Release Process

Production Windows builds use PyInstaller with a gated pipeline in scripts/release_build.ps1.

Quick commands

Goal	Command
Production release	`build_release.bat` or `powershell -File .\scripts\release_build.ps1`
Dev build (Desktop copy)	`build_exe.bat` or `powershell -File .\scripts\setup_and_build.ps1`
Skip tests (dev only)	`powershell -File .\scripts\setup_and_build.ps1 -SkipTests`

Production pipeline (`release_build.ps1`)

Resolve Python 3.10+
Install requirements.txt + dev-requirements.txt (PyInstaller 6.10.0 pinned)
Test gate: compileall + unittest discover (skip with -SkipTests — not for prod)
Download & SHA-verify bundled gost.exe → proxy_chain_manager/_bundled/
Generate Windows VERSIONINFO → build/version_info.txt
PyInstaller one-file build via ProxyChainManager.spec
Optional Authenticode sign (see below)
SHA256 sidecar for the exe
SBOM (SBOM.json + requirements-frozen.txt)
RELEASE_MANIFEST.json (version, commit, sha256, build time)
Zip → releases/ProxyGod-v{version}-windows-amd64.zip

Output layout

releases/
  v1.0.0/
    ProxyChainManager.exe
    ProxyChainManager.exe.sha256
    RELEASE_MANIFEST.json
    SBOM.json
    requirements-frozen.txt
    LICENSE
    OPERATOR_RUNBOOK.md
  ProxyGod-v1.0.0-windows-amd64.zip
dist/
  ProxyChainManager.exe          # same binary (developer convenience)
  ProxyChainManager.exe.sha256

Version numbering

Resolved in order:

-Version parameter to release_build.ps1
Exact git tag on current commit (git describe --tags --exact-match)
git describe --tags --always --dirty
proxy_chain_manager.__version__

Tag releases with v1.2.3 — CI release.yml runs automatically on v* tags.

Authenticode signing (optional)

Set before building:

$env:SIGN_CERT_PATH = "C:\certs\proxygod.pfx"
$env:SIGN_CERT_PASSWORD = "your-password"   # optional if pfx has no password
powershell -File .\scripts\release_build.ps1

Requires Windows SDK (signtool.exe on PATH). Without a cert, the build completes unsigned (SmartScreen may warn on first run).

CI / GitHub Releases

Every push/PR: .github/workflows/test.yml — unit tests only
Tag v* or manual dispatch: .github/workflows/release.yml — full release build + artifact upload + GitHub Release assets

git tag v1.0.0
git push origin v1.0.0

Before tagging (checklist)

python -m unittest discover -s tests -v passes locally
CHANGELOG.md updated
No secrets in settings.json / signup JSON committed
proxy_chain_manager/_bundled/gost.exe will be fetched at build time (or pre-staged)
Verify SHA256 after build: Get-FileHash releases\v*\ProxyChainManager.exe -Algorithm SHA256

Verify a release artifact

Get-FileHash -Algorithm SHA256 releases\v1.0.0\ProxyChainManager.exe
Get-Content releases\v1.0.0\ProxyChainManager.exe.sha256
Get-Content releases\v1.0.0\RELEASE_MANIFEST.json | ConvertFrom-Json

3.1 KiB Raw Blame History