classid to pg_class (name still resolved through ev_class).
Fixes the live-PG integration test object_dependencies_for_table_includes_view
and makes the dependency dialog readable for view dependents.
* test: add idempotent PG integration-test seed script
Seeds the first PG test db (GRIDLINE_TEST_SRC) with the objects the
#[ignore] integration tests assert against: users (+users_id_seq),
products (3 rows), orders (3 rows), order_summary view, audit_log +
get_user functions, user_role enum. Idempotent: DROP + recreate.
* fix(build): regenerate multi-resolution icons + roadmap Keychain item
- icon.ico previously contained a single 16x16 frame (Windows scaled it
up -> blurry taskbar/start-menu icon). Regenerated from the 512px source
via 'tauri icon': ICO now has 16/24/32/48/64/256 frames, icns has full
@2x coverage up to 1024px, PNGs re-rendered from the same source.
- Added icons/icon.png (512px) to bundle.icon so Linux hicolor installs
a high-DPI entry.
- ROADMAP: log the 'Enable Keychain' toggle (currently a form-only
placeholder) under Next up -> Connection & credentials.
* docs(readme): dynamic version-free download links + 3-col table
- release.yml: set releaseAssetNamePattern to '[name]_[platform]_[arch][setup][ext]'
(version-free), so asset filenames are stable across releases:
Gridline_darwin_aarch64.dmg, Gridline_windows_x64-setup.exe,
Gridline_linux_amd64.deb, Gridline_linux_x86_64.rpm, etc.
- README: both download tables now 3-column (OS | Architecture | Download)
and link via GitHub's releases/latest/download/<file> redirect — they
always point at the newest published release, no per-release edits.
- AGENTS.md: releases checklist updated — download links stay version-free.
* docs(readme): platform-per-column download table (macOS | Windows | Linux)
Table now mirrors the release layout: one column per OS with a logo row
and a download-links row underneath. Links stay version-free via
releases/latest/download/<file> (releaseAssetNamePattern in release.yml).
* docs(readme): revert download table to clean image-less 3-col layout
Logo row was hard to read on GitHub dark mode; the plain OS | Architecture
| Download table is cleaner and still uses dynamic releases/latest links.
adrianbonpin