Builds and releases

Scopwis separates ordinary CI, compatibility artifacts, and protected release evidence.

Version tags

Release tags use:

vX.Y.Z
vX.Y.Z-beta.N

The tag, Cargo workspace version, and Flutter core version must agree.

Before tagging, run:

cargo run -p scopwis-xtask -- release check --tag v0.1.0

Beta vs stable

Beta/testing packages are convenient compatibility artifacts and may use temporary signing identities where the platform requires one. Stable/final assets pass the protected signing, checksum, SBOM, and attestation path.

A testing package is never silently relabeled as production-signed.

Distribution

The project publishes native client packages, CLI/TUI archives/installers, Linux Server archives, and a multi-architecture Server OCI image. Platform packaging remains native: APK/AAB, IPA, DMG/ZIP, MSIX/MSI/ZIP, and tar.gz where appropriate.

Supply-chain gate

Final assets are tied to:

SHA-256 checksums;
a release manifest;
an SPDX SBOM;
platform signing state where applicable;
GitHub Artifact Attestation;
Server smoke evidence for native Server archives.

Website releases

The documentation/marketing website is independent of the Flutter Web application. A push to main that changes the website source triggers the website verification workflow; Cloudflare Git integration builds site-dist with the repository-owned Rust renderer and deploys it through Wrangler.

Current public docs describe the current product. Historical behavior remains available from Git tags and GitHub Releases instead of being mixed into the live docs navigation.