Signing and shipping
A version bump on main is the release. Everything below happens without you watching it.
The workflow tags it, publishes the notes from CHANGELOG.md, and builds a signed and notarized .app and .dmg, .tar.gz/.deb/.AppImage for x86_64 and aarch64, and .zip/.msi with Scoop and Chocolatey manifests. Then it rewrites the Homebrew cask.
Signing credentials are optional — without them every job still runs and produces ad-hoc artifacts with a warning, so a fork keeps building.
Two things that bite. assets/entitlements.plist is not optional: gpui JITs its Metal shaders, so a hardened-runtime build without allow-jit notarizes cleanly and then crashes on first paint. And check the staple, not the signature — a signed-but-not-notarized build looks identical until a stranger downloads it. xcrun stapler validate and spctl -a -vvv -t install are the two commands that actually answer.
Set the Developer ID team in update.rs. Without it guise refuses to execute a downloaded bundle and opens the release page instead — an app that ships notarized builds and forgets this has quietly lost its own update path.