tauri-action notarizes and staples the .app but never the .dmg wrapping it, so
Gatekeeper rejected the downloaded DMG as "Unnotarized Developer ID" even
though the app inside was fine:
spctl --assess --type open --context context:primary-signature -v \
Gridline_0.8.0_aarch64.dmg
-> rejected, source=Unnotarized Developer ID
Gatekeeper assesses the DMG itself when a user opens the download, so the app
being notarized does not save the mount. Submit each DMG to the same notary
service and staple the ticket into it.
- release.yml: new macOS-only step after tauri-action replaces each uploaded
DMG with its stapled copy. Assets are replaced via the release ID because the
GitHub releases/tags endpoint 404s for drafts, so uploading by tag cannot
work while the release is still a draft.
- release-mac.sh: same notarize + staple pass for the local/Gitea path before
upload, respecting GRIDLINE_SKIP_NOTARIZE.
- README: state that both the .app and the .dmg carry a stapled ticket.
The `release: published` trigger does not fire for a release whose draft was
created by tauri-action's GITHUB_TOKEN — verified on v0.8.0, which produced
zero workflow runs after publishing, so the Homebrew cask was never bumped and
the tap stayed empty.
Adds `bump_cask` to the workflow_dispatch inputs so the cask bump can be run
on demand for any tag, and switches the cask job to RELEASE_TAG (which resolves
for both dispatch and release events) instead of GITHUB_REF_NAME.
Also stops the cask template's header comment from being rewritten with the
substituted version and checksums on every render.
Adds a `tag` input so a release can be re-run without rewriting its tag.
Tag-triggered runs use the workflow file at the tagged commit, so fixing the
workflow and re-pushing the same tag was previously the only way to rebuild —
which rewrites a published release ref and misrepresents what the tag points
at.
RELEASE_TAG resolves to the input on workflow_dispatch and to the ref
otherwise, and drives both the checkout ref and tauri-action's tagName.
Replace the HOMEBREW_TAP_TOKEN PAT with HOMEBREW_TAP_DEPLOY_KEY, a
write-enabled SSH deploy key scoped to only AdrianBonpin/homebrew-gridline.
actions/checkout's `ssh-key` input wires the key into the SSH agent for the
job, so the cask push goes over SSH and no broadly-scoped personal access
token has to be stored as a repository secret.
Also drops the now-wrong claim that the job no-ops until the secret is set.
`gh secret set` strips the trailing newline when storing APPLE_API_KEY_CONTENT,
and Apple's PEM parser expects the key file to end with one. Write it back
explicitly so notarization can load the key.
GitHub is unsuspended, so releases move back from Gitea to GitHub, with the
Gitea mirror kept as a fallback.
- release.yml: re-enable as the active path and wire up Developer-ID signing
+ notarization for the macOS jobs. The Apple steps are guarded on the
secrets being present, so the workflow stays green (ad-hoc signed) until
they are configured.
- release.yml: re-sign the bundled PostgreSQL/MariaDB client binaries with
the Developer ID identity + hardened runtime + timestamp — Apple rejects
ad-hoc-signed nested executables during notarization.
- release.yml: move the Homebrew cask bump to the `release: published` event.
It previously ran on tag push, but the releases/tags API does not serve
drafts, so it could never download the DMGs. It now also skips cleanly
when HOMEBREW_TAP_TOKEN is unset rather than failing the workflow.
- release.yml: drop the stale header note claiming this is not the active
release path.
- README + cask template: point downloads, issues, releases and the Homebrew
tap back at github.com/AdrianBonpin.
Replace the static hero screenshot with a self-contained React mockup of the
full Gridline DB viewer (sidebar, table tree, tab bar, fake SQL editor,
data grid, queries/objects/schema-visualizer views, disabled Tools state).
- Add @astrojs/react and mount the island via client:visible
- 16:9 aspect-ratio mockup, hidden on mobile (static image fallback)
- JSON cell popover: solid surface, anchored within the mockup window,
Escape/outside-click close
- Dependency-free HTML5 drag-to-reorder tabs
- Theme-aware app tokens (canvas, surface-raised, popover bg)
- Site-wide max-w-7xl (was max-w-[1200px]) so sections center on big screens
- Regenerate standalone www/bun.lock for deterministic Dokploy builds
Hide entry-animated elements at first paint (html.anime-ready guard in
global.css) so the landing page no longer flashes visible content before
anime.js loads. Adds a <noscript> fallback and a JS load-error fallback to
guarantee content is never permanently hidden, and reveals the hero
immediately for prefers-reduced-motion users. Includes #macos-hint in the
hero entrance timeline so the macOS command box animates in correctly.
www/package.json declares vitest ^4.1.10 but the standalone www/bun.lock
(Railpack/Dokploy builds from /www with --frozen-lockfile) was stale and
missing it, failing every deployment with 'lockfile had changes, but
lockfile is frozen'. Regenerated www/bun.lock from www/package.json.
Add 'Copy connection URL' (with password, fetched from the OS keychain on
demand) and 'Copy connection URL (no password)' to the connection card kebab
menu. Builds postgresql://, mysql://, sqlite://, redis:// strings with
percent-encoded credentials and the PG sslmode appended. Bump to v0.7.10.
- Add 2-feature_request.md and 3-improvement.md templates (chooser now
lists Bug report, Feature request, Improvement in order)
- Improve bug report template: cross-template pointer, Linux log hint,
Related issues/PRs section, demo-DB reproduction hint
- Auto-assign every newly opened issue to the repo owner:
assignees in template front matter + a workflows/auto-assign.yml
(covers issues opened without a template)
- Add ISSUE_TEMPLATE/config.yml with Roadmap/README contact links
- Update README Contributing section
The bundle contains read-only files (e.g. the bundled OpenSSL dylibs), so a
sudo-less 'xattr -dr com.apple.quarantine' fails with Permission denied for
some users. Standardize on 'sudo xattr -dr com.apple.quarantine' in the
README, ROADMAP, the release.yml SIGNING STATUS comment, and the release
notes; AGENTS.md now requires release notes to carry the macOS first-launch
instructions until a Developer ID cert is secured.
Users at the top table previously saw no mention of the unsigned-app
warnings; the details lived ~200 lines down under Getting Started. Add a
callout right under the Download table linking to the macOS first-launch
instructions (right-click Open / xattr workaround).
* fix: macOS Finder launch (store path, ad-hoc signing, vendored openssl)
- Store::open was resolving 'gridline.db' relative to the working directory;
Finder/LaunchServices launches run with cwd=/ so the .expect() panicked
(exit 101, silent 'app does nothing') before Tauri ever started. Open the
store under app.path().app_data_dir() in setup instead (same dir as the
demo DB), creating the dir when needed.
- Add bundle.macOS.signingIdentity "-" + hardenedRuntime false so the
bundler ad-hoc signs the whole bundle. Previously only the inner binary
got Xcode 16's linker-signed signature, which macOS treats as unsigned:
quarantined downloads showed 'damaged and can't be opened', and after
quarantine removal LaunchServices silently refused to spawn it.
- ssh2 now builds OpenSSL vendored (feature vendored-openssl): the release
binary previously carried an absolute LC_LOAD_DYLIB to the build machine's
/opt/homebrew/opt/openssl@3/lib, which dyld aborted on (and hardened
runtime library-validation rejected even when present).
- README: document the macOS first-launch paths (right-click Open / xattr
for the damaged-error case, re-run after every upgrade).
- release.yml: update SIGNING STATUS comment to reflect ad-hoc signing.
* chore: bump 0.7.8 -> 0.7.9 (release prep)
- Version sync across package.json, src-tauri/Cargo.toml, src-tauri/tauri.conf.json
- version.test.ts / bundle-config.test.ts / docs-coverage.test.ts expect 0.7.9
- README: both download tables -> v0.7.9 asset names; new v0.7.9 changelog entry;
tag instructions -> v0.7.9; MAINTENANCE comment updated
- AGENTS.md maintenance note example -> v0.7.9
- ROADMAP: Shipped (0.7.9) section; Next up retitled (0.8.0) TBD
adrianbonpin