Repository navigation
OSS-readiness: install surface, CI gates, checksums, and package channels - #4
Merged
Merged
Conversation
Bring OpenCherry up to the "bare-minimum OSS" pillars: - CI: enforce `cargo fmt --check`, `clippy -D warnings`, and `cargo audit` as dedicated jobs (previously only in the local `just check` recipe). - Releases: add CHANGELOG.md (Keep a Changelog), attach a SHA-256 checksum to every artifact across all three platforms, and drive the GitHub Release body from the changelog (the Linux workflow uniquely owns the body, which is race-safe since action-gh-release@v2 preserves an unset body). - Linux release now builds .deb, .AppImage, and .rpm. - One-command install: scripts/install.sh (curl | sh, GitHub-API asset resolution + SHA-256 verify + desktop integration), scripts/build-appimage.sh, and a `just build-appimage` recipe. - AUR (opencherry-bin) and Homebrew cask packaging, authored but dormant behind the PUBLISH_AUR / PUBLISH_HOMEBREW repo variables and their secrets; maintainer setup documented under packaging/. - Fix stale capitalized OpenCherry_* artifact names in the README and the website install guide to match the current lowercase productName. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ENCpQgGM7BbXt3ah6Bjhci
Mirror the AUR/Homebrew pattern for the Windows Package Manager: - publish-winget job in release-windows.yml using vedantmgoyal9/winget-releaser, gated behind vars.PUBLISH_WINGET and the WINGET_TOKEN secret (tag-only, needs build-windows so the .exe is on the release). - packaging/winget/README.md documents the one-time setup: the manual first submission via wingetcreate, the microsoft/winget-pkgs fork, the classic PAT, and the PUBLISH_WINGET variable. Dormant until configured; never breaks an unconfigured release. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ENCpQgGM7BbXt3ah6Bjhci
The manually-submitted winget PR (microsoft/winget-pkgs#395223) registers the package as 4nrry.OpenCherryDesktop, but the dormant publish-winget job and packaging docs targeted 4nrry.OpenCherry. On the first automated publish this would have created a divergent package that never updates the manually registered one. Point the workflow identifier and README at the same id. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YSHVdqh21CJbX4kixanSzH
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings OpenCherry up to the "bare-minimum OSS" pillars (install surface, enforced CI, changelog-driven releases) without touching any Rust source — all changes are YAML / shell / Markdown / TOML / Ruby.
What's in here
CI quality gates (
ci.yml)fmtjob (cargo fmt --check),clippy -D warningsfolded into therustjob (after the frontend build, withcomponents: clippy), and anauditjob viataiki-e/install-action+cargo audit.CHANGELOG + checksums + release notes
CHANGELOG.md(Keep a Changelog)..sha256is generated and attached for every artifact on all three platforms.awkextract); macOS/Windows attach files only — race-safe becauseaction-gh-release@v2preserves an unset body.AppImage + one-command install
.deb,.AppImage, and.rpm.scripts/install.sh(curl … | sh: GitHub-API asset resolution + SHA-256 verify +.desktopintegration + FUSE warning),scripts/build-appimage.sh, and ajust build-appimagerecipe.OpenCherry_*artifact names fixed in the README and the website install guide to match the current lowercaseproductName.Package-manager channels (dormant, gated)
packaging/aur/PKGBUILD,opencherry-bin), Homebrew Cask (packaging/homebrew/opencherry.rb), and winget (vedantmgoyal9/winget-releaser) publish jobs.PUBLISH_AUR/PUBLISH_HOMEBREW/PUBLISH_WINGET) and its secret, so they never run or break a release until the maintainer wires them up. Setup is documented underpackaging/*/README.md.Verification
cargo fmt,clippy -D warnings, andcargo auditrun green locally (auditexits 0; the 19 findings are non-fatal unmaintained/unsound warnings, including the GTK3 bindings Tauri needs on Linux).actionlintand parse as YAML;sh -n/bash -nclean; the changelogawkextraction was tested.Maintainer follow-ups (after merge)
main, the one-command install (curl … | sh) andjust build-appimagego live (the install URL pinsmain).PUBLISH_*variables (seepackaging/*/README.md). winget additionally needs a manual first submission viawingetcreate..app/.dmgnames once against a real Mac build before enablingPUBLISH_HOMEBREW.cargo auditflags twogit2 0.20.4unsound advisories (RUSTSEC-2026-0183/0184) on a direct dep — non-blocking; bump when convenient.🤖 Generated with Claude Code
https://claude.ai/code/session_01ENCpQgGM7BbXt3ah6Bjhci