.github/RELEASE_CHECKLIST.md - maka - Git at Google

 # macOS arm64 release checklist

 The `Release macOS arm64` workflow is the single release entry point. It packages, signs, notarizes, verifies, and creates a draft GitHub Release; it never publishes the release.

 ## One-time repository setup

 Create a GitHub Environment named `release`. Add required reviewers if the repository needs a release approval gate, then configure these environment secrets:

 - `CSC_LINK`: base64-encoded Developer ID Application `.p12`;
 - `CSC_KEY_PASSWORD`: password for that `.p12`;
 - `APPLE_API_KEY`: raw contents of an App Store Connect API `.p8` key;
 - `APPLE_API_KEY_ID`: App Store Connect API key ID;
 - `APPLE_API_ISSUER`: App Store Connect API issuer ID.

 ## Create the draft

 1. Confirm the intended commit is on `main`, CI is green, and `apps/desktop/package.json` contains a version that has never been released.
 2. In GitHub Actions, run `Release macOS arm64` against `main`.
 3. Confirm every workflow step passes and a draft release named `v<version>` exists.
 4. Confirm the draft records the intended commit SHA and contains exactly the DMG and its `.sha256` file.

 ## Acceptance on another Apple Silicon Mac

 Download both draft assets through the GitHub UI. This download path applies the real browser quarantine metadata that CI intentionally does not simulate.

 1. From the download directory, run `shasum -a 256 -c Maka-<version>-mac-arm64.dmg.sha256`.
 2. Open the DMG in Finder, drag Maka to Applications, and launch it from Finder.
 3. Confirm macOS opens Maka without an unidentified-developer or damaged-app warning.
 4. Run `spctl --assess --type execute --verbose=4 /Applications/Maka.app` and confirm it is accepted with a Developer ID origin.
 5. Configure a model connection, send one basic prompt, and run one representative file-tool task.
 6. Install `ripgrep` with `brew install ripgrep`, then confirm a task using `Grep` works.
 7. Run one representative Office task and confirm OfficeCLI starts without an update prompt.
 8. Confirm the known limitation is accurate: Computer Use is not included.

 Publish the draft only after all checks pass. If acceptance fails, keep the draft unpublished, fix the issue, increment the desktop version, and run the workflow again; do not replace an existing release identity.
	# macOS arm64 release checklist

	The `Release macOS arm64` workflow is the single release entry point. It packages, signs, notarizes, verifies, and creates a draft GitHub Release; it never publishes the release.

	## One-time repository setup

	Create a GitHub Environment named `release`. Add required reviewers if the repository needs a release approval gate, then configure these environment secrets:

	- `CSC_LINK`: base64-encoded Developer ID Application `.p12`;
	- `CSC_KEY_PASSWORD`: password for that `.p12`;
	- `APPLE_API_KEY`: raw contents of an App Store Connect API `.p8` key;
	- `APPLE_API_KEY_ID`: App Store Connect API key ID;
	- `APPLE_API_ISSUER`: App Store Connect API issuer ID.

	## Create the draft

	1. Confirm the intended commit is on `main`, CI is green, and `apps/desktop/package.json` contains a version that has never been released.
	2. In GitHub Actions, run `Release macOS arm64` against `main`.
	3. Confirm every workflow step passes and a draft release named `v<version>` exists.
	4. Confirm the draft records the intended commit SHA and contains exactly the DMG and its `.sha256` file.

	## Acceptance on another Apple Silicon Mac

	Download both draft assets through the GitHub UI. This download path applies the real browser quarantine metadata that CI intentionally does not simulate.

	1. From the download directory, run `shasum -a 256 -c Maka-<version>-mac-arm64.dmg.sha256`.
	2. Open the DMG in Finder, drag Maka to Applications, and launch it from Finder.
	3. Confirm macOS opens Maka without an unidentified-developer or damaged-app warning.
	4. Run `spctl --assess --type execute --verbose=4 /Applications/Maka.app` and confirm it is accepted with a Developer ID origin.
	5. Configure a model connection, send one basic prompt, and run one representative file-tool task.
	6. Install `ripgrep` with `brew install ripgrep`, then confirm a task using `Grep` works.
	7. Run one representative Office task and confirm OfficeCLI starts without an update prompt.
	8. Confirm the known limitation is accurate: Computer Use is not included.

	Publish the draft only after all checks pass. If acceptance fails, keep the draft unpublished, fix the issue, increment the desktop version, and run the workflow again; do not replace an existing release identity.