Releases

Cretty uses release-please and tag-driven builds, following Cagent’s release process. The first release is bootstrapped at 0.1.0. The repository remains Cretezy/cretty_private; releases do not rename it or change its visibility.

Release a version

1. Use Conventional Commits on main. Prepare releases maintains a release PR with the version and changelog. Configure RELEASE_PLEASE_TOKEN with repository permission to update branches/PRs and create tags; the normal Actions token cannot trigger the separate tag workflow.
2. Review the PR and run python3 scripts/check-release-version.py plus the normal workspace and docs checks. The workspace, version.txt, and local lockfile packages must agree.
3. Complete the release rehearsal, then merge the PR. The resulting v<version> tag runs reusable CI, validates the version, builds the matrix, and publishes a GitHub Release with SHA256SUMS.

Platform	Targets	Artifacts
Linux	x86-64, Arm64	Portable archive and Debian package.
macOS	Intel x86-64, Apple Silicon Arm64	Signed and notarized app archive.

Archives are named cretty-<Rust target>.tar.gz. They include the application, LICENSE, THIRD_PARTY_NOTICES.md, and licenses/. Windows is experimental and outside the release matrix. See the workflow for pinned tools and packaging details.

Manual workflow_dispatch builds unsigned rehearsal artifacts without publishing. It does not validate production signing.

macOS signing

Tag releases require these repository/environment secrets:

Secret	Value
APPLE_CERTIFICATE_P12	Base64-encoded Developer ID Application certificate/private key in P12 format.
APPLE_CERTIFICATE_PASSWORD	P12 password.
APPLE_SIGNING_IDENTITY	Developer ID Application identity.
APPLE_ID	Apple account for notarization.
APPLE_APP_SPECIFIC_PASSWORD	App-specific password.
APPLE_TEAM_ID	Developer team identifier.

The workflow imports a temporary keychain, signs with the hardened runtime, notarizes, and staples the app before archiving. Local builds are unsigned.

Release rehearsal

Before the first release, and after relevant packaging or platform changes:

• Run workspace checks, docs validation/build, dependency auditing, and a full-history secret scan. Review asset notices and screenshots.
• Install the actual artifacts on a clean account/machine for each target. Check checksum failures, first launch, reinstall, and uninstall.
• On macOS, verify Finder launch, signing, and notarization on another machine.
• On Linux, test X11 and Wayland: launcher, clipboard, notifications, links, fonts, images, and a full-screen TUI.
• Exercise shell startup recovery, settings save/reload, session restoration, and tab/group/window closure. Record OS, architecture, backend, and results.

These checks must be performed; the matrix alone is not evidence that they passed. Before the later public rename, update repository links and installer URLs together.

Documentation deployment

The docs workflow builds on PRs and deploys main to cretty.cretezy.com through Cloudflare Workers Static Assets. docs/wrangler.jsonc contains the public account ID and custom domain. Set GitHub’s CLOUDFLARE_API_TOKEN secret with Workers Scripts Write, Zone Read, and Workers Routes Write for cretezy.com. No additional account variable is needed. bun run deploy in docs/ deploys an authenticated local build.