Claudinite growth: extract lessons - #28
Merged
Merged
Conversation
The optional Developer ID signing + Apple notarization lane added to both DMG workflows (#4) has real CI-side gotchas — the Hardened-Runtime-needs-the-mic- entitlement coupling, ad-hoc-isn't-notarizable, the ephemeral-keychain searchable-list trick, and the secret-gated ad-hoc fallback — that were only recorded in the workflow YAML comments, so a future session editing the release flow wouldn't be pointed at them. Re-home them into ci-release.md (the doc CLAUDE.md sends you to before touching those workflows), the same way the trigger gotchas were captured. Refs #21. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Daily growth-extract run over the last window. The substantive change was the
macOS signing/notarization work — commit #4 (Developer ID signing + Apple
notarization lane) and its follow-up #27 (pipefail in the DMG workflows).
Added one lesson to
dev/procedures/ci-release.md(the doc CLAUDE.md sendsyou to before editing the DMG workflows): a terse "Signing & notarization is
an optional, secret-gated lane" section capturing the CI-side gotchas from #4
that were only recorded in the workflow YAML comments —
com.apple.security.device.audio-inputmic entitlement (an ad-hoc builddoesn't), so enabling notarization silently kills mic access without it.
codesigncan't find the imported identity — and thatsedpipe is why ci: run DMG workflow steps with pipefail #27needed pipefail.
still pass.
Deliberately not captured: the #27 pipefail lesson itself — it's already a
canon blocking check (
gha/run-pipefail) and prose in thegit-github-advancedskill, so a local copy would only duplicate the canon.This PR referenced it only as the reason the signing steps need
shell: bash.Writes only the project's own instruction docs. Refs #21.
Generated by Claude Code