Summary
Once the external release conductor is live, the public repo should build only unsigned artifacts on dispatch and hold no release secrets. This issue tracks the trim. Do not merge until the conductor has produced at least one real signed release, otherwise shipping breaks.
Changes
- Remove in-build signing: drop
osxSign/osxNotarize activation and the macos-signing-setup invocations from frontend-release.yml and frontend-nightly.yml.
- Remove
publisher-github release creation and the alias gh release upload steps from those workflows (the conductor creates releases now).
- Remove the
publish-feed job (feed generation moves to the conductor).
- Delete the nightly
schedule: cron from frontend-nightly.yml (the conductor's cron drives nightly).
- Retire
feature-release.yml (PR previews move to the conductor).
Depends on
The conductor (AgentWrapper/ao-releases) being live and proven. Neutral capability workflow added in #2862.
Summary
Once the external release conductor is live, the public repo should build only unsigned artifacts on dispatch and hold no release secrets. This issue tracks the trim. Do not merge until the conductor has produced at least one real signed release, otherwise shipping breaks.
Changes
osxSign/osxNotarizeactivation and themacos-signing-setupinvocations fromfrontend-release.ymlandfrontend-nightly.yml.publisher-githubrelease creation and the aliasgh release uploadsteps from those workflows (the conductor creates releases now).publish-feedjob (feed generation moves to the conductor).schedule:cron fromfrontend-nightly.yml(the conductor's cron drives nightly).feature-release.yml(PR previews move to the conductor).Depends on
The conductor (AgentWrapper/ao-releases) being live and proven. Neutral capability workflow added in #2862.