Repository navigation
ci(release): scope and lock the signing keychain on 0.7.x - #3092
Conversation
Backports the release.yml part of #3066. Both signing jobs set `environment: release`, the unlock reads the password from standard input with pipefail set, and each job ends by locking the keychain. The one conflict is the build job timeout. This branch keeps its own 60 minutes and its comment, because it does not build bep.
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the
 |
|
Approved: no findings at Nothing to do. Clobber: none seen. |
There was a problem hiding this comment.
Approving. The changed lines are identical to release.yml's in #3066. I diffed the two PRs' changed lines and they match. The 60-minute build timeout is the one difference, as the body says.
The pieces this depends on are already proven on main. Release run 42126774474 ran on d7c85f6, two minutes after #3066 merged. In both build-release-macos-arm64 and sign-macos-artifacts, the stdin unlock signed and notarized, and Lock the signing keychain ran green. The release environment admits main and release/* and holds KC_PW, so release/0.7.x qualifies.
The dry run you list as not yet run is still the real check for this branch. It should show the release deployment and both lock steps.
What
Backports the
release.ymlpart of #3066 torelease/0.7.x:environment: release.pipefailset.if: always()step that locks the keychain.Why
release/0.7.xstill takes patches, so its signing jobs need the same setup asmain.Differences from #3066
bep. That was the only conflict.main.Verification
release.ymlparses, and both jobs showenvironment: releaseand the lock step last.unlock-keychain -premains in the file.release/0.7.xdry run. That needs this merged, and it should create areleasedeployment for the branch.