skatespots/SkateSpots
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions 1

docs(release): record 1.7.1; release.sh reads protected zsp.env by default

Browse source
This commit is contained in:
SkateSpots 2026-10-27 09:15:01 +07:00
parent 118b91188e
commit ab3ceb0363
2 changed files with 23 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
AGENTS.md
View file

@ -2232,13 +2232,18 @@ Rules:
`SIGN_WITH="$(sed -n 's/^SIGN_WITH=//p' ~/.config/skatespots/zsp.env)"; export SIGN_WITH`. `SIGN_WITH="$(sed -n 's/^SIGN_WITH=//p' ~/.config/skatespots/zsp.env)"; export SIGN_WITH`.
Complete non-interactive publish: Complete non-interactive publish:
`SIGN_WITH="$(sed -n 's/^SIGN_WITH=//p' ~/.config/skatespots/zsp.env)"; export SIGN_WITH; zsp publish --quiet zapstore.yaml` `SIGN_WITH="$(sed -n 's/^SIGN_WITH=//p' ~/.config/skatespots/zsp.env)"; export SIGN_WITH; zsp publish --quiet zapstore.yaml`
✅ **Published 1.6.1–1.7.0 on 2026-10-12/26** — the app's usual path is an **inline ✅ **Published 1.6.1–1.7.1 on 2026-10-12/27** — use the protected
`SIGN_WITH=<nsec1…>`** (the value lives only in the shell/history, never in `~/.config/skatespots/zsp.env` (mode 600) via **`scripts/release.sh`**;
the repo); verify the signer is the app identity first (`nak key public` → the old inline `SIGN_WITH=<nsec1…>` path still works but should not be used.
Verify the signer is the app identity first (`nak key public` →
`npub1yrnuj…` / hex `20e7c953…`). Use **`~/go/bin/zsp`** (v0.4.11) — the `npub1yrnuj…` / hex `20e7c953…`). Use **`~/go/bin/zsp`** (v0.4.11) — the
`zsp` on `PATH` (`~/.local/bin/zsp`) is older (v0.4.10). `zsp` warns that a `zsp` on `PATH` (`~/.local/bin/zsp`) is older (v0.4.10). `zsp` warns that a
nsec in env is insecure (prefer `bunker://`); the relay event to check is nsec in env is insecure (prefer `bunker://`); the relay event to check is
`nak req -k 30063 -d org.skatespots.app@<version> wss://relay.zapstore.dev`. `nak req -k 30063 -d org.skatespots.app@<version> wss://relay.zapstore.dev`.
- **1.7.1 (2026-10-27):** Hindi + Catalan/Basque/Galician (24 dictionaries /
25 codes), regional flag SVGs + English/Portuguese variants, single-world
map clamp with horizontal wrap to the Pacific, menu hardening; APK sha256
`846925af…`, versionCode 10701, released with `scripts/release.sh`.
### Relay archive (dataset backup) ### Relay archive (dataset backup)
- **Transfer content between keys (`scripts/transfer-content.mjs`, 2026-10-04):** - **Transfer content between keys (`scripts/transfer-content.mjs`, 2026-10-04):**
@ -2377,7 +2382,8 @@ Rules:
`~/.local/state/skatespots-deps/failures/` (8 kept, rotated) and a `~/.local/state/skatespots-deps/failures/` (8 kept, rotated) and a
`last-failure` marker; reports keep 12. Releases are one command via `last-failure` marker; reports keep 12. Releases are one command via
**`scripts/release.sh`** (notes check → `npm test` → bump → Android build → **`scripts/release.sh`** (notes check → `npm test` → bump → Android build →
`zsp publish` → relay verification → commit/push + tag). The deploy timer has `zsp publish` → relay verification → commit/push + tag), reading the 0600
`~/.config/skatespots/zsp.env` by default. The deploy timer has
`TimeoutStartSec=20min`, and all deploy/deps units are tracked in `TimeoutStartSec=20min`, and all deploy/deps units are tracked in
`scripts/systemd/`. `scripts/systemd/`.

20
scripts/release.sh
View file

@ -10,11 +10,9 @@
# Before running: # Before running:
# 1. write the new section at the TOP of release-notes.txt (do not commit it — # 1. write the new section at the TOP of release-notes.txt (do not commit it —
# this script commits it with the version bump); # this script commits it with the version bump);
# 2. provide the release signer WITHOUT putting it in shell history: # 2. the signer is read from ~/.config/skatespots/zsp.env (chmod 600) by
# export SIGN_WITH=nsec1... # current shell only # default. You can also export SIGN_WITH for the current shell, or set
# or point at a 0600 file: # SKATES_RELEASE_ENV to another 0600 file.
# export SKATES_RELEASE_ENV=$HOME/.config/skatespots/release.env
# # file contains: SIGN_WITH=nsec1...
# #
# What it does NOT do: deploy the web (the skatespots-deploy.timer does that # What it does NOT do: deploy the web (the skatespots-deploy.timer does that
# within ~3 min, 24h throttle) or touch the relay. # within ~3 min, 24h throttle) or touch the relay.
@ -35,15 +33,23 @@ log() { echo "• $*"; }
[ -x "$ZSP" ] || die "zsp not found/executable at $ZSP (set ZSP=...)" [ -x "$ZSP" ] || die "zsp not found/executable at $ZSP (set ZSP=...)"
[ -d "$ANDROID_HOME" ] || die "Android SDK not found at $ANDROID_HOME (set ANDROID_HOME=...)" [ -d "$ANDROID_HOME" ] || die "Android SDK not found at $ANDROID_HOME (set ANDROID_HOME=...)"
# Optional protected env file (never commit it). # Protected env file (never commit it). Prefer the file documented in AGENTS.
if [ -z "${SKATES_RELEASE_ENV:-}" ] && [ -f "$HOME/.config/skatespots/zsp.env" ]; then
SKATES_RELEASE_ENV="$HOME/.config/skatespots/zsp.env"
fi
if [ -z "${SIGN_WITH:-}" ] && [ -n "${SKATES_RELEASE_ENV:-}" ]; then if [ -z "${SIGN_WITH:-}" ] && [ -n "${SKATES_RELEASE_ENV:-}" ]; then
[ -f "$SKATES_RELEASE_ENV" ] || die "SKATES_RELEASE_ENV does not exist: $SKATES_RELEASE_ENV" [ -f "$SKATES_RELEASE_ENV" ] || die "SKATES_RELEASE_ENV does not exist: $SKATES_RELEASE_ENV"
mode="$(stat -c %a "$SKATES_RELEASE_ENV" 2>/dev/null || echo '?')"
case "$mode" in
600|400) ;;
*) log "warning: $SKATES_RELEASE_ENV is mode $mode (chmod 600 recommended)" ;;
esac
set -a set -a
# shellcheck disable=SC1090 # shellcheck disable=SC1090
. "$SKATES_RELEASE_ENV" . "$SKATES_RELEASE_ENV"
set +a set +a
fi fi
[ -n "${SIGN_WITH:-}" ] || die "SIGN_WITH is not set (export it or use SKATES_RELEASE_ENV)" [ -n "${SIGN_WITH:-}" ] || die "SIGN_WITH is not set (use ~/.config/skatespots/zsp.env, SKATES_RELEASE_ENV, or export it)"
# Resolve the newest nvm Node (the old hard-coded path breaks after upgrades). # Resolve the newest nvm Node (the old hard-coded path breaks after upgrades).
if [ -d "$HOME/.nvm/versions/node" ]; then if [ -d "$HOME/.nvm/versions/node" ]; then