chore(release): publish

- @standardnotes/[email protected]
 - @standardnotes/[email protected]
 - @standardnotes/[email protected]
 - @standardnotes/[email protected]
 - @standardnotes/[email protected].5
 - @standardnotes/[email protected]

.github/workflows/desktop.release.reuse.yml

@@ -355,93 +355,6 @@ jobs:
             packages/desktop/dist/*.yml
             packages/desktop/dist/*.yaml
 
-  Windows:
-    runs-on: windows-latest
-    env:
-      SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
-
-    defaults:
-      run:
-        working-directory: packages/desktop
-
-    steps:
-      - name: Code signing with Software Trust Manager
-        uses: digicert/[email protected]
-
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Setup Node
-        uses: actions/setup-node@v3
-        with:
-          registry-url: 'https://registry.npmjs.org'
-          node-version-file: '.nvmrc'
-          cache: 'yarn'
-
-      - name: Setup Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.10'
-
-      - name: Install Dependencies
-        run: yarn install --immutable
-
-      - name: Rebuild Electron Native Modules
-        run: yarn workspace @standardnotes/desktop rebuild:home-server
-
-      - name: Build
-        run: yarn build:desktop
-
-      - name: Webpack
-        run: yarn run webpack --config desktop.webpack.prod.js
-
-      - name: Set up certificate
-        run: |
-          echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12
-        shell: bash
-
-      - name: Set variables
-        id: variables
-        run: |
-          export DEBUG='electron-builder'
-
-          echo "SM_HOST=${{ secrets.SM_HOST }}" >> "$GITHUB_ENV"
-          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV"
-          echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
-          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV"
-
-          echo "C:\Program Files (x86)\Windows Kits\10\App Certification Kit" >> $GITHUB_PATH
-          echo "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools" >> $GITHUB_PATH
-          echo "C:\Program Files\DigiCert\DigiCert Keylocker Tools" >> $GITHUB_PATH
-        shell: bash
-
-      - name: Setup Keylocker KSP on windows
-        run: |
-          curl -X GET  https://one.digicert.com/signingmanager/api-ui/v1/releases/Keylockertools-windows-x64.msi/download -H "x-api-key:%SM_API_KEY%" -o Keylockertools-windows-x64.msi
-          msiexec /i Keylockertools-windows-x64.msi /quiet /qn
-          smksp_registrar.exe list
-          smctl.exe keypair ls
-          C:\Windows\System32\certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
-        shell: cmd
-
-      - name: Certificates Sync
-        run: |
-          smctl windows certsync
-        shell: cmd
-
-      - name: Build & Sign With Electron Builder
-        run: yarn run electron-builder --windows --x64 --ia32 --publish=never --c.extraMetadata.version=$(node -p "require('./../web/package.json').version")
-
-      - name: Upload
-        uses: actions/[email protected]
-        with:
-          name: dist-windows
-          path: |
-            packages/desktop/dist/*.blockmap
-            packages/desktop/dist/*.exe
-            packages/desktop/dist/*.yml
-            packages/desktop/dist/*.yaml
-
   Publish:
     runs-on: ubuntu-latest
     env:
@@ -449,7 +362,6 @@ jobs:
     if: ${{ always() }}
     needs:
       [
-        Windows,
         Mac,
         Linux-AppImage-X64,
         Linux-AppImage-ARM64,
@@ -504,14 +416,3 @@ jobs:
         run: |
           sudo snap install snapcraft --classic
           snapcraft upload dist/standard-notes-${{ env.APP_VERSION }}-linux-amd64.snap --release stable,candidate,beta,edge
-
-  Notify:
-    runs-on: ubuntu-latest
-    needs: [Publish]
-    steps:
-      - name: Notify Release Update
-        uses: peter-evans/repository-dispatch@v2
-        with:
-          token: ${{ secrets.CI_PAT_TOKEN }}
-          repository: ${{ secrets.RELEASES_EVENT_RECEIVING_REPO }}
-          event-type: releases-updated-event

.github/workflows/ios.testflight.yml

@@ -7,11 +7,15 @@ jobs:
     defaults:
       run:
         working-directory: packages/mobile
-    runs-on: macos-latest
+    runs-on: macos-15
     timeout-minutes: 90
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
+      - name: Select Xcode 26
+        uses: maxim-lobanov/setup-xcode@v1
+        with:
+          xcode-version: "26"
       - name: Export version from package.json
         run:
           echo "PACKAGE_VERSION=$(grep '"version"' ../web/package.json | cut -d '"' -f 4 | cut -d "-" -f 1)" >> $GITHUB_ENV

.github/workflows/mobile.release.prod.yml

@@ -74,11 +74,15 @@ jobs:
     defaults:
       run:
         working-directory: packages/mobile
-    runs-on: macos-14
+    runs-on: macos-15
     timeout-minutes: 90
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
+      - name: Select Xcode 26
+        uses: maxim-lobanov/setup-xcode@v1
+        with:
+          xcode-version: "26"
       - name: Export version from package.json
         run:
           echo "PACKAGE_VERSION=$(grep '"version"' ../web/package.json | cut -d '"' -f 4 | cut -d "-" -f 1)" >> $GITHUB_ENV

.github/workflows/publish.yml

@@ -2,12 +2,17 @@ name: Publish Packages
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
+
+# Use commit message "[snjs docker only]" to build/push only standardnotes/snjs (:sha + :latest) for E2E; skips full build, web image, and NPM.
+
+permissions:
+  id-token: write
 
 jobs:
   build:
     name: Build & Test
-    if: "${{ contains(github.event.head_commit.message, 'chore(release): publish') == false }}"
+    if: "${{ contains(github.event.head_commit.message, 'chore(release): publish') == false && contains(github.event.head_commit.message, '[snjs docker only]') == false }}"
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -65,6 +70,7 @@ jobs:
 
   e2e-base:
     name: E2E Base Test Suite
+    if: false
     needs: build-docker
     runs-on: ubuntu-latest
     steps:
@@ -84,6 +90,7 @@ jobs:
 
   e2e-vaults:
     name: E2E Vaults Test Suite
+    if: false
     needs: build-docker
     runs-on: ubuntu-latest
     steps:
@@ -103,7 +110,7 @@ jobs:
 
   publish-web-docker:
     name: Build and publish Docker Image for Web App
-    needs: [e2e-base, e2e-vaults]
+    if: "${{ contains(github.event.head_commit.message, 'chore(release): publish') == false && contains(github.event.head_commit.message, '[snjs docker only]') == false }}"
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -141,7 +148,7 @@ jobs:
 
   publish:
     name: Publish to NPM
-    needs: [e2e-base, e2e-vaults]
+    if: "${{ contains(github.event.head_commit.message, 'chore(release): publish') == false && contains(github.event.head_commit.message, '[snjs docker only]') == false }}"
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -155,6 +162,10 @@ jobs:
           registry-url: 'https://registry.npmjs.org'
           node-version-file: '.nvmrc'
           cache: 'yarn'
+      - name: Upgrade npm (trusted publishing requirement)
+        run: npm install -g npm@^11.5.1
+      - name: Enable Corepack (Yarn)
+        run: corepack enable
       - name: Setup git config
         run: |
           git config --global user.name "standardci"
@@ -174,12 +185,11 @@ jobs:
         run: yarn release:prod
       - name: Publish
         run: yarn publish:prod
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.CI_NPM_TOKEN }}
 
   publish-docker:
     name: Publish to Docker Hub
-    needs: [e2e-base, e2e-vaults]
+    needs: build-docker
+    if: "${{ contains(github.event.head_commit.message, 'chore(release): publish') == false }}"
     runs-on: ubuntu-latest
     steps:
       - name: Login to Docker Hub

.github/workflows/releases.notify.yml

@@ -0,0 +1,15 @@
+name: Notify Marketing Releases Update
+
+on:
+  workflow_dispatch:
+
+jobs:
+  notify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify Release Update
+        uses: peter-evans/repository-dispatch@v2
+        with:
+          token: ${{ secrets.CI_PAT_TOKEN }}
+          repository: ${{ secrets.RELEASES_EVENT_RECEIVING_REPO }}
+          event-type: releases-updated-event