93 lines
3.1 KiB
Markdown
93 lines
3.1 KiB
Markdown
# Release Process
|
|
|
|
Production Windows builds use **PyInstaller** with a gated pipeline in `scripts/release_build.ps1`.
|
|
|
|
## Quick commands
|
|
|
|
| Goal | Command |
|
|
|------|---------|
|
|
| **Production release** | `build_release.bat` or `powershell -File .\scripts\release_build.ps1` |
|
|
| **Dev build (Desktop copy)** | `build_exe.bat` or `powershell -File .\scripts\setup_and_build.ps1` |
|
|
| **Skip tests (dev only)** | `powershell -File .\scripts\setup_and_build.ps1 -SkipTests` |
|
|
|
|
## Production pipeline (`release_build.ps1`)
|
|
|
|
1. Resolve Python 3.10+
|
|
2. Install `requirements.txt` + `dev-requirements.txt` (PyInstaller **6.10.0** pinned)
|
|
3. **Test gate**: `compileall` + `unittest discover` (skip with `-SkipTests` — not for prod)
|
|
4. Download & SHA-verify bundled `gost.exe` → `proxy_chain_manager/_bundled/`
|
|
5. Generate Windows **VERSIONINFO** → `build/version_info.txt`
|
|
6. **PyInstaller** one-file build via `ProxyChainManager.spec`
|
|
7. Optional **Authenticode** sign (see below)
|
|
8. SHA256 sidecar for the exe
|
|
9. **SBOM** (`SBOM.json` + `requirements-frozen.txt`)
|
|
10. **RELEASE_MANIFEST.json** (version, commit, sha256, build time)
|
|
11. Zip → `releases/ProxyGod-v{version}-windows-amd64.zip`
|
|
|
|
### Output layout
|
|
|
|
```
|
|
releases/
|
|
v1.0.0/
|
|
ProxyChainManager.exe
|
|
ProxyChainManager.exe.sha256
|
|
RELEASE_MANIFEST.json
|
|
SBOM.json
|
|
requirements-frozen.txt
|
|
LICENSE
|
|
OPERATOR_RUNBOOK.md
|
|
ProxyGod-v1.0.0-windows-amd64.zip
|
|
dist/
|
|
ProxyChainManager.exe # same binary (developer convenience)
|
|
ProxyChainManager.exe.sha256
|
|
```
|
|
|
|
## Version numbering
|
|
|
|
Resolved in order:
|
|
|
|
1. `-Version` parameter to `release_build.ps1`
|
|
2. Exact git tag on current commit (`git describe --tags --exact-match`)
|
|
3. `git describe --tags --always --dirty`
|
|
4. `proxy_chain_manager.__version__`
|
|
|
|
Tag releases with `v1.2.3` — CI **release.yml** runs automatically on `v*` tags.
|
|
|
|
## Authenticode signing (optional)
|
|
|
|
Set before building:
|
|
|
|
```powershell
|
|
$env:SIGN_CERT_PATH = "C:\certs\proxygod.pfx"
|
|
$env:SIGN_CERT_PASSWORD = "your-password" # optional if pfx has no password
|
|
powershell -File .\scripts\release_build.ps1
|
|
```
|
|
|
|
Requires **Windows SDK** (`signtool.exe` on PATH). Without a cert, the build completes unsigned (SmartScreen may warn on first run).
|
|
|
|
## CI / GitHub Releases
|
|
|
|
- **Every push/PR**: `.github/workflows/test.yml` — unit tests only
|
|
- **Tag `v*` or manual dispatch**: `.github/workflows/release.yml` — full release build + artifact upload + GitHub Release assets
|
|
|
|
```bash
|
|
git tag v1.0.0
|
|
git push origin v1.0.0
|
|
```
|
|
|
|
## Before tagging (checklist)
|
|
|
|
- [ ] `python -m unittest discover -s tests -v` passes locally
|
|
- [ ] CHANGELOG.md updated
|
|
- [ ] No secrets in `settings.json` / signup JSON committed
|
|
- [ ] `proxy_chain_manager/_bundled/gost.exe` will be fetched at build time (or pre-staged)
|
|
- [ ] Verify SHA256 after build: `Get-FileHash releases\v*\ProxyChainManager.exe -Algorithm SHA256`
|
|
|
|
## Verify a release artifact
|
|
|
|
```powershell
|
|
Get-FileHash -Algorithm SHA256 releases\v1.0.0\ProxyChainManager.exe
|
|
Get-Content releases\v1.0.0\ProxyChainManager.exe.sha256
|
|
Get-Content releases\v1.0.0\RELEASE_MANIFEST.json | ConvertFrom-Json
|
|
```
|