feat: publish a signed release on tag push - #564
Merged
Conversation
Adds a Release workflow that delegates to owncloud/reusable-workflows. On a `v*` tag push it runs `make dist`, signs the bundle with ocsign instead of `occ integrity:sign-app` (no ownCloud server required) and attaches the tarball to a GitHub Release. Until now `make dist` in CI silently skipped signing: `CAN_SIGN` is only set when key, cert and occ all exist locally, so the `else` branch just echoed a message and the build still exited 0. Since signing is mandatory on ownCloud 11+, the reusable workflow now asserts the tarball carries a valid `appinfo/signature.json` and fails the release otherwise. Two Makefile changes are needed for this app: The `appstore` target moved `../../config/config.php` aside around the sign call, to stop occ reading the app's own config. ocsign does not read any config, and without a core checkout that path does not exist, so the `mv` failed with "cannot stat". Both lines are removed, which leaves `configdir` unused, so its definition goes too. `make dist` also emits two tarballs that are both named `notes.tar.gz` (a source and an appstore bundle), which would collide as release assets, so the workflow narrows `artifact-glob` to the appstore one. Requires the SIGNING_KEY, SIGNING_CERT and SIGNING_CHAIN secrets on this repository. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
phil-davis
approved these changes
Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a
Releaseworkflow: on av*tag push,make distruns, the bundle issigned, and the tarball is attached to a GitHub Release. Delegates to
owncloud/reusable-workflows.Why
make distin CI has been silently producing unsigned tarballs.CAN_SIGNis only set when key, cert and
occall exist locally, so theelsebranchjust echoes a message and the build still exits 0:
Signing is mandatory on ownCloud 11+ — an unsigned app is blocked, not
warned. Signing now uses
ocsign, whichneeds no ownCloud server, and the reusable workflow asserts the tarball
carries a valid
appinfo/signature.jsonwhose leafCNmatches the app id.Two Makefile changes this app needs
The
configdirworkaround is removed.appstore:moved../../config/config.phpaside around the sign call, sooccwould not readthe app's own config. ocsign reads no config, and without a core checkout that
path does not exist, so the
mvfailed outright:Both lines are gone, which leaves
configdirunreferenced, so its definitiongoes too. Verified: with the patch,
make distsigns and tars cleanly.artifact-globis narrowed.make distemits two tarballs, both namednotes.tar.gz—build/artifacts/source/andbuild/artifacts/appstore/. Asrelease assets they would collide, so only the appstore bundle is published.
Before this can publish
The
SIGNING_KEY,SIGNING_CERTandSIGNING_CHAINsecrets must be set onthis repository. Without them the release job fails fast with a clear message
rather than shipping something unsigned.
The workflow also requires the pushed tag (minus the leading
v) to equal<version>inappinfo/info.xml.🤖 Generated with Claude Code