Document one shared runner per host [skip ci]

.gitea/workflows/build.yml

@@ -9,7 +9,7 @@ on:
 
 jobs:
   macos:
-    runs-on: macos-15
+    runs-on: macos-arm64
     steps:
       - uses: actions/checkout@v4
       - name: Build Meetingnotes
@@ -22,6 +22,7 @@ jobs:
           -derivedDataPath "$RUNNER_TEMP/DerivedData"
           ARCHS="arm64 x86_64"
           ONLY_ACTIVE_ARCH=NO
+          PRODUCT_BUNDLE_IDENTIFIER=net.jamesbone.meetingnotes.ci
           CODE_SIGNING_ALLOWED=NO
           build
       - name: Sign test build
@@ -34,28 +35,15 @@ jobs:
           codesign -d --entitlements :- "$app_path" 2>&1 \
             | grep -q 'com.apple.security.network.server'
       - name: Smoke test local API
-        run: |
+        run: python3 scripts/smoke_test_api.py "$RUNNER_TEMP/DerivedData/Build/Products/Release/Meetingnotes.app"
-          defaults write net.jamesbone.meetingnotes muteDeckAPIEnabled -bool true
-          defaults write net.jamesbone.meetingnotes muteDeckAPIPort -int 19880
-          "$RUNNER_TEMP/DerivedData/Build/Products/Release/Meetingnotes.app/Contents/MacOS/Meetingnotes" >"$RUNNER_TEMP/meetingnotes.log" 2>&1 &
-          app_pid=$!
-          trap 'kill "$app_pid" 2>/dev/null || true' EXIT
-
-          for _ in {1..20}; do
-            if curl -fsS http://127.0.0.1:19880/api/info >"$RUNNER_TEMP/api-info.json"; then
-              break
-            fi
-            sleep 1
-          done
-
-          grep -q '"name":"MeetingDebrief"' "$RUNNER_TEMP/api-info.json"
-          test "$(curl -sS -o /dev/null -w '%{http_code}' http://127.0.0.1:19880/api/recording/status)" = "401"
       - name: Package test build
+        if: always()
         run: |
           app_path="$RUNNER_TEMP/DerivedData/Build/Products/Release/Meetingnotes.app"
           ditto -c -k --sequesterRsrc --keepParent \
             "$app_path" "$RUNNER_TEMP/Meetingnotes-macOS.zip"
       - name: Upload test build
+        if: always()
         uses: actions/upload-artifact@v4
         with:
           name: Meetingnotes-macOS-${{ github.sha }}

.gitea/workflows/release.yml

@@ -0,0 +1,47 @@
+name: Release
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Version from MARKETING_VERSION, without the v prefix
+        required: true
+        type: string
+permissions:
+  contents: write
+concurrency:
+  group: meetingnotes-release
+  cancel-in-progress: false
+jobs:
+  release:
+    runs-on: macos-arm64
+    env:
+      VERSION: ${{ inputs.version }}
+      RELEASE_BASE_URL: https://git.jamesbone.net/coder/meetingnotes
+      APPLE_ID: ${{ secrets.APPLE_ID }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+      APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
+      SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
+    steps:
+      - name: Require main
+        run: test "$GITHUB_REF" = refs/heads/main
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Build, sign, and notarize release
+        timeout-minutes: 45
+        env:
+          APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+        run: python3 scripts/with_signing_identity.py scripts/package_release.sh
+      - name: Preserve signed release artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: meetingnotes-signed-release-${{ github.run_id }}
+          path: ${{ runner.temp }}/meetingnotes-release/release
+          if-no-files-found: error
+          retention-days: 30
+      - name: Publish Gitea release
+        env:
+          GITEA_SERVER_URL: ${{ github.server_url }}
+          GITEA_TOKEN: ${{ github.token }}
+        run: python3 scripts/publish_gitea_release.py

.github/workflows/finalize-release.yml

@@ -1,92 +0,0 @@
-name: Finalize Notarization (manual)
-
-on:
-  workflow_dispatch:
-    inputs:
-      release_run_id:
-        description: Release workflow run ID; leave blank to use the latest pending run
-        required: false
-        type: string
-
-permissions:
-  actions: read
-  contents: write
-
-concurrency:
-  group: meetingnotes-finalize-release
-  cancel-in-progress: false
-
-jobs:
-  finalize:
-    if: github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success'
-    runs-on: macos-15
-    env:
-      APPLE_ID: ${{ secrets.APPLE_ID }}
-      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-      APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
-      SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
-      GH_TOKEN: ${{ github.token }}
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Validate release secrets
-        run: |
-          for variable in APPLE_ID APPLE_TEAM_ID APPLE_APP_PASSWORD SPARKLE_PRIVATE_KEY; do
-            if [[ -z "${!variable:-}" ]]; then
-              echo "Missing GitHub Actions secret: $variable" >&2
-              exit 1
-            fi
-          done
-
-      - name: Download pending signed build
-        id: submission
-        env:
-          MANUAL_RUN_ID: ${{ inputs.release_run_id }}
-          COMPLETED_RUN_ID: ${{ github.event.workflow_run.id }}
-        run: |
-          PENDING_DIR="$RUNNER_TEMP/meetingnotes-pending"
-          candidate_ids=()
-          if [[ -n "${MANUAL_RUN_ID:-}" ]]; then
-            candidate_ids+=("$MANUAL_RUN_ID")
-          elif [[ -n "${COMPLETED_RUN_ID:-}" ]]; then
-            candidate_ids+=("$COMPLETED_RUN_ID")
-          else
-            while IFS= read -r run_id; do
-              candidate_ids+=("$run_id")
-            done < <(gh run list --repo "$GITHUB_REPOSITORY" --workflow Release --status success --limit 20 --json databaseId --jq '.[].databaseId')
-          fi
-
-          for run_id in "${candidate_ids[@]}"; do
-            if [[ ! "$run_id" =~ ^[0-9]+$ ]]; then
-              echo "Invalid release run ID: $run_id" >&2
-              exit 1
-            fi
-
-            artifact_name="meetingnotes-notarization-$run_id"
-            artifact_count=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$run_id/artifacts" \
-              --jq "[.artifacts[] | select(.name == \"$artifact_name\" and .expired == false)] | length")
-            if [[ "$artifact_count" == 0 ]]; then
-              continue
-            fi
-
-            rm -rf "$PENDING_DIR"
-            mkdir -p "$PENDING_DIR"
-            gh run download "$run_id" --repo "$GITHUB_REPOSITORY" --name "$artifact_name" --dir "$PENDING_DIR"
-
-            version=$(<"$PENDING_DIR/version")
-            if gh release view "v$version" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
-              continue
-            fi
-
-            echo "found=true" >> "$GITHUB_OUTPUT"
-            echo "run_id=$run_id" >> "$GITHUB_OUTPUT"
-            echo "Using release submission from workflow run $run_id"
-            exit 0
-          done
-
-          echo "found=false" >> "$GITHUB_OUTPUT"
-          echo "No pending release submission was found"
-
-      - name: Check notarization and publish when accepted
-        if: steps.submission.outputs.found == 'true'
-        run: scripts/finalize_release.sh

.github/workflows/release.yml

@@ -1,88 +0,0 @@
-name: Release
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: Version from MARKETING_VERSION, without the v prefix
-        required: true
-        type: string
-
-permissions:
-  contents: write
-
-concurrency:
-  group: meetingnotes-release
-  cancel-in-progress: false
-
-jobs:
-  release:
-    runs-on: macos-15
-    env:
-      VERSION: ${{ inputs.version }}
-      APPLE_ID: ${{ secrets.APPLE_ID }}
-      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-      APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
-      SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      - name: Validate release secrets
-        env:
-          APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-        run: |
-          for variable in APPLE_CERTIFICATE_P12 APPLE_CERTIFICATE_PASSWORD APPLE_ID APPLE_TEAM_ID APPLE_APP_PASSWORD SPARKLE_PRIVATE_KEY; do
-            if [[ -z "${!variable:-}" ]]; then
-              echo "Missing GitHub Actions secret: $variable" >&2
-              exit 1
-            fi
-          done
-
-      - name: Import Developer ID certificate
-        uses: apple-actions/import-codesign-certs@v7
-        with:
-          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE_P12 }}
-          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-
-      - name: Locate Developer ID identity
-        run: |
-          signing_identity=$(security find-identity -v -p codesigning | awk -F '"' '/Developer ID Application/{print $2; exit}')
-          if [[ -z "$signing_identity" ]]; then
-            echo "The .p12 does not contain a Developer ID Application identity" >&2
-            exit 1
-          fi
-          echo "SIGNING_IDENTITY=$signing_identity" >> "$GITHUB_ENV"
-
-      - name: Build, sign, and notarize release
-        timeout-minutes: 30
-        run: scripts/package_release.sh
-
-      - name: Preserve signed release artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: meetingnotes-signed-release-${{ github.run_id }}
-          path: ${{ runner.temp }}/meetingnotes-release/release
-          if-no-files-found: error
-          retention-days: 30
-
-      - name: Publish signed GitHub release
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          tag="v$VERSION"
-          if gh release view "$tag" >/dev/null 2>&1; then
-            gh release upload "$tag" \
-              "$RUNNER_TEMP/meetingnotes-release/release/Meetingnotes-$VERSION.zip" \
-              "$RUNNER_TEMP/meetingnotes-release/release/appcast.xml" \
-              --clobber
-          else
-            gh release create "$tag" \
-              "$RUNNER_TEMP/meetingnotes-release/release/Meetingnotes-$VERSION.zip" \
-              "$RUNNER_TEMP/meetingnotes-release/release/appcast.xml" \
-              --target "$GITHUB_SHA" \
-              --title "Meetingnotes $VERSION" \
-              --generate-notes
-          fi

Meetingnotes.xcodeproj/project.pbxproj

@@ -276,7 +276,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 44;
+				CURRENT_PROJECT_VERSION = 45;
 				DEVELOPMENT_ASSET_PATHS = "\"meetingnotes/Preview Content\"";
 				DEVELOPMENT_TEAM = G9LVHZAJNX;
 				ENABLE_HARDENED_RUNTIME = YES;
@@ -290,7 +290,7 @@
 					"@executable_path/../Frameworks",
 				);
 				MACOSX_DEPLOYMENT_TARGET = 15.0;
-				MARKETING_VERSION = 1.1.32;
+				MARKETING_VERSION = 1.1.33;
 				ONLY_ACTIVE_ARCH = NO;
 				OTHER_SWIFT_FLAGS = "$(inherited) -D ENABLE_TCC_SPI";
 				PRODUCT_BUNDLE_IDENTIFIER = net.jamesbone.meetingnotes;
@@ -312,7 +312,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 44;
+				CURRENT_PROJECT_VERSION = 45;
 				DEVELOPMENT_ASSET_PATHS = "\"meetingnotes/Preview Content\"";
 				DEVELOPMENT_TEAM = G9LVHZAJNX;
 				ENABLE_HARDENED_RUNTIME = YES;
@@ -326,7 +326,7 @@
 					"@executable_path/../Frameworks",
 				);
 				MACOSX_DEPLOYMENT_TARGET = 15.0;
-				MARKETING_VERSION = 1.1.32;
+				MARKETING_VERSION = 1.1.33;
 				ONLY_ACTIVE_ARCH = YES;
 				OTHER_SWIFT_FLAGS = "$(inherited) -D ENABLE_TCC_SPI";
 				PRODUCT_BUNDLE_IDENTIFIER = net.jamesbone.meetingnotes;

README.md

@@ -46,7 +46,7 @@ Later:
 ## Releasing a New Version
 
 Production releases are Developer ID signed, notarized by Apple, published to
-GitHub Releases, and signed for Sparkle auto-updates.
+[Gitea Releases](https://git.jamesbone.net/coder/meetingnotes/releases), and signed for Sparkle auto-updates.
 
 ### Release Process
 
@@ -68,12 +68,12 @@ GitHub Releases, and signed for Sparkle auto-updates.
 
 2. Commit and push the version change to `main`.
 
-3. Run the `Release` workflow from GitHub Actions and enter the version without
+3. Run the `Release` workflow from Gitea Actions on `main` and enter the version without
    the `v` prefix. The workflow signs and notarizes the app, generates the
    signed appcast, creates the version tag, and publishes both release assets.
 
 The app checks
-`https://github.com/superdooper86/meetingnotes/releases/latest/download/appcast.xml`
+`https://git.jamesbone.net/coder/meetingnotes/releases/download/latest/appcast.xml`
 and installs later releases automatically through Sparkle.
 
 ### Recovering Meetings
@@ -82,3 +82,20 @@ The first Developer ID signed build may not automatically inherit data from an
 older ad-hoc signed build. In Settings, use **Import Meetings...** and select the
 old `Meetings` folder. After this one-time transition, the stable signing
 identity keeps the same sandbox container across updates.
+
+### Build runner and GitHub transition
+
+`.gitea/workflows/build.yml` builds universal macOS artifacts for pushes and pull
+requests to `main`. The shared account-scoped `mac-mini` runner uses the
+`macos-arm64` label. Smoke tests use a separate CI bundle identifier and temporary
+launch preferences and an internal-volume staging directory. Keychain services
+follow the bundle identifier, so CI never reads production credentials; the smoke
+test removes its isolated API token before and after each launch. Release jobs import the original Developer ID certificate
+into a temporary keychain and keep the original Sparkle signing key in Gitea
+Actions secrets. They never publish from a development branch.
+
+Version 1.1.33 moves the embedded update feed to Gitea. After its notarized archive
+is verified, replace the `appcast.xml` asset on the last GitHub release with the
+new appcast. Existing installations discover the Gitea download through that old
+GitHub feed; after installing it, they check Gitea directly. Keep the old GitHub
+repository and its release appcast available for installations that update later.

meetingnotes/Info.plist

@@ -14,7 +14,7 @@
 	<key>NSMicrophoneUsageDescription</key>
 	<string>Meetingnotes needs access to your microphone for transcription.</string>
 	<key>SUFeedURL</key>
-	<string>https://github.com/superdooper86/meetingnotes/releases/latest/download/appcast.xml</string>
+	<string>https://git.jamesbone.net/coder/meetingnotes/releases/download/latest/appcast.xml</string>
 	<key>SUPublicEDKey</key>
 	<string>9ZuN9G9ERB3Qoyyd/4FsF+6LMUv5jzAGP26OXAHBiW0=</string>
 	<key>SUEnableAutomaticChecks</key>

meetingnotes/Managers/KeychainHelper.swift

@@ -8,7 +8,7 @@ import Security
 class KeychainHelper {
     static let shared = KeychainHelper()
     
-    private let serviceName = "net.jamesbone.meetingnotes"
+    private let serviceName = Bundle.main.bundleIdentifier ?? "net.jamesbone.meetingnotes"
     
     private init() {}
     

meetingnotes/Views/SettingsView.swift

@@ -255,7 +255,7 @@ struct SettingsView: View {
                     
                     // Link to GitHub repository
                     Link("GitHub",
-                         destination: URL(string: "https://github.com/superdooper86/meetingnotes")!)
+                         destination: URL(string: "https://git.jamesbone.net/coder/meetingnotes")!)
                         .foregroundColor(.blue)
 
                     // Link to landing page

scripts/configure_github_release_secrets.sh

@@ -1,34 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-REPOSITORY="${REPOSITORY:-superdooper86/meetingnotes}"
-
-if ! command -v gh >/dev/null 2>&1; then
-  echo "Install GitHub CLI first: brew install gh" >&2
-  exit 1
-fi
-
-gh auth status >/dev/null
-
-read -r -p "Developer ID certificate (.p12) path: " certificate_path
-if [[ ! -f "$certificate_path" ]]; then
-  echo "Certificate not found: $certificate_path" >&2
-  exit 1
-fi
-
-read -r -s -p "Certificate export password: " certificate_password
-printf '\n'
-read -r -p "Apple ID email: " apple_id
-read -r -p "Apple Developer Team ID: " team_id
-read -r -s -p "Apple app-specific password: " app_password
-printf '\n'
-
-base64 < "$certificate_path" | gh secret set APPLE_CERTIFICATE_P12 -R "$REPOSITORY"
-printf '%s' "$certificate_password" | gh secret set APPLE_CERTIFICATE_PASSWORD -R "$REPOSITORY"
-printf '%s' "$apple_id" | gh secret set APPLE_ID -R "$REPOSITORY"
-printf '%s' "$team_id" | gh secret set APPLE_TEAM_ID -R "$REPOSITORY"
-printf '%s' "$app_password" | gh secret set APPLE_APP_PASSWORD -R "$REPOSITORY"
-
-unset certificate_password app_password
-echo "Apple release secrets configured for $REPOSITORY."

scripts/finalize_release.sh

@@ -1,139 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-APP_NAME="Meetingnotes"
-RUNNER_TEMP="${RUNNER_TEMP:-/tmp}"
-PENDING_DIR="${PENDING_DIR:-$RUNNER_TEMP/meetingnotes-pending}"
-WORK_ROOT="${WORK_ROOT:-$RUNNER_TEMP/meetingnotes-finalize}"
-APP_PATH="$WORK_ROOT/$APP_NAME.app"
-RELEASE_DIR="$WORK_ROOT/release"
-VERSION_PATH="$PENDING_DIR/version"
-COMMIT_SHA_PATH="$PENDING_DIR/commit-sha"
-SUBMISSION_PATH="$PENDING_DIR/notary-submission.json"
-PRE_NOTARY_ZIP="$PENDING_DIR/$APP_NAME-pre-notary.zip"
-
-required_variables=(
-  APPLE_ID
-  APPLE_TEAM_ID
-  APPLE_APP_PASSWORD
-  SPARKLE_PRIVATE_KEY
-  GH_TOKEN
-  GITHUB_REPOSITORY
-)
-
-for variable in "${required_variables[@]}"; do
-  if [[ -z "${!variable:-}" ]]; then
-    echo "Missing required environment variable: $variable" >&2
-    exit 1
-  fi
-done
-
-for path in "$VERSION_PATH" "$COMMIT_SHA_PATH" "$SUBMISSION_PATH" "$PRE_NOTARY_ZIP" "$PENDING_DIR/generate_appcast"; do
-  if [[ ! -e "$path" ]]; then
-    echo "Missing release submission artifact: $path" >&2
-    exit 1
-  fi
-done
-
-VERSION=$(<"$VERSION_PATH")
-COMMIT_SHA=$(<"$COMMIT_SHA_PATH")
-SUBMISSION_ID=$(plutil -extract id raw -o - "$SUBMISSION_PATH")
-TAG="v$VERSION"
-
-if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
-  echo "Release already exists: $TAG"
-  exit 0
-fi
-
-STATUS_PATH="$WORK_ROOT/notary-status.json"
-rm -rf "$WORK_ROOT"
-mkdir -p "$RELEASE_DIR"
-
-notary_info_succeeded=false
-for attempt in 1 2 3; do
-  if xcrun notarytool info "$SUBMISSION_ID" \
-    --apple-id "$APPLE_ID" \
-    --team-id "$APPLE_TEAM_ID" \
-    --password "$APPLE_APP_PASSWORD" \
-    --output-format json > "$STATUS_PATH"; then
-    notary_info_succeeded=true
-    break
-  fi
-  echo "Notary status check failed ($attempt/3); retrying"
-  sleep 15
-done
-
-if [[ "$notary_info_succeeded" != true ]]; then
-  echo "Unable to query Apple notarization status after three attempts" >&2
-  exit 1
-fi
-
-NOTARY_STATUS=$(plutil -extract status raw -o - "$STATUS_PATH")
-echo "Notarization status for $SUBMISSION_ID: $NOTARY_STATUS"
-
-case "$NOTARY_STATUS" in
-  "In Progress")
-    if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
-      printf 'Apple is still processing Meetingnotes %s. Submission: `%s`. The scheduled workflow will check again.\n' \
-        "$VERSION" "$SUBMISSION_ID" >> "$GITHUB_STEP_SUMMARY"
-    fi
-    exit 0
-    ;;
-  Accepted)
-    ;;
-  Invalid|Rejected)
-    xcrun notarytool log "$SUBMISSION_ID" \
-      --apple-id "$APPLE_ID" \
-      --team-id "$APPLE_TEAM_ID" \
-      --password "$APPLE_APP_PASSWORD" || true
-    exit 1
-    ;;
-  *)
-    echo "Unexpected notarization status: $NOTARY_STATUS" >&2
-    exit 1
-    ;;
-esac
-
-ditto -x -k "$PRE_NOTARY_ZIP" "$WORK_ROOT"
-if [[ ! -d "$APP_PATH" ]]; then
-  echo "Signed app was not found after extracting $PRE_NOTARY_ZIP" >&2
-  exit 1
-fi
-
-APP_VERSION=$(plutil -extract CFBundleShortVersionString raw -o - "$APP_PATH/Contents/Info.plist")
-if [[ "$APP_VERSION" != "$VERSION" ]]; then
-  echo "Signed app version $APP_VERSION does not match release version $VERSION" >&2
-  exit 1
-fi
-
-xcrun stapler staple "$APP_PATH"
-xcrun stapler validate "$APP_PATH"
-spctl --assess --type execute --verbose=2 "$APP_PATH"
-
-ARCHIVE_NAME="$APP_NAME-$VERSION.zip"
-ARCHIVE_PATH="$RELEASE_DIR/$ARCHIVE_NAME"
-ditto -c -k --sequesterRsrc --keepParent "$APP_PATH" "$ARCHIVE_PATH"
-
-GENERATE_APPCAST="$PENDING_DIR/generate_appcast"
-chmod +x "$GENERATE_APPCAST"
-DOWNLOAD_URL="https://github.com/$GITHUB_REPOSITORY/releases/download/$TAG/"
-printf '%s' "$SPARKLE_PRIVATE_KEY" | "$GENERATE_APPCAST" "$RELEASE_DIR" \
-  --ed-key-file - \
-  --download-url-prefix "$DOWNLOAD_URL" \
-  --maximum-deltas 0 \
-  -o "$RELEASE_DIR/appcast.xml"
-
-grep -q "$DOWNLOAD_URL$ARCHIVE_NAME" "$RELEASE_DIR/appcast.xml"
-grep -q 'sparkle:edSignature=' "$RELEASE_DIR/appcast.xml"
-
-gh release \
-  create "$TAG" \
-  "$ARCHIVE_PATH" \
-  "$RELEASE_DIR/appcast.xml" \
-  --repo "$GITHUB_REPOSITORY" \
-  --target "$COMMIT_SHA" \
-  --title "Meetingnotes $VERSION" \
-  --generate-notes
-
-echo "Published Meetingnotes $VERSION"

scripts/package_release.sh

@@ -14,11 +14,13 @@ APP_PATH="$DERIVED_DATA/Build/Products/Release/$APP_NAME.app"
 required_variables=(
   VERSION
   SIGNING_IDENTITY
+  SIGNING_KEYCHAIN
   APPLE_ID
   APPLE_TEAM_ID
   APPLE_APP_PASSWORD
   SPARKLE_PRIVATE_KEY
   GITHUB_REPOSITORY
+  RELEASE_BASE_URL
 )
 
 for variable in "${required_variables[@]}"; do
@@ -57,12 +59,12 @@ SPARKLE_FRAMEWORK="$APP_PATH/Contents/Frameworks/Sparkle.framework"
 SPARKLE_CONTENTS="$SPARKLE_FRAMEWORK/Versions/B"
 
 sign_component() {
-  codesign --force --timestamp --options runtime --sign "$SIGNING_IDENTITY" "$1"
+  codesign --force --timestamp --options runtime --keychain "$SIGNING_KEYCHAIN" --sign "$SIGNING_IDENTITY" "$1"
 }
 
 sign_component "$SPARKLE_CONTENTS/XPCServices/Installer.xpc"
 if [[ -d "$SPARKLE_CONTENTS/XPCServices/Downloader.xpc" ]]; then
-  codesign --force --timestamp --options runtime \
+  codesign --force --timestamp --options runtime --keychain "$SIGNING_KEYCHAIN" \
     --preserve-metadata=entitlements \
     --sign "$SIGNING_IDENTITY" \
     "$SPARKLE_CONTENTS/XPCServices/Downloader.xpc"
@@ -71,7 +73,7 @@ sign_component "$SPARKLE_CONTENTS/Autoupdate"
 sign_component "$SPARKLE_CONTENTS/Updater.app"
 sign_component "$SPARKLE_FRAMEWORK"
 
-codesign --force --timestamp --options runtime \
+codesign --force --timestamp --options runtime --keychain "$SIGNING_KEYCHAIN" \
   --entitlements meetingnotes/meetingnotes.entitlements \
   --sign "$SIGNING_IDENTITY" \
   "$APP_PATH"
@@ -116,7 +118,7 @@ if [[ -z "$GENERATE_APPCAST" ]]; then
   exit 1
 fi
 
-DOWNLOAD_URL="https://github.com/$GITHUB_REPOSITORY/releases/download/v$VERSION/"
+DOWNLOAD_URL="$RELEASE_BASE_URL/releases/download/v$VERSION/"
 printf '%s' "$SPARKLE_PRIVATE_KEY" | "$GENERATE_APPCAST" "$RELEASE_DIR" \
   --ed-key-file - \
   --download-url-prefix "$DOWNLOAD_URL" \
@@ -127,7 +129,7 @@ grep -q "$DOWNLOAD_URL$ARCHIVE_NAME" "$RELEASE_DIR/appcast.xml"
 grep -q 'sparkle:edSignature=' "$RELEASE_DIR/appcast.xml"
 
 if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
-  printf 'Built, Developer ID-signed, notarized, and stapled Meetingnotes %s. The GitHub release is ready to publish.\n' \
+  printf 'Built, Developer ID-signed, notarized, and stapled Meetingnotes %s. The Gitea release is ready to publish.\n' \
     "$VERSION" >> "$GITHUB_STEP_SUMMARY"
 fi
 

scripts/publish_gitea_release.py

@@ -0,0 +1,45 @@
+#!/usr/bin/env python3
+"""Publish both signed assets together, keeping incomplete uploads as a draft."""
+import json
+import os
+import urllib.error
+import urllib.parse
+import urllib.request
+from pathlib import Path
+
+base = os.environ["GITEA_SERVER_URL"].rstrip("/") + "/api/v1/repos/" + os.environ["GITHUB_REPOSITORY"]
+token = os.environ["GITEA_TOKEN"]
+version = os.environ["VERSION"]
+
+
+class NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, *args, **kwargs):
+        return None
+
+
+def request(path, method="GET", data=None, binary=False):
+    body = data if binary else None if data is None else json.dumps(data).encode()
+    req = urllib.request.Request(base + path, method=method, data=body, headers={
+        "Authorization": "token " + token,
+        "Content-Type": "application/octet-stream" if binary else "application/json",
+        "User-Agent": "Meetingnotes-release",
+    })
+    with urllib.request.build_opener(NoRedirect()).open(req, timeout=120) as response:
+        raw = response.read()
+        return json.loads(raw) if raw else None
+
+
+release_dir = Path(os.environ["RUNNER_TEMP"]) / "meetingnotes-release/release"
+assets = [release_dir / f"Meetingnotes-{version}.zip", release_dir / "appcast.xml"]
+for asset in assets:
+    if not asset.is_file() or not asset.stat().st_size:
+        raise RuntimeError(f"Missing release artifact: {asset.name}")
+release = request("/releases", "POST", {
+    "tag_name": "v" + version, "target_commitish": os.environ["GITHUB_SHA"],
+    "name": "Meetingnotes " + version, "draft": True, "prerelease": False,
+    "body": "Developer ID signed, Apple notarized, and signed for Sparkle updates.\n\nBuilt from main at `" + os.environ["GITHUB_SHA"] + "`.",
+})
+for asset in assets:
+    request(f"/releases/{release['id']}/assets?name=" + urllib.parse.quote(asset.name), "POST", asset.read_bytes(), binary=True)
+request(f"/releases/{release['id']}", "PATCH", {"draft": False})
+print("Published Meetingnotes " + version)

scripts/smoke_test_api.py

@@ -0,0 +1,77 @@
+#!/usr/bin/env python3
+"""Check the CI app's unauthenticated API without changing saved preferences."""
+import json
+import plistlib
+import socket
+import subprocess
+import sys
+import tempfile
+import time
+import urllib.error
+import urllib.request
+from pathlib import Path
+
+# Launch from the Mac's internal volume; the runner checkout is on removable storage.
+cache = Path.home() / "Library/Caches/meetingnotes-ci"
+cache.mkdir(parents=True, exist_ok=True)
+with tempfile.TemporaryDirectory(prefix="smoke-", dir=cache) as directory:
+    staged = Path(directory) / "Meetingnotes.app"
+    subprocess.run(["ditto", sys.argv[1], str(staged)], check=True)
+    app = staged / "Contents/MacOS/Meetingnotes"
+    with (staged / "Contents/Info.plist").open("rb") as info_file:
+        bundle_id = plistlib.load(info_file)["CFBundleIdentifier"]
+    assert bundle_id == "net.jamesbone.meetingnotes.ci", "Smoke tests require the isolated CI app"
+
+    def clear_test_token():
+        result = subprocess.run(
+            ["security", "delete-generic-password", "-s", bundle_id, "-a", "muteDeckAPIToken"],
+            capture_output=True, timeout=10,
+        )
+        if result.returncode not in (0, 44):  # 44: item does not exist
+            raise RuntimeError("Could not clear the CI Keychain token")
+
+    clear_test_token()
+    with socket.socket() as listener:
+        listener.bind(("127.0.0.1", 0))
+        port = listener.getsockname()[1]
+    with tempfile.TemporaryFile() as log:
+        process = subprocess.Popen(
+            [str(app), "-muteDeckAPIEnabled", "YES", "-muteDeckAPIPort", str(port), "-hasCompletedOnboarding", "YES", "-hasAcceptedTerms", "YES", "-SUEnableAutomaticChecks", "NO"],
+            stdout=log, stderr=subprocess.STDOUT,
+        )
+        try:
+            for attempt in range(30):
+                if process.poll() is not None:
+                    raise RuntimeError("CI app exited before the API became ready")
+                try:
+                    with urllib.request.urlopen(f"http://127.0.0.1:{port}/api/info", timeout=2) as response:
+                        info = json.load(response)
+                    break
+                except (urllib.error.URLError, TimeoutError):
+                    time.sleep(1)
+            else:
+                raise RuntimeError("CI API did not become ready")
+            assert info["name"] == "MeetingDebrief", "Unexpected API identity"
+            try:
+                urllib.request.urlopen(f"http://127.0.0.1:{port}/api/recording/status", timeout=2)
+            except urllib.error.HTTPError as error:
+                assert error.code == 401, f"Unexpected status: {error.code}"
+            else:
+                raise RuntimeError("Recording status allowed an unauthenticated request")
+            print("Local API readiness and authentication checks passed")
+        except Exception:
+            if process.poll() is None:
+                sample = subprocess.run(["sample", str(process.pid), "1", "1"], capture_output=True, text=True, timeout=10)
+                print(sample.stdout.split("Binary Images:")[0], file=sys.stderr)
+            log.seek(0)
+            print(log.read().decode(errors="replace")[-8000:], file=sys.stderr)
+            raise
+        finally:
+            if process.poll() is None:
+                process.terminate()
+                try:
+                    process.wait(timeout=10)
+                except subprocess.TimeoutExpired:
+                    process.kill()
+                    process.wait()
+            clear_test_token()

scripts/with_signing_identity.py

@@ -0,0 +1,43 @@
+#!/usr/bin/env python3
+"""Import the CI certificate into an isolated keychain for one release command."""
+import base64
+import os
+import re
+import secrets
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+
+def security(*args):
+    result = subprocess.run(["security", *args], capture_output=True, text=True)
+    if result.returncode:
+        raise RuntimeError(f"security {args[0]} failed (output withheld to protect credentials)")
+    return result.stdout
+
+
+with tempfile.TemporaryDirectory(prefix="meetingnotes-signing-", dir=os.environ["RUNNER_TEMP"]) as directory:
+    keychain = str(Path(directory) / "release.keychain-db")
+    certificate = Path(directory) / "certificate.p12"
+    certificate.write_bytes(base64.b64decode(os.environ["APPLE_CERTIFICATE_P12"]))
+    certificate.chmod(0o600)
+    password = secrets.token_urlsafe(32)
+    created = False
+    try:
+        security("create-keychain", "-p", password, keychain)
+        created = True
+        security("set-keychain-settings", "-lut", "21600", keychain)
+        security("unlock-keychain", "-p", password, keychain)
+        security("import", str(certificate), "-k", keychain, "-P", os.environ["APPLE_CERTIFICATE_PASSWORD"], "-T", "/usr/bin/codesign", "-T", "/usr/bin/security")
+        security("set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", password, keychain)
+        identities = security("find-identity", "-v", "-p", "codesigning", keychain)
+        match = re.search(r'([0-9A-F]{40}) "Developer ID Application:', identities)
+        if not match:
+            raise RuntimeError("The certificate contains no valid Developer ID Application identity")
+        environment = dict(os.environ, SIGNING_IDENTITY=match[1], SIGNING_KEYCHAIN=keychain)
+        status = subprocess.run(sys.argv[1:], env=environment).returncode
+    finally:
+        if created:
+            security("delete-keychain", keychain)
+    sys.exit(status)