8000 chore: prepare v0.1.0 beta release by shroominic · Pull Request #25 · shroominic/OpenGlucose · GitHub
[go: up one dir, main page]

Skip to content

chore: prepare v0.1.0 beta release - #25

Merged
shroominic merged 7 commits into
mainfrom
chore/v0.1.0-beta-release
Aug 13, 2026
Merged

shroominic merged 7 commits into
mainfrom
chore/v0.1.0-beta-release

Conversation

@shroominic
Copy link
Copy Markdown
Owner

Summary

  • integrate the locally tested sensor lifecycle, archive, settings, analytics, and single-file export work for the beta
  • bump the Flutter app to 0.1.0+17 and add truthful beta release notes
  • add a fail-closed Android prerelease workflow triggered by publishing a GitHub prerelease
  • require a protected signing environment, verify the exact signer/package/version/permissions/digest, attest the APK, and attach exactly one verified asset
  • add INTERNET to the release manifest so the explicitly enabled BYO-key HTTPS integration works outside debug builds

Release safety

  • the historical v0.0.1+10 APK is debug-signed and cannot be upgraded in place with the new dedicated beta certificate
  • the old APK has no migration/export path; release notes warn that uninstalling deletes its local data
  • the release verifier rejects the historical debug certificate, multiple signers, debuggable APKs, identity/version drift, and missing network permission
  • release upload is bound to the immutable release-event commit and exact GitHub release ID; it refuses pre-existing assets and never overwrites

Verification

  • make check (all package/app tests, integration test, Android debug build, web build, iOS build, and native iOS tests)
  • make tooling-check format-check lint
  • flutter test --no-pub test/privacy_release_defaults_test.dart
  • signed local flutter build apk --release --no-pub
  • verified local APK as com.openglucose.app, version 0.1.0 build 17, one non-debug signer, required permission, SHA-256 582db2fb645a32c17f81c8705b488097fc0302931514d9c92d5f38a9421effa8
  • confirmed the verifier rejects the published historical debug-signed APK

Release operation after merge

Create and protect the android-release environment, install the five signing secrets, protect v* tags, then publish v0.1.0 as a prerelease. The workflow must build, attest, and attach openglucose-0.1.0+17.apk; an assetless or failed prerelease must not be silently recreated or overwritten.

@shroominic
shroominic merged commit 145022a into main Aug 13, 2026
9 checks passed
@shroominic
shroominic deleted the chore/v0.1.0-beta-release branch August 13, 2026 12:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

0