the_og
6fce19cc67
CI / Tests (py3.10 / ubuntu-latest) (push) Successful in 10s
CI / Tests (py3.12 / ubuntu-latest) (push) Successful in 10s
CI / Lint (ruff) (push) Successful in 6s
CI / Tests (py3.12 / windows-latest) (push) Successful in 23s
CI / Tests (py3.13 / ubuntu-latest) (push) Successful in 10s
CI / Catalog signature (push) Successful in 6s
Two gaps closed now that a real key exists. 1. CI 'Catalog signature' job (the #61 gate): every push/PR verifies data/catalog.json against data/catalog.json.sig using the public key in bcc_core, and runs validate_catalog. The threat model here is not an outsider pushing to the repo -- it is merging a friendly-looking PR without really reading it. A contributor can change catalog.json but cannot produce a matching signature, so a blindly-merged PR now lands as a red build within a minute instead of quietly riding into the next release. Public-key only; no secret involved. 2. release.yml 'Signing key smoke test' (workflow_dispatch only): the Publish job is gated on a tag, so a manual run never exercised signing -- a wrong or missing RELEASE_SIGNING_KEY would first surface during a real release. This signs a throwaway manifest with the secret and verifies it against the public key compiled into bcc_core, proving the two halves of the keypair actually match. Publishes nothing.
273 lines
11 KiB
YAML
273 lines
11 KiB
YAML
name: Build & Release
|
|
|
|
# Trigger on version tags (e.g. git tag v1.0.0 && git push --tags)
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*"
|
|
# Manual run from Actions tab (useful for testing the workflow itself)
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build:
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- os: macos-latest
|
|
platform: macOS
|
|
artifact: BetterClaudeConfig-macOS.zip
|
|
- os: windows-latest
|
|
platform: Windows
|
|
artifact: BetterClaudeConfig-Windows.zip
|
|
- os: ubuntu-latest
|
|
platform: Linux
|
|
artifact: BetterClaudeConfig-Linux.tar.gz
|
|
|
|
runs-on: ${{ matrix.os }}
|
|
name: Build (${{ matrix.platform }})
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Python 3.12 (Linux)
|
|
if: runner.os == 'Linux'
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Set up Python venv (macOS)
|
|
if: runner.os == 'macOS'
|
|
run: |
|
|
PYBIN="$(command -v python3.12 || echo /opt/homebrew/bin/python3.12)"
|
|
"$PYBIN" -m venv .venv
|
|
echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
|
|
|
|
- name: Set up Python venv (Windows)
|
|
if: runner.os == 'Windows'
|
|
shell: pwsh
|
|
run: |
|
|
py -3.12 -m venv .venv
|
|
Add-Content -Path $env:GITHUB_PATH -Value "$env:GITHUB_WORKSPACE\.venv\Scripts"
|
|
|
|
- name: Install dependencies
|
|
run: pip install -r requirements-dev.txt
|
|
|
|
# macOS: build app.icns from source PNGs (iconutil is built into macOS)
|
|
- name: Generate app.icns (macOS)
|
|
if: runner.os == 'macOS'
|
|
run: python scripts/build_icons.py
|
|
|
|
# Windows: generate app.ico using Pillow (already installed via requirements-dev.txt)
|
|
- name: Generate app.ico (Windows)
|
|
if: runner.os == 'Windows'
|
|
run: python scripts/build_icons.py
|
|
|
|
- name: Build with PyInstaller
|
|
run: pyinstaller bcc.spec
|
|
|
|
# ── Package ──────────────────────────────────────────────────────────
|
|
|
|
- name: Package (macOS)
|
|
if: runner.os == 'macOS'
|
|
run: |
|
|
cd dist
|
|
zip -r --symlinks "../${{ matrix.artifact }}" BetterClaudeConfig.app
|
|
|
|
- name: Package (Windows)
|
|
if: runner.os == 'Windows'
|
|
shell: pwsh
|
|
run: |
|
|
Compress-Archive -Path dist\BetterClaudeConfig.exe `
|
|
-DestinationPath "${{ matrix.artifact }}"
|
|
|
|
- name: Package (Linux)
|
|
if: runner.os == 'Linux'
|
|
run: |
|
|
tar -czf "${{ matrix.artifact }}" -C dist BetterClaudeConfig
|
|
|
|
# ── Upload artifact for the release job ──────────────────────────────
|
|
|
|
- name: Upload artifact
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: ${{ matrix.artifact }}
|
|
path: ${{ matrix.artifact }}
|
|
|
|
# ── Signing-key smoke test (workflow_dispatch only) ─────────────────────
|
|
#
|
|
# The Publish job is gated on a tag, so a manual run never exercises the
|
|
# signing step — which means a wrong/missing RELEASE_SIGNING_KEY secret
|
|
# would only be discovered at the worst possible moment: during a real
|
|
# release. This job signs a throwaway manifest with the secret and verifies
|
|
# the result against the PUBLIC key already compiled into bcc_core.
|
|
#
|
|
# It proves the two halves of the keypair actually match, without
|
|
# publishing anything. Run it from the Actions tab after setting or
|
|
# rotating the secret.
|
|
signing-smoke-test:
|
|
name: Signing key smoke test
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'workflow_dispatch'
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Install dependencies
|
|
run: pip install cryptography
|
|
|
|
- name: Sign a throwaway manifest and verify against the shipped pubkey
|
|
env:
|
|
RELEASE_SIGNING_KEY: ${{ secrets.RELEASE_SIGNING_KEY }}
|
|
run: |
|
|
if [ -z "$RELEASE_SIGNING_KEY" ]; then
|
|
echo "FAIL: RELEASE_SIGNING_KEY secret is not set."
|
|
echo "Generate it with: python catalog_console.py show-seed-b64"
|
|
echo "then add it under Settings -> Actions -> Secrets."
|
|
exit 1
|
|
fi
|
|
mkdir -p smoke && echo "smoke test payload" > smoke/hello.txt
|
|
python3 scripts/sign_checksums.py generate smoke --out smoke/SHA256SUMS
|
|
python3 scripts/sign_checksums.py sign --sums smoke/SHA256SUMS --out smoke/SHA256SUMS.sig
|
|
python - <<'PY'
|
|
import base64, pathlib, sys
|
|
import bcc_core as c
|
|
from scripts.sign_checksums import verify_checksums
|
|
|
|
# The public half that ships inside the binary. If the secret is a
|
|
# DIFFERENT key than the one users' copies trust, this fails here --
|
|
# which is the entire point of the job.
|
|
pub_b64 = base64.b64encode(c.CATALOG_PUBKEYS[0]).decode()
|
|
|
|
sums = pathlib.Path("smoke/SHA256SUMS").read_text()
|
|
sig = pathlib.Path("smoke/SHA256SUMS.sig").read_bytes()
|
|
|
|
if not verify_checksums(pub_b64, sums, sig):
|
|
sys.exit(
|
|
"FAIL: the signature produced by RELEASE_SIGNING_KEY does NOT verify\n"
|
|
"against the public key in bcc_core.CATALOG_PUBKEYS.\n"
|
|
"\n"
|
|
"The secret and the shipped public key are different keypairs. Users\n"
|
|
"would reject every signature this CI produces. Re-copy the seed from\n"
|
|
"`catalog_console.py show-seed-b64`, or update CATALOG_PUBKEYS."
|
|
)
|
|
print("OK: RELEASE_SIGNING_KEY matches the public key shipped in bcc_core.")
|
|
PY
|
|
|
|
# ── Create GitHub Release with all three artifacts ──────────────────────
|
|
|
|
release:
|
|
name: Publish Release
|
|
needs: build
|
|
runs-on: ubuntu-latest
|
|
# Only publish when a tag was pushed (not on workflow_dispatch without a tag)
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
permissions:
|
|
contents: write
|
|
|
|
steps:
|
|
# Needed for scripts/sign_checksums.py — the release job otherwise
|
|
# only downloads build artifacts, it doesn't check out the repo.
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Download all artifacts
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
path: artifacts
|
|
|
|
- name: Set up Python 3.12
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
# download-artifact@v3 nests each artifact under a directory named
|
|
# after it (artifacts/<name>/<name>). Flatten into one directory so
|
|
# SHA256SUMS lists plain filenames, matching what `sha256sum -c`
|
|
# expects when run from inside an extracted release download.
|
|
- name: Collect release files
|
|
run: |
|
|
mkdir -p release-files
|
|
find artifacts -type f -exec cp {} release-files/ \;
|
|
ls -la release-files
|
|
|
|
- name: Generate SHA256SUMS
|
|
run: python3 scripts/sign_checksums.py generate release-files --out release-files/SHA256SUMS
|
|
|
|
# ── Sign the checksum manifest (best-effort) ──────────────────────
|
|
#
|
|
# BCC binaries are not code-signed (no budget for a paid cert). This
|
|
# is the free half: a checksum manifest, detached-signed with
|
|
# Ed25519, so a tampered download is detectable by anyone who
|
|
# checks. It does NOT remove Gatekeeper/SmartScreen warnings.
|
|
#
|
|
# The private key is a repo secret (RELEASE_SIGNING_KEY, base64 raw
|
|
# Ed25519 seed) generated via the Catalog Console (#62). If it's not
|
|
# set, we still publish the release — just without a .sig — rather
|
|
# than fail the release outright.
|
|
- name: Check for signing key
|
|
id: signing
|
|
run: |
|
|
if [ -n "${{ secrets.RELEASE_SIGNING_KEY }}" ]; then
|
|
echo "has_key=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "has_key=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Install signing dependencies
|
|
if: steps.signing.outputs.has_key == 'true'
|
|
run: pip install cryptography
|
|
|
|
- name: Sign SHA256SUMS
|
|
if: steps.signing.outputs.has_key == 'true'
|
|
env:
|
|
RELEASE_SIGNING_KEY: ${{ secrets.RELEASE_SIGNING_KEY }}
|
|
run: |
|
|
python3 scripts/sign_checksums.py sign \
|
|
--sums release-files/SHA256SUMS \
|
|
--out release-files/SHA256SUMS.sig
|
|
|
|
- name: Warn — release will be unsigned
|
|
if: steps.signing.outputs.has_key != 'true'
|
|
run: |
|
|
echo "::warning::RELEASE_SIGNING_KEY secret is not set — this release is being published WITHOUT a signed SHA256SUMS.sig. Add the secret (base64 raw Ed25519 seed, generated via the Catalog Console, #62) before the next tag."
|
|
|
|
- name: Create GitHub Release
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
name: Better Claude Config ${{ github.ref_name }}
|
|
draft: false
|
|
prerelease: false
|
|
generate_release_notes: false
|
|
files: |
|
|
artifacts/**/*
|
|
release-files/SHA256SUMS*
|
|
body: |
|
|
## Better Claude Config ${{ github.ref_name }}
|
|
|
|
A GUI for managing MCP server configurations for Claude Desktop and Claude Code — no hand-editing JSON.
|
|
|
|
### Download
|
|
|
|
| Platform | File |
|
|
|----------|------|
|
|
| macOS | `BetterClaudeConfig-macOS.zip` — unzip and drag **BetterClaudeConfig.app** to Applications |
|
|
| Windows | `BetterClaudeConfig-Windows.zip` — unzip and run **BetterClaudeConfig.exe** |
|
|
| Linux | `BetterClaudeConfig-Linux.tar.gz` — extract and run **BetterClaudeConfig** |
|
|
|
|
### macOS note
|
|
The app is not code-signed. On first launch, right-click → **Open** to bypass Gatekeeper, or run:
|
|
```
|
|
xattr -cr /Applications/BetterClaudeConfig.app
|
|
```
|
|
|
|
### Verifying your download
|
|
Every release includes `SHA256SUMS` (and, when the signing key is configured, a detached `SHA256SUMS.sig`). See [Verifying your download](https://git.avezzano.io/the_og/better-claude-config#verifying-your-download) in the README for commands. This proves you got the file we published — it does not remove Gatekeeper/SmartScreen warnings.
|
|
|
|
### Requirements
|
|
No Python installation needed — the app is self-contained.
|