release

Release

Execute a Cyboflow release. The authoritative procedure and its rationale live in docs/RELEASE-RUNBOOK.md — read it first; this skill is the executable checklist. Work through the phases in order and do not skip verification.

Guardrails

• Never run build:mac:universal — it fails on the bundled claude/codex binaries. The release is per-arch DMGs.
• R2 is the real release channel, not GitHub. The app auto-updates from updates.cyboflow.com/<variant>/latest-mac.yml (R2) and never reads the GitHub release. Publishing GitHub without the R2 step (Phase 5) leaves every user on the old version. Do NOT call the release done until both R2 feeds show the new version.
• Hold all outward actions until the user confirms. Do the gate, bump, builds, and verification, then stop and ask before publishing to R2, pushing main, the tag, or the GitHub release — unless the user has already said to push without asking.
• Every mac build recompiles native modules for the Electron ABI; restore the host-Node ABI afterward — rebuild both or the gate fails with a pty.node / better_sqlite3.node dlopen arch mismatch: pnpm rebuild better-sqlite3 @homebridge/node-pty-prebuilt-multiarch.
• Don't launch the app while a build:mac runs (it can wedge the DMG eject).

Phase 0 — Preconditions

1. Confirm a clean tree on main (git status), and read the recent log to see what's shipping (git log --oneline v<last>..HEAD).
2. Decide the new version. Default is a patch bump of the current package.json version; ask the user if a minor/major bump is intended.
3. Confirm creds exist in ./.envrc.local (8 vars): Apple APPLE_ID, APPLE_TEAM_ID, APPLE_APP_SPECIFIC_PASSWORD, CSC_LINK, CSC_KEY_PASSWORD
   • R2 R2_ACCOUNT_ID, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY.
4. Re-resolve the dependency tree before gating — the gate is otherwise blind to lockfile defects:

   pnpm install --frozen-lockfile
   

   node_modules can be self-consistent while the lockfile is not, so Phase 1 would pass against dependencies that no longer match what CI installs. This is exactly how 0.2.9 shipped a dead E2E suite: a dep bump split playwright (1.62.1) from @playwright/test (1.54.1) in the lock, but the un-reinstalled tree still held a matched 1.54.1 pair, so the local smoke tier passed and every nightly after it failed at spec collection. --frozen-lockfile also hard-fails outright when package.json and the lockfile disagree. Runs BEFORE step 5 on purpose: it prunes to host arch, so the cross-arch binary check must follow it, never precede it.
5. Confirm all four agent binaries are present (a plain install prunes to host arch):

   ls -d node_modules/@anthropic-ai/claude-agent-sdk-darwin-{arm64,x64} \
         node_modules/@openai/codex-darwin-{arm64,x64}
   

   If any are missing, run the cross-arch install with --force (see runbook).