ship

Ship Skill — Signing, Packaging, and Distribution

Overview

The pulp ship command handles the full distribution pipeline: code signing, Apple notarization, platform-specific packaging, update feed generation, and Android APK/AAB builds.

For the end-to-end release pipeline that turns a merged PR into a published GitHub Release (auto-release.yml → sign-and-release.yml → release-cli.yml, the 11 published assets, and the failure-mode triage by which asset is missing), see docs/guides/release-pipeline.md. Cross-reference comments at the top of release-cli.yml and sign-and-release.yml point back to that doc — keep them in sync when either workflow changes ownership of appcast generation, draft creation, or the matrix-tarball upload.

There is no Intel/universal gate on the release path. A universal-arch-gate job used to build PulpGain universal and run dual-arch auval on every tag. It was removed: it is redundant with nightly-intel.yml's universal-crosscheck (same check) and intel-portability.yml (Intel at PR time), and — worse — it pinned itself to the GitHub-hosted macos-15 pool for ~2h per tag, which is the SAME scarce pool the release's own required darwin-x64 legs need. At ~14 tags/day it queued ~28 macOS-hours/day of hosted work ahead of the leg that actually gates publication, while the self-hosted Studios sat idle. Never put an advisory check in front of the release on a pool the release itself competes for. (Universal-build gotcha worth keeping: a raw lipo'd wgpu dylib fails codesign --verify and the arm64 slice is SIGKILL'd at load — always re-sign after lipo.) See docs/guides/intel-support.md.

Which platforms a release ships is active_platforms in release_product_matrix.json — one field consumed by the build/smoke matrix (release_build_matrix.py), the publish-time content verification, and the --exact-required asset list, so the built legs and the demanded assets cannot desync. Absent = full inventory; a subset (e.g. ["darwin-arm64"]) pauses the other platforms' legs AND drops their archives from the asset contract in one edit. The publish step reads it from the default branch, so the flip governs re-dispatches and backfills too. Paused platforms are time-boxed by release-platform-subset-check.yml (7 days → tracking issue). The per-release asset table in docs/guides/release-pipeline.md describes the full inventory; a subset release legitimately carries fewer rows, and installers for paused platforms serve users from the last release that carried them. The narrowing is permanent per release: a published GitHub release is immutable, so every tag published while the field is narrow ships without the paused platforms' assets forever — widening the field later cannot repair them; only a new tag can. The 7-day check catches a subset that outlives its purpose, NOT a release that shipped incomplete inside the window — that one is already immutable by the time the issue opens.