feat(ci): tenant-locked app builds (IBL_TENANT) with per-tenant releases - #406
Open
sonegillis1 wants to merge 2 commits into
Open
feat(ci): tenant-locked app builds (IBL_TENANT) with per-tenant releases#406sonegillis1 wants to merge 2 commits into
sonegillis1 wants to merge 2 commits into
Conversation
Add an `ibl_tenant` workflow_dispatch input to the macOS and Windows release workflows. When set, it flows to IBL_TENANT (compile-time, option_env! -> get_locked_tenant) so the built app is hard-locked to that tenant (forces the tenant, hides the switcher). The build is then given a tenant-suffixed name and published to a shared per-tenant release (app-v<version>-<tenant>) — DMG + x64/arm64 installers on one release — with a stable download URL surfaced as a badge in the run summary. Normal (multi-tenant) builds are unchanged; all tenant logic is gated on ibl_tenant != ''. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
macOS will not hide the ".app" extension for "ibl.ai.app": ".ai" is a registered file extension, so Finder shows the full name regardless of the extension-hidden FinderInfo bit (verified — even Finder's own `set extension hidden` leaves the displayed name "ibl.ai.app", whereas e.g. zoom.us.app hides fine because ".us" is not registered). The re-master step set the bit (confirmed =1 on shipped DMGs) with zero visible effect, while adding a full re-sign + re-notarize + re-staple round — the exact step that failed the 0.95.7 release. Remove it; the DMG now ships as tauri-action builds it (already signed, notarized, stapled). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wires the existing (shipped)
IBL_TENANTtenant-lock feature into the release pipeline so tenant-locked desktop apps can be produced from CI.What it does
On Actions → Release macOS DMG / Release Windows → Run workflow, a new
ibl_tenantinput:IBL_TENANT(compile-timeoption_env!→get_locked_tenant), so the built app is hard-locked to that tenant — forces the tenant on open, hides the tenant switcher (seehooks/use-tenant-lock.ts,components/tenant-lock.tsx).ibl.ai_<version>_<tenant>_universal.dmg,…_<tenant>_<arch>-setup.exe) so it never collides with the standard build.app-v<version>-<tenant>(DMG + x64/arm64 installers on one release) with a stable public download URL.Normal (multi-tenant) builds are unchanged — every tenant path is gated on
ibl_tenant != ''.Files
reusable-release-macos-dmg.yml/release-macos-dmg.yml— input,IBL_TENANTenv, tenant-publish step + dispatch passthrough.reusable-release-windows.yml/release-windows.yml— same, per-arch (x64 + arm64) publishing to the shared release.Testing
CI-only (can't run locally). Trigger a tenant dispatch from this branch (
workflow_dispatchruns the workflow from the selected branch) to validate before merge.🤖 Generated with Claude Code