Publishing and verification

After the generated release PR is merged, the workflow produces a finalized release contract from the merged SHA and creates or updates a GitHub Release draft.

Review the draft and use GitHub’s Publish release action when it is correct. Publishing is the second and final semantic human gate.

Existing publisher

Publishing the GitHub Release triggers the existing LibreSign package/sign/App Store workflow. The release automation does not duplicate that publisher.

Publication verification

After publication, the workflow waits for the existing publisher and validates:

• the GitHub Release is published and still points to the finalized tag/SHA;

• the configured publisher workflow completed successfully for that release;

• the expected release asset exists;

• artifact digest and package contents satisfy the configured package contract;

• the same version is visible in the Nextcloud App Store.

Verification is independently rerunnable. Bounded retries handle eventual consistency only; they do not replace release validation rules.

Changelog source

The released changelog remains in LibreSign/libresign under docs/changelogs/changelog-<major>.md. This documentation repository does not copy or maintain a second release-history dataset.

For security releases, advisory-private text must never be added to the public changelog or documentation.