chore(release): publish

- @standardnotes/[email protected] - @standardnotes/[email protected] - @standardnotes/[email protected] - @standardnotes/[email protected] - @standardnotes/[email protected].3 - @standardnotes/[email protected].3
chore: trigger release
2026-09-13 00:45:26 -04:00 · 2026-09-04 03:24:15 +00:00 · 2026-09-04 00:18:30 -03:00 · 2026-09-04 00:06:13 -03:00 · 2026-09-03 15:32:15 +00:00 · 2026-09-03 12:24:38 -03:00
1414 changed files with 24052 additions and 6293 deletions
@@ -0,0 +1,19 @@
+name: Desktop Manual Build
+
+on:
+  workflow_dispatch:
+    inputs:
+      platform:
+        description: Platform to build
+        required: true
+        type: choice
+        options:
+          - mac
+          - linux
+          - windows
+
+jobs:
+  build:
+    uses: ./.github/workflows/desktop.build.reuse.yml
+    with:
+      platform: ${{ inputs.platform }}
@@ -0,0 +1,254 @@
+name: Desktop Reusable Manual Build Workflow
+
+on:
+  workflow_call:
+    inputs:
+      platform:
+        required: true
+        type: string
+
+jobs:
+  Mac:
+    if: inputs.platform == 'mac'
+    runs-on: macos-latest
+    env:
+      CSC_IDENTITY_AUTO_DISCOVERY: false
+    defaults:
+      run:
+        working-directory: packages/desktop
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          registry-url: 'https://registry.npmjs.org'
+          node-version-file: '.nvmrc'
+          cache: 'yarn'
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+      - run: yarn install --immutable
+      - name: Rebuild Electron Native Modules
+        run: yarn workspace @standardnotes/desktop rebuild:home-server
+      - run: yarn build:desktop
+      - run: echo APP_VERSION=$(node -p "require('./../web/package.json').version") >> $GITHUB_ENV
+      - name: Compile Mac
+        run: yarn run webpack --config desktop.webpack.prod.js
+      - name: MacX64
+        run: |
+          yarn run electron-builder --mac --x64 --publish=never --config electron-builder.unsigned.cjs --c.extraMetadata.version=${{ env.APP_VERSION }}
+          node scripts/fixMacZip.js ${{ env.APP_VERSION }}
+      - name: MacArm64
+        run: yarn run electron-builder --mac --arm64 --publish=never --config electron-builder.unsigned.cjs --c.extraMetadata.version=${{ env.APP_VERSION }}
+      - name: Upload
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist-macos
+          retention-days: 7
+          path: |
+            packages/desktop/dist/*.dmg
+            packages/desktop/dist/*.zip
+            packages/desktop/dist/*.blockmap
+            packages/desktop/dist/*.yml
+            packages/desktop/dist/*.yaml
+
+  Linux-AppImage-X64:
+    name: Linux AppImage X64
+    if: inputs.platform == 'linux'
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: packages/desktop
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          registry-url: 'https://registry.npmjs.org'
+          node-version-file: '.nvmrc'
+          cache: 'yarn'
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+      - name: Install FPM
+        run: sudo gem install fpm -f
+      - run: yarn install --immutable
+      - name: Rebuild Electron Native Modules
+        run: yarn workspace @standardnotes/desktop rebuild:home-server
+      - run: yarn build:desktop
+      - run: echo APP_VERSION=$(node -p "require('./../web/package.json').version") >> $GITHUB_ENV
+      - name: Compile for AppImage
+        run: yarn run webpack --config desktop.webpack.prod.js
+      - name: AppImageX64
+        run: yarn run electron-builder --linux --x64 -c.linux.target=AppImage --publish=never --c.extraMetadata.version=${{ env.APP_VERSION }}
+      - name: Upload
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist-linux-appimage-x64
+          retention-days: 7
+          path: |
+            packages/desktop/dist/*.AppImage
+            packages/desktop/dist/*.yml
+            packages/desktop/dist/*.yaml
+
+  Linux-AppImage-ARM64:
+    name: Linux AppImage ARM64
+    if: inputs.platform == 'linux'
+    runs-on: ubuntu-24.04-arm
+    defaults:
+      run:
+        working-directory: packages/desktop
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          registry-url: 'https://registry.npmjs.org'
+          node-version-file: '.nvmrc'
+          cache: 'yarn'
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+      - name: Install FPM
+        run: sudo gem install fpm -f
+      - run: yarn install --immutable
+      - name: Rebuild Electron Native Modules
+        run: yarn workspace @standardnotes/desktop rebuild:home-server
+      - run: yarn build:desktop
+      - run: echo APP_VERSION=$(node -p "require('./../web/package.json').version") >> $GITHUB_ENV
+      - name: Compile for AppImage
+        run: yarn run webpack --config desktop.webpack.prod.js
+      - name: AppImageArm64
+        run: yarn run electron-builder --linux --arm64 -c.linux.target=AppImage --publish=never --c.extraMetadata.version=${{ env.APP_VERSION }}
+      - name: Upload
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist-linux-appimage-arm64
+          retention-days: 7
+          path: |
+            packages/desktop/dist/*.AppImage
+            packages/desktop/dist/*.yml
+            packages/desktop/dist/*.yaml
+
+  Linux-Deb-X64:
+    name: Linux Deb X64
+    if: inputs.platform == 'linux'
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: packages/desktop
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          registry-url: 'https://registry.npmjs.org'
+          node-version-file: '.nvmrc'
+          cache: 'yarn'
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+      - name: Install FPM
+        run: sudo gem install fpm -f
+      - run: yarn install --immutable
+      - name: Rebuild Electron Native Modules
+        run: yarn workspace @standardnotes/desktop rebuild:home-server
+      - run: yarn build:desktop
+      - run: echo APP_VERSION=$(node -p "require('./../web/package.json').version") >> $GITHUB_ENV
+      - name: Deb
+        run: |
+          yarn run webpack --config desktop.webpack.prod.js --env deb
+          yarn run electron-builder --linux --x64 -c.linux.target=deb --publish=never --c.extraMetadata.version=${{ env.APP_VERSION }}
+      - name: Upload
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist-linux-deb-x64
+          retention-days: 7
+          path: |
+            packages/desktop/dist/*.deb
+            packages/desktop/dist/*.yml
+            packages/desktop/dist/*.yaml
+
+  Linux-Deb-ARM64:
+    name: Linux Deb ARM64
+    if: inputs.platform == 'linux'
+    runs-on: ubuntu-24.04-arm
+    defaults:
+      run:
+        working-directory: packages/desktop
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          registry-url: 'https://registry.npmjs.org'
+          node-version-file: '.nvmrc'
+          cache: 'yarn'
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+      - name: Install FPM
+        run: sudo gem install fpm -f
+      - run: yarn install --immutable
+      - name: Rebuild Electron Native Modules
+        run: yarn workspace @standardnotes/desktop rebuild:home-server
+      - run: yarn build:desktop
+      - run: echo APP_VERSION=$(node -p "require('./../web/package.json').version") >> $GITHUB_ENV
+      - name: DebArm64
+        env:
+          USE_SYSTEM_FPM: 'true'
+        run: |
+          yarn run webpack --config desktop.webpack.prod.js --env deb
+          yarn run electron-builder --linux --arm64 -c.linux.target=deb --publish=never --c.extraMetadata.version=${{ env.APP_VERSION }}
+      - name: Upload
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist-linux-deb-arm64
+          retention-days: 7
+          path: |
+            packages/desktop/dist/*.deb
+            packages/desktop/dist/*.yml
+            packages/desktop/dist/*.yaml
+
+  Windows:
+    name: Windows
+    if: inputs.platform == 'windows'
+    runs-on: windows-latest
+    env:
+      NODE_OPTIONS: --max-old-space-size=8192
+      CSC_IDENTITY_AUTO_DISCOVERY: false
+    defaults:
+      run:
+        working-directory: packages/desktop
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          registry-url: 'https://registry.npmjs.org'
+          node-version-file: '.nvmrc'
+          cache: 'yarn'
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+      - run: corepack enable
+      - run: yarn install --immutable
+      - run: yarn build:desktop
+      - name: Set app version
+        shell: bash
+        run: echo APP_VERSION=$(node -p "require('./../web/package.json').version") >> $GITHUB_ENV
+      - name: Compile
+        run: yarn run webpack --config desktop.webpack.prod.js
+      - name: Build Windows installers
+        shell: bash
+        run: yarn run electron-builder --windows --x64 --ia32 --publish=never --config electron-builder.unsigned.cjs --c.extraMetadata.version=$APP_VERSION
+      - name: Upload
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist-windows
+          retention-days: 7
+          path: |
+            packages/desktop/dist/*.exe
+            packages/desktop/dist/*.yml
+            packages/desktop/dist/*.yaml
+            packages/desktop/dist/*.blockmap
@@ -56,8 +56,8 @@ jobs:
            packages/desktop/dist/*.yml
            packages/desktop/dist/*.yaml

-  Linux-AppImage:
-    name: Linux AppImage
+  Linux-AppImage-X64:
+    name: Linux AppImage X64
    runs-on: ubuntu-latest
    defaults:
      run:
@@ -78,37 +78,76 @@ jobs:

      - run: yarn install --immutable

+      - name: Rebuild Electron Native Modules
+        run: yarn workspace @standardnotes/desktop rebuild:home-server
+
+      - run: yarn build:desktop
+
      - run: echo APP_VERSION=$(node -p "require('./../web/package.json').version") >> $GITHUB_ENV
-      - name: AppImage
-        run: |
-          yarn workspace @standardnotes/desktop rebuild:home-server
-          yarn run webpack --config desktop.webpack.prod.js
-          yarn run electron-builder --linux --x64 -c.linux.target=AppImage --publish=never --c.extraMetadata.version=${{ env.APP_VERSION }}
+
+      - name: Compile for AppImage
+        run: yarn run webpack --config desktop.webpack.prod.js

      - name: AppImageX64
        run: |
-          yarn workspace @standardnotes/desktop rebuild:home-server
-          yarn run webpack --config desktop.webpack.prod.js
          yarn run electron-builder --linux --x64 -c.linux.target=AppImage --publish=never --c.extraMetadata.version=${{ env.APP_VERSION }}
-      - name: AppImageArm64
-        run: |
-          yarn workspace @standardnotes/desktop rebuild:home-server --arch arm64
-          yarn run webpack --config desktop.webpack.prod.js
-          yarn run electron-builder --linux --arm64 -c.linux.target=AppImage --publish=never --c.extraMetadata.version=${{ env.APP_VERSION }}
-        env:
-          npm_config_target_arch: 'arm64'

      - name: Upload
        uses: actions/[email protected]
        with:
-          name: dist-linux-appimage
+          name: dist-linux-appimage-x64
          path: |
            packages/desktop/dist/*.AppImage
            packages/desktop/dist/*.yml
            packages/desktop/dist/*.yaml

-  Linux-Dir:
-    name: Linux Dir
+  Linux-AppImage-ARM64:
+    name: Linux AppImage ARM64
+    runs-on: ubuntu-24.04-arm
+    defaults:
+      run:
+        working-directory: packages/desktop
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          registry-url: 'https://registry.npmjs.org'
+          node-version-file: '.nvmrc'
+          cache: 'yarn'
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+      - name: Install FPM
+        run: sudo gem install fpm -f
+
+      - run: yarn install --immutable
+
+      - name: Rebuild Electron Native Modules
+        run: yarn workspace @standardnotes/desktop rebuild:home-server
+
+      - run: yarn build:desktop
+
+      - run: echo APP_VERSION=$(node -p "require('./../web/package.json').version") >> $GITHUB_ENV
+
+      - name: Compile for AppImage
+        run: yarn run webpack --config desktop.webpack.prod.js
+
+      - name: AppImageArm64
+        run: |
+          yarn run electron-builder --linux --arm64 -c.linux.target=AppImage --publish=never --c.extraMetadata.version=${{ env.APP_VERSION }}
+
+      - name: Upload
+        uses: actions/[email protected]
+        with:
+          name: dist-linux-appimage-arm64
+          path: |
+            packages/desktop/dist/*.AppImage
+            packages/desktop/dist/*.yml
+            packages/desktop/dist/*.yaml
+
+  Linux-Dir-X64:
+    name: Linux Dir X64
    runs-on: ubuntu-latest
    defaults:
      run:
@@ -138,19 +177,45 @@ jobs:

      - name: Dir
        run: |
-          yarn workspace @standardnotes/desktop rebuild:home-server
          yarn run webpack --config desktop.webpack.prod.js
          yarn run electron-builder --linux --x64 -c.linux.target=dir --publish=never --c.extraMetadata.version=${{ env.APP_VERSION }}
+
+  Linux-Dir-ARM64:
+    name: Linux Dir ARM64
+    runs-on: ubuntu-24.04-arm
+    defaults:
+      run:
+        working-directory: packages/desktop
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          registry-url: 'https://registry.npmjs.org'
+          node-version-file: '.nvmrc'
+          cache: 'yarn'
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+      - name: Install FPM
+        run: sudo gem install fpm -f
+
+      - run: yarn install --immutable
+
+      - name: Rebuild Electron Native Modules
+        run: yarn workspace @standardnotes/desktop rebuild:home-server
+
+      - run: yarn build:desktop
+
+      - run: echo APP_VERSION=$(node -p "require('./../web/package.json').version") >> $GITHUB_ENV
+
      - name: DirArm64
        run: |
-          yarn workspace @standardnotes/desktop rebuild:home-server --arch arm64
          yarn run webpack --config desktop.webpack.prod.js
          yarn run electron-builder --linux --arm64 -c.linux.target=dir --publish=never --c.extraMetadata.version=${{ env.APP_VERSION }}
-        env:
-          npm_config_target_arch: 'arm64'

-  Linux-Deb:
-    name: Linux Deb
+  Linux-Deb-X64:
+    name: Linux Deb X64
    runs-on: ubuntu-latest
    defaults:
      run:
@@ -171,26 +236,67 @@ jobs:

      - run: yarn install --immutable

+      - name: Rebuild Electron Native Modules
+        run: yarn workspace @standardnotes/desktop rebuild:home-server
+
+      - run: yarn build:desktop
+
      - run: echo APP_VERSION=$(node -p "require('./../web/package.json').version") >> $GITHUB_ENV

      - name: Deb
        run: |
-          yarn workspace @standardnotes/desktop rebuild:home-server
          yarn run webpack --config desktop.webpack.prod.js --env deb
          yarn run electron-builder --linux --x64 -c.linux.target=deb --publish=never --c.extraMetadata.version=${{ env.APP_VERSION }}
+
+      - name: Upload
+        uses: actions/[email protected]
+        with:
+          name: dist-linux-deb-x64
+          path: |
+            packages/desktop/dist/*.deb
+            packages/desktop/dist/*.yml
+            packages/desktop/dist/*.yaml
+
+  Linux-Deb-ARM64:
+    name: Linux Deb ARM64
+    runs-on: ubuntu-24.04-arm
+    defaults:
+      run:
+        working-directory: packages/desktop
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          registry-url: 'https://registry.npmjs.org'
+          node-version-file: '.nvmrc'
+          cache: 'yarn'
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+      - name: Install FPM
+        run: sudo gem install fpm -f
+
+      - run: yarn install --immutable
+
+      - name: Rebuild Electron Native Modules
+        run: yarn workspace @standardnotes/desktop rebuild:home-server
+
+      - run: yarn build:desktop
+
+      - run: echo APP_VERSION=$(node -p "require('./../web/package.json').version") >> $GITHUB_ENV
+
      - name: DebArm64
        env:
-          npm_config_target_arch: 'arm64'
          USE_SYSTEM_FPM: 'true'
        run: |
-          yarn workspace @standardnotes/desktop rebuild:home-server --arch arm64
          yarn run webpack --config desktop.webpack.prod.js --env deb
          yarn run electron-builder --linux --arm64 -c.linux.target=deb --publish=never --c.extraMetadata.version=${{ env.APP_VERSION }}

      - name: Upload
        uses: actions/[email protected]
        with:
-          name: dist-linux-deb
+          name: dist-linux-deb-arm64
          path: |
            packages/desktop/dist/*.deb
            packages/desktop/dist/*.yml
@@ -224,7 +330,9 @@ jobs:

      - name: Install Snapcraft
        run: |
-          sudo snap install snapcraft --classic
+          # Pin to 8.x: electron-builder's legacy core22 snap target calls `snapcraft snap`,
+          # which was removed in snapcraft 9.0 (renamed to `pack`).
+          sudo snap install snapcraft --classic --channel=8.x/stable

      - name: Setup LXD
        uses: canonical/[email protected]
@@ -249,99 +357,22 @@ jobs:
            packages/desktop/dist/*.yml
            packages/desktop/dist/*.yaml

-  Windows:
-    runs-on: windows-latest
-    env:
-      SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-
-    defaults:
-      run:
-        working-directory: packages/desktop
-
-    steps:
-      - name: Code signing with Software Trust Manager
-        uses: digicert/[email protected]
-
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Setup Node
-        uses: actions/setup-node@v3
-        with:
-          registry-url: 'https://registry.npmjs.org'
-          node-version-file: '.nvmrc'
-          cache: 'yarn'
-
-      - name: Setup Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.10'
-
-      - name: Install Dependencies
-        run: yarn install --immutable
-
-      - name: Rebuild Electron Native Modules
-        run: yarn workspace @standardnotes/desktop rebuild:home-server
-
-      - name: Build
-        run: yarn build:desktop
-
-      - name: Webpack
-        run: yarn run webpack --config desktop.webpack.prod.js
-
-      - name: Set up certificate
-        run: |
-          echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12
-        shell: bash
-
-      - name: Set variables
-        id: variables
-        run: |
-          export DEBUG='electron-builder'
-
-          echo "SM_HOST=${{ secrets.SM_HOST }}" >> "$GITHUB_ENV"
-          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV"
-          echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
-          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV"
-
-          echo "C:\Program Files (x86)\Windows Kits\10\App Certification Kit" >> $GITHUB_PATH
-          echo "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools" >> $GITHUB_PATH
-          echo "C:\Program Files\DigiCert\DigiCert Keylocker Tools" >> $GITHUB_PATH
-        shell: bash
-
-      - name: Setup Keylocker KSP on windows
-        run: |
-          curl -X GET  https://one.digicert.com/signingmanager/api-ui/v1/releases/Keylockertools-windows-x64.msi/download -H "x-api-key:%SM_API_KEY%" -o Keylockertools-windows-x64.msi
-          msiexec /i Keylockertools-windows-x64.msi /quiet /qn
-          smksp_registrar.exe list
-          smctl.exe keypair ls
-          C:\Windows\System32\certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
-        shell: cmd
-
-      - name: Certificates Sync
-        run: |
-          smctl windows certsync
-        shell: cmd
-
-      - name: Build & Sign With Electron Builder
-        run: yarn run electron-builder --windows --x64 --ia32 --publish=never --c.extraMetadata.version=$(node -p "require('./../web/package.json').version")
-
-      - name: Upload
-        uses: actions/[email protected]
-        with:
-          name: dist-windows
-          path: |
-            packages/desktop/dist/*.blockmap
-            packages/desktop/dist/*.exe
-            packages/desktop/dist/*.yml
-            packages/desktop/dist/*.yaml
-
  Publish:
    runs-on: ubuntu-latest
    env:
      SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
    if: ${{ always() }}
-    needs: [Windows, Mac, Linux-AppImage, Linux-Dir, Linux-Deb, Linux-Snap]
+    needs:
+      [
+        Mac,
+        Linux-AppImage-X64,
+        Linux-AppImage-ARM64,
+        Linux-Dir-X64,
+        Linux-Dir-ARM64,
+        Linux-Deb-X64,
+        Linux-Deb-ARM64,
+        Linux-Snap,
+      ]
    defaults:
      run:
        working-directory: packages/desktop
@@ -385,16 +416,5 @@ jobs:

      - name: Publish Snap
        run: |
-          sudo snap install snapcraft --classic
+          sudo snap install snapcraft --classic --channel=8.x/stable
          snapcraft upload dist/standard-notes-${{ env.APP_VERSION }}-linux-amd64.snap --release stable,candidate,beta,edge
-
-  Notify:
-    runs-on: ubuntu-latest
-    needs: [Publish]
-    steps:
-      - name: Notify Release Update
-        uses: peter-evans/repository-dispatch@v2
-        with:
-          token: ${{ secrets.CI_PAT_TOKEN }}
-          repository: ${{ secrets.RELEASES_EVENT_RECEIVING_REPO }}
-          event-type: releases-updated-event
@@ -7,11 +7,15 @@ jobs:
    defaults:
      run:
        working-directory: packages/mobile
-    runs-on: macos-latest
+    runs-on: macos-15
    timeout-minutes: 90
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
+      - name: Select Xcode 26
+        uses: maxim-lobanov/setup-xcode@v1
+        with:
+          xcode-version: "26"
      - name: Export version from package.json
        run:
          echo "PACKAGE_VERSION=$(grep '"version"' ../web/package.json | cut -d '"' -f 4 | cut -d "-" -f 1)" >> $GITHUB_ENV
@@ -0,0 +1,59 @@
+name: Mobile Release Closed Beta
+
+on:
+  workflow_dispatch:
+    inputs:
+      beta_label:
+        description: Feature label for this beta build (e.g. offline-sync)
+        required: true
+        type: string
+
+jobs:
+  android:
+    defaults:
+      run:
+        working-directory: packages/mobile
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+      - name: Setup Java version
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'zulu'
+          java-version: '17'
+      - name: Export version for closed beta
+        run: |
+          BASE_VERSION=$(grep '"version"' ../web/package.json | cut -d '"' -f 4 | cut -d "-" -f 1)
+          BETA_LABEL=$(echo "${{ inputs.beta_label }}" | tr '[:upper:]' '[:lower:]' | tr ' ' '-' | sed 's/[^a-z0-9-]//g')
+          if [ -z "$BETA_LABEL" ]; then
+            echo "beta_label must contain at least one alphanumeric character"
+            exit 1
+          fi
+          echo "PACKAGE_VERSION=${BASE_VERSION}-beta-${BETA_LABEL}" >> $GITHUB_ENV
+      - name: Setup react-native kernel and increase watchers
+        run: echo fs.inotify.max_user_watches=524288 | sudo tee -a /etc/sysctl.conf && sudo sysctl -p
+      - name: Decode Production Android keystore
+        run: |
+          echo "${{ secrets.ANDROID_KEYSTORE }}" > keystore.keystore.asc
+          gpg -d --passphrase "${{ secrets.KEYSTORE_PASSPHRASE }}" --batch keystore.keystore.asc > android/app/keystore.keystore
+      - name: Install dependencies
+        run: yarn install --immutable
+      - run: yarn build:mobile
+      - name: Ruby Setup for Fastlane
+        uses: ruby/setup-ruby@v1
+        with:
+          working-directory: 'packages/mobile'
+      - name: fastlane
+        uses: maierj/[email protected]
+        env:
+          PACKAGE_VERSION: ${{ env.PACKAGE_VERSION }}
+          BUILD_NUMBER: ${{ github.run_number }}
+          ANDROID_KEYSTORE_ALIAS: ${{ secrets.ANDROID_KEYSTORE_ALIAS }}
+          ANDROID_KEYSTORE_PRIVATE_KEY_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PRIVATE_KEY_PASSWORD }}
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          GOOGLE_PLAY_JSON_KEY_DATA: ${{ secrets.GOOGLE_PLAY_JSON_KEY_DATA }}
+        with:
+          lane: 'android closed_beta'
+          subdirectory: 'packages/mobile'
@@ -74,11 +74,15 @@ jobs:
    defaults:
      run:
        working-directory: packages/mobile
-    runs-on: macos-latest
+    runs-on: macos-15
    timeout-minutes: 90
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
+      - name: Select Xcode 26
+        uses: maxim-lobanov/setup-xcode@v1
+        with:
+          xcode-version: "26"
      - name: Export version from package.json
        run:
          echo "PACKAGE_VERSION=$(grep '"version"' ../web/package.json | cut -d '"' -f 4 | cut -d "-" -f 1)" >> $GITHUB_ENV
@@ -2,12 +2,24 @@ name: Publish Packages

 on:
  push:
-    branches: [ main ]
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      package:
+        description: 'Package to publish (e.g. @standardnotes/releases)'
+        required: true
+        type: string
+
+# Use commit message "[snjs docker only]" to build/push only standardnotes/snjs (:sha + :latest) for E2E; skips full build, web image, and NPM.
+# Manual dispatch publishes tagged packages from an existing release commit without bumping versions.
+
+permissions:
+  id-token: write

 jobs:
  build:
    name: Build & Test
-    if: "${{ contains(github.event.head_commit.message, 'chore(release): publish') == false }}"
+    if: "${{ github.event_name == 'push' && contains(github.event.head_commit.message, 'chore(release): publish') == false && contains(github.event.head_commit.message, '[snjs docker only]') == false }}"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
@@ -34,7 +46,7 @@ jobs:

  build-docker:
    name: Build Docker Image
-    if: "${{ contains(github.event.head_commit.message, 'chore(release): publish') == false }}"
+    if: "${{ github.event_name == 'push' && contains(github.event.head_commit.message, 'chore(release): publish') == false }}"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
@@ -65,6 +77,7 @@ jobs:

  e2e-base:
    name: E2E Base Test Suite
+    if: false
    needs: build-docker
    runs-on: ubuntu-latest
    steps:
@@ -84,6 +97,7 @@ jobs:

  e2e-vaults:
    name: E2E Vaults Test Suite
+    if: false
    needs: build-docker
    runs-on: ubuntu-latest
    steps:
@@ -103,7 +117,7 @@ jobs:

  publish-web-docker:
    name: Build and publish Docker Image for Web App
-    needs: [e2e-base, e2e-vaults]
+    if: "${{ github.event_name == 'push' && contains(github.event.head_commit.message, 'chore(release): publish') == false && contains(github.event.head_commit.message, '[snjs docker only]') == false }}"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
@@ -141,7 +155,7 @@ jobs:

  publish:
    name: Publish to NPM
-    needs: [e2e-base, e2e-vaults]
+    if: "${{ github.event_name == 'push' && contains(github.event.head_commit.message, 'chore(release): publish') == false && contains(github.event.head_commit.message, '[snjs docker only]') == false }}"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
@@ -155,6 +169,10 @@ jobs:
          registry-url: 'https://registry.npmjs.org'
          node-version-file: '.nvmrc'
          cache: 'yarn'
+      - name: Upgrade npm (trusted publishing requirement)
+        run: npm install -g npm@^11.5.1
+      - name: Enable Corepack (Yarn)
+        run: corepack enable
      - name: Setup git config
        run: |
          git config --global user.name "standardci"
@@ -174,12 +192,96 @@ jobs:
        run: yarn release:prod
      - name: Publish
        run: yarn publish:prod
+
+  publish-from-git-tags:
+    name: Publish to NPM from Git Tags
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          token: ${{ secrets.CI_PAT_TOKEN }}
+          ref: main
+          fetch-depth: 0
+
+      - name: Resolve release commit
+        id: release-commit
+        run: |
+          COMMIT="$(git log main --grep='chore(release): publish' -n 1 --format=%H)"
+
+          if [ -z "$COMMIT" ]; then
+            echo "No release commit found on main."
+            exit 1
+          fi
+
+          if ! git cat-file -e "${COMMIT}^{commit}" 2>/dev/null; then
+            echo "Commit ${COMMIT} does not exist."
+            exit 1
+          fi
+
+          TAG_COUNT="$(git tag --points-at "$COMMIT" | wc -l | tr -d ' ')"
+          if [ "$TAG_COUNT" -eq 0 ]; then
+            echo "Commit ${COMMIT} has no release tags."
+            exit 1
+          fi
+
+          echo "commit=${COMMIT}" >> "$GITHUB_OUTPUT"
+          echo "Using release commit ${COMMIT}"
+          git tag --points-at "$COMMIT"
+
+      - name: Checkout release commit
+        run: git checkout "${{ steps.release-commit.outputs.commit }}"
+
+      - name: Set up Node
+        uses: actions/setup-node@v3
+        with:
+          registry-url: 'https://registry.npmjs.org'
+          node-version-file: '.nvmrc'
+          cache: 'yarn'
+
+      - name: Upgrade npm (trusted publishing requirement)
+        run: npm install -g npm@^11.5.1
+
+      - name: Enable Corepack (Yarn)
+        run: corepack enable
+
+      - name: Install dependencies
+        run: yarn install --immutable
+
+      - name: Build
+        run: yarn build:all
+
+      - name: Publish tagged package
        env:
-          NODE_AUTH_TOKEN: ${{ secrets.CI_NPM_TOKEN }}
+          PACKAGE: ${{ inputs.package }}
+        run: |
+          set -euo pipefail
+
+          PACKAGE="$(echo "$PACKAGE" | xargs)"
+          if [ -z "$PACKAGE" ]; then
+            echo "Package name is required."
+            exit 1
+          fi
+
+          mapfile -t TAGS < <(git tag --points-at HEAD --list "${PACKAGE}@*")
+          if [ "${#TAGS[@]}" -eq 0 ]; then
+            echo "No release tag found for ${PACKAGE} at the release commit."
+            exit 1
+          fi
+
+          if [ "${#TAGS[@]}" -gt 1 ]; then
+            echo "Multiple release tags found for ${PACKAGE}: ${TAGS[*]}"
+            exit 1
+          fi
+
+          echo "Publishing ${PACKAGE} (${TAGS[0]})..."
+          yarn workspace "$PACKAGE" npm publish --access public

  publish-docker:
    name: Publish to Docker Hub
-    needs: [e2e-base, e2e-vaults]
+    needs: build-docker
+    if: "${{ github.event_name == 'push' && contains(github.event.head_commit.message, 'chore(release): publish') == false }}"
    runs-on: ubuntu-latest
    steps:
      - name: Login to Docker Hub
@@ -0,0 +1,15 @@
+name: Notify Marketing Releases Update
+
+on:
+  workflow_dispatch:
+
+jobs:
+  notify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify Release Update
+        uses: peter-evans/repository-dispatch@v2
+        with:
+          token: ${{ secrets.CI_PAT_TOKEN }}
+          repository: ${{ secrets.RELEASES_EVENT_RECEIVING_REPO }}
+          event-type: releases-updated-event
--- a/Show More
+++ b/Show More