release

# Meridian Release Skill Meridian uses **semantic-release** (not release-please) driven by two GitHub Actions workflows: `.github/workflows/release.yml` (production, on push to `main`) and `.github/workflows/release-staging.yml` (staging, on push to `pre-main` gated by a `[staging-release]` commit-message marker, or manual dispatch). ## Components & Version Files Bumped in lockstep by `scripts/set-version.sh <version>`: | Component | Version File | |-----------|--------------| | Rust daemon | `Cargo.toml` (`version = "X.Y.Z"`), `Cargo.lock` | | UI | `ui/package.json` | | MCP server | `packages/meridian-mcp/package.json` | | Tray app | `tray/src-tauri/tauri.conf.json` | ## Release Workflow ### Production (`main`) Config: `.releaserc.json`. Commit-message convention (conventionalcommits preset): `feat:` → minor, `fix:` → patch, `feat!:`/`BREAKING CHANGE:` → major, `chore:`/`docs:`/`refactor:` → no bump but included in changelog. `prepareCmd` runs, in order: 1. `scripts/set-version.sh <ver>` — bump all version files 2. `cargo build --release` 3. UI build (`ui/`), tray build (`tray/`, `tauri build`) 4. `scripts/notarize-dmg.sh <ver>` — notarize + staple the `.dmg` (Tauri only signs+notarizes+staples the `.app`, not the `.dmg`) 5. `scripts/package-updater.sh <ver>` — build `latest.json` from the real minisign `.sig`, copy the versioned DMG to a stable `Meridian.dmg` name 6. `scripts/verify-release-bundle.sh <ver>` — hard gate: codesign identity, Gatekeeper offline ...