From 75bfd3cbec7db5d090258616893834806c1bdc1e Mon Sep 17 00:00:00 2001 From: Philipp Dunkel Date: Sat, 10 Oct 2026 00:24:54 +0200 Subject: [PATCH] README: packing, CI and releases on tangled --- README.md | 36 +++++++++++++++++++++++++++++------- 1 file changed, 29 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index e91404d..696f7c1 100644 --- a/README.md +++ b/README.md @@ -102,7 +102,8 @@ src/ui/ the setup window: Chromium over CDP, as in bled web/, public/ the setup page packages/ @ordner.fyi/xml, observe, dav-core, dav-client test/ detection/planning unit tests; end-to-end tests against dav-core -tools/ packaging (manifest, smoke test) +tools/ pack, smoke test, release +.tangled/workflows/ CI and release, on tangled's spindle ``` ## Development @@ -114,17 +115,38 @@ npm run test:packages # the workspace packages' own suites npm start -- setup # run from source ``` -## Packaging +## Packaging and releases -Packaging uses [@pipobscure/bundle](https://github.com/pipobscure/bundles), as -bled does: +The app ships as one file, `davsync.nzip`, built with +[@pipobscure/bundle](https://github.com/pipobscure/bundles). It holds the app's +sources and every module it runs, behind a launcher, so it runs by name: ```sh -npm run package # build/davsync.manifest, then build/davsync.unsigned.nzip -npm run smoke # start the packed app headless and wait for the page to load -npm run sign # bundle sign → build/davsync.nzip +npm run pack # build/davsync.nzip, reproducibly (members dated with the commit) +npm run smoke # run it by name: --version, and the setup window headless +./build/davsync.nzip setup ``` +CI and releases run on tangled's spindle ([`.tangled/workflows`](.tangled/workflows)). +`ci.yml` tests, packs and smoke-tests every push and pull request to main. + +To release, set `version` in package.json, commit, `git tag -a v`, and +`git push --follow-tags`. The tag starts `release.yml`, which runs +[`tools/release.sh`](tools/release.sh). That script tests, packs and smoke-tests, +attaches `davsync.nzip` to the tag as a release file, vouches for it with an +attestation (`bundle attest --kind published`), and publishes the `davsync` +listing. Then: + +```sh +bundle install @/davsync +``` + +It needs the secrets `TANGLED_HANDLE` and `TANGLED_APP_PASSWORD` +(`tangled secret set …`). Run by hand (`tangled run trigger -w release.yml`), +it is a dry run. The release job gets the `tangled` CLI with `bundle install`, +and accepts it only with its publisher's attestation +([`ci/policy.json`](ci/policy.json)). + ## License [EUPL-1.2](LICENSE) -- knotmirror 0.0.1