From beb8a52ec110e27c4afcb81fc43de65351c09574 Mon Sep 17 00:00:00 2001 From: Erwin Wee Date: Fri, 2 Oct 2026 09:22:23 +0800 Subject: [PATCH 1/2] chore: release v0.4.1 --- package-lock.json | 4 ++-- package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 81b87d3..b1ea067 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "gitgood", - "version": "0.4.0", + "version": "0.4.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "gitgood", - "version": "0.4.0", + "version": "0.4.1", "hasInstallScript": true, "license": "MIT", "dependencies": { diff --git a/package.json b/package.json index adf9ab9..c06cf35 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "gitgood", - "version": "0.4.0", + "version": "0.4.1", "description": "A GitHub Desktop-style Git client for Windows, macOS and Linux that drives the git and gh CLIs", "main": "./out/main/index.js", "author": "Erwin Wee", From e58a28b8f4147a436d1cd720f1b098bf9c31ecac Mon Sep 17 00:00:00 2001 From: Erwin Wee Date: Fri, 2 Oct 2026 09:23:21 +0800 Subject: [PATCH 2/2] fix(release): unset empty signing certificate before packaging --- .github/workflows/release.yml | 10 ++++++---- CHANGELOG.md | 7 ++++++- docs/RELEASING.md | 2 +- 3 files changed, 13 insertions(+), 6 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0ef0d11..d555e98 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -50,11 +50,13 @@ jobs: - name: Typecheck run: npm run typecheck - # Signing and notarization are driven by these secrets and only happen when - # they are set (see docs/RELEASING.md); unset secrets expand to empty - # strings, which electron-builder treats as "not provided". + # Unset secrets expand to empty strings. macOS signing treats an empty + # CSC_LINK as a certificate path, so remove it when signing is unconfigured. - name: Build - run: npm run ${{ matrix.dist }} -- --publish never + shell: bash + run: | + if [ -z "$CSC_LINK" ]; then unset CSC_LINK; fi + npm run ${{ matrix.dist }} -- --publish never env: CSC_LINK: ${{ secrets.CSC_LINK }} CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }} diff --git a/CHANGELOG.md b/CHANGELOG.md index 14acd70..5baaa92 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,12 @@ All notable changes to GitGood. Versions follow [semver](https://semver.org); release notes for each version are also on the [Releases page](https://github.com/erwin-wee/gitgood/releases). -## 0.4.0 — 2026-10-02 +## 0.4.1 — 2026-10-02 + +- Fixed macOS release packaging when signing secrets are not configured: an empty `CSC_LINK` is now removed before running electron-builder. +- Includes all changes below from 0.4.0, whose release build failed and was not published. + +## 0.4.0 — 2026-10-02 (not published) A security, privacy and robustness pass over the whole app, plus the features that came out of it. diff --git a/docs/RELEASING.md b/docs/RELEASING.md index 82d8575..0b3beb7 100644 --- a/docs/RELEASING.md +++ b/docs/RELEASING.md @@ -52,7 +52,7 @@ Installed copies check the GitHub releases feed (via `electron-updater`) on laun ## Signing -`release.yml` passes these repository secrets to the build step, and electron-builder signs and notarizes only when they are set; with none set the build is unsigned, exactly as before: +`release.yml` passes these repository secrets to the build step, and electron-builder signs and notarizes only when they are set; with none set the build is unsigned. The build unsets an empty `CSC_LINK` because electron-builder on macOS treats it as a certificate path rather than an absent secret: | Secret | Used for | | --- | --- |