Skip to content
Speedwave

Release engineering and signing

Speedwave publishes official application binaries and CLI releases via GitHub Releases. Release packaging, semantic versioning, and binary code signing are automated through GitHub Actions workflows.

Release branch workflow

Section titled “Release branch workflow”

Daily engineering takes place on the dev branch. Feature branches are merged to main via Conventional Commit pull requests (feat:, fix:, etc.):

flowchart TD
  Feature["feat/fix branch"] --> Dev["dev branch"]
  Dev --> Main["main branch"]
  Main --> RP["Release Please PR (Bumps version & changelog)"]
  RP --> Merge["Merge to main"]
  Merge --> GH["GitHub Release + Tag + Signed Binaries"]
  1. Merges to main evaluate commit histories to trigger Release Please.
  2. Release Please authors or updates an active Release Pull Request declaring calculated semantic version increments (major, minor, patch) and updated CHANGELOG.md records.
  3. Merging the Release PR creates a tagged GitHub Release in draft state.

Hotfix procedures

Section titled “Hotfix procedures”

For emergency patch releases:

  1. Branch hotfix/<description> directly from main.
  2. Commit targeted fixes using the conventional format (fix(scope): ...).
  3. Merge the hotfix branch to main, allowing Release Please to generate a patch release.
  4. Cherry-pick commits back into dev to prevent divergence.

Build compilation and code signing

Section titled “Build compilation and code signing”

Merging a Release PR activates desktop-release.yml:

  • macOS application bundles: Compiles universal binaries (ARM64 and x86_64). Every Mach-O binary (CLI, Node.js runtime, Swift helpers) is signed using Apple Developer ID Application certificates with Hardened Runtime flags, followed by Apple Notarization.
  • Windows installers: Compiles 64-bit installers with Authenticode code signing.
  • Tauri updater manifests: Signs updater manifests using dedicated Ed25519 private keys.
  • CLI release archives: Cross-compiles standalone CLI binaries for macOS (ARM64/x86_64) and Windows (x86_64).

Before transitioning releases from draft to public states, verification scripts ensure all expected signed artifacts, signature manifests, and SHA-256 checksums are present. For verification details, see Binary authenticity.