Skip to content
AMX
Esc
↑↓navigate↵open⌘Jpreview
On this page

Release

How a release of Activity Monitor X is made and put on Homebrew.

A tag starts a release. The GitHub Actions workflow .github/workflows/release.yml runs on the xcode-27 runner (Apple silicon).

Make a release

  1. Write the new version in VERSION, for example 0.2.0, and commit it.
  2. Tag the commit with the same version, then push the tag:
git tag v0.2.0
git push origin v0.2.0

The workflow stops if the tag is not v followed by the version in VERSION.

What the workflow does

  1. It runs the tests.
  2. It builds the app and the helper, signs them with the release certificate, and makes the disk image.
  3. It checks that the app and the helper are signed with the certificate that CERT in website/public/install.sh names.
  4. It publishes a GitHub release with AMX-<version>.dmg, its SHA-256 file AMX-<version>.dmg.sha256, and AMX.dmg. The install script always downloads the AMX.dmg of the latest release.
  5. If TAP_TOKEN is set, it writes the new version, the checksum and the certificate into Casks/amx.rb in HenryQW/homebrew-tap.

Signing

A release has no Developer ID signature, so Apple does not notarize it. The install script downloads with curl, which adds no quarantine flag, and the cask removes the flag. Both accept only an app and a helper that the release certificate signed.

The release certificate

The helper runs as root, and it can quit processes. So it accepts only callers that are signed with the same certificate as itself. Each release must be signed with one stable certificate: the app and amx of a release then work with its helper, and nothing else can talk to the helper. The release certificate is a self-signed code-signing certificate. The workflow gets it, with its private key, from the repository secrets.

The secrets

Set these in the repository settings, under Secrets and variables > Actions:

Secret What it holds
RELEASE_CERT_P12 The release certificate and its private key, as a .p12 file in base64.
RELEASE_CERT_PASSWORD The password of that .p12 file.
TAP_TOKEN A fine-grained token with write access to the contents of HenryQW/homebrew-tap. Without it the release still publishes, and the tap does not change.

Scripts/make-release-cert.sh makes the release certificate once and prints the two values for RELEASE_CERT_P12 and RELEASE_CERT_PASSWORD. Keep the .p12 file out of the repository. It also prints the SHA-1 of the certificate: put it in CERT in website/public/install.sh. A code requirement takes only a SHA-1. If you change the certificate, change CERT in the same commit, or the next release stops at the check.

The Homebrew tap

The tap is the repository HenryQW/homebrew-tap. The workflow writes Casks/amx.rb from the template Packaging/homebrew/amx.rb. Users install with:

brew trust --tap henryqw/tap && brew install --cask henryqw/tap/amx

A tap is a public GitHub repository whose name starts with homebrew-. brew trust --tap henryqw/tap lets Homebrew load casks from it. brew install --cask henryqw/tap/amx clones github.com/HenryQW/homebrew-tap (the first time only), reads Casks/amx.rb, downloads the disk image from the GitHub release, checks its SHA-256, copies the app to /Applications, and links amx. brew update gets new versions of the cask. Homebrew does not review a tap. The tap and the amx repository must be public: Homebrew downloads without a GitHub sign-in.

To check the cask before a release, fill in the template and run brew style on it.

The official Homebrew cask repository does not take AMX: it accepts only apps that pass Gatekeeper, so it needs a Developer ID and notarization.