CI/CD Pipeline (Temporary Manual Release Mode)

Voxeltron is temporarily running in manual release mode from build-mac.

Current Mode

• Release host: build-mac
• Release entrypoint: scripts/release/manual-release.sh
• Woodpecker release pipeline: paused for day-to-day release operations
• GitHub release workflow: manual fallback only (workflow_dispatch)

Build Host Access

ssh build-mac

Required Environment Variables

• GH_TOKEN
• DOCKER_USERNAME
• DOCKER_PASSWORD
• GPG_PRIVATE_KEY (ASCII-armored or base64-encoded private key)
• GPG_PASSPHRASE
• GPG_KEY_ID

Manual Release Commands

# Full release (includes smoke gate)
./scripts/release/manual-release.sh vX.Y.Z

# Skip smoke gate (emergency only)
./scripts/release/manual-release.sh vX.Y.Z --skip-smoke

# Build artifacts without publishing
./scripts/release/manual-release.sh vX.Y.Z --dry-run

Manual Release Quick Checklist

Use this sequence for every short-term manual release:

1. Connect to build-mac and ensure a clean working tree:

   ssh build-mac
   cd /path/to/voxeltron
   git status --short

2. Confirm required environment variables are present (GH_TOKEN, Docker creds, GPG vars).
3. Run a dry run first to build artifacts without publishing:

   ./scripts/release/manual-release.sh vX.Y.Z --dry-run

4. Publish the release:

   ./scripts/release/manual-release.sh vX.Y.Z

5. Verify integrity artifacts after publish (PASS/FAIL output):

   ./scripts/release/verify-release-artifacts.sh dist

6. Confirm release assets exist on GitHub for the new tag.

Verification Expectations

1. checksums.txt matches published artifacts
2. GPG metadata signatures verify (Release.gpg, repomd.xml.asc)
3. Release includes expected assets (.tar.gz, .deb, .rpm, SBOMs, repo snapshots, signing key)

Exit Criteria for Manual Mode

1. Woodpecker release pipeline validated end-to-end on build-mac
2. Secret management stable
3. A dry-run and one successful tagged release completed with verification evidence