Releasing

Release pipeline

The release process is automated via reusable workflows from kdeldycke/repomatic. A push to main triggers the release.yaml workflow, which produces:

All release artifacts are signed with GitHub Artifact Attestations providing SLSA v1 provenance.

The release PR must be merged via “Rebase and merge” (never squash). See the repomatic-release skill for the full mechanics.

GNOME Shell extension

The build-gnome-extension job of release.yaml packs gnome-shell/mpm@kdeldycke.github.io with gnome-extensions pack and hands the zip to the release engine, which attaches it to the release and attests it like every other artifact. Publishing it on extensions.gnome.org stays manual, and is only needed when the extension actually changed: see the extension’s release process.

Screenshots

Each release tag starts docs-screenshots.yaml, which photographs the menus of the bar plugin and of the GNOME Shell extension at the released version. It opens or refreshes one pull request per frontend with the frames that changed.

Chocolatey

The Chocolatey package definition is maintained in-tree at packaging/choco/meta-package-manager/, but is no longer pushed to the Chocolatey community repository (see Impact on Chocolatey for the rejection rationale). The automated chocolatey job has been removed from release.yaml; only the in-tree nuspec remains, so users can build and install locally and the choco-source job in tests-install.yaml keeps the build instructions exercised.

The package directory name must match the nuspec basename: this is enforced by Chocolatey-AU’s AUPackage, which derives the nuspec path from Split-Path -Leaf $pwd.

Guix

meta-package-manager and its dependencies are part of GNU Guix upstream, merged via guix/guix#8047 on 2026-06-28. The package definition is also maintained in-tree at packaging/guix/. The guix job in release.yaml runs after the main release, computes the git-fetch hash of the tagged checkout (the NAR SHA256 in Nix-style base32, see packaging/guix/update.py), and updates the .scm file. Dependencies newer than the Guix channel ships live in packaging/guix/meta-package-manager/dependencies.scm, which the job does not bump. Since Guix packages live on Codeberg and require reviewed PRs, the job only opens a PR to this repository with the updated definition, and none when the definition is already current; each version bump is then forwarded upstream as a new Guix PR.

Nix

The Nix package definition is maintained in-tree at packaging/nix/ while NixOS/nixpkgs#506145 is pending review. The nix job in release.yaml runs after the main release, computes the SRI hash of the GitHub source tarball using nix-prefetch-url, and updates package.nix. The job opens a PR to this repository with the updated definition, which can then be pushed to the nixpkgs PR branch. A definition carrying an # update-hold: comment is left as is, and the comment gives the reason. The job opens no PR when no definition changed.

Two dependencies (click-extra and extra-platforms) are also bundled in packaging/nix/ since they are not yet in nixpkgs. So is cloup 4.0.0, and click is pinned to 8.5.0, until nixpkgs ships both. overlay.nix adds them to the Python package set, and both default.nix and flake.nix read it. Once the nixpkgs PR lands and nixpkgs catches up, the overlay and bundled dependencies become unnecessary.

Channels refreshed by hand

Only the Guix and Nix definitions have a bump job in release.yaml. The channels below are refreshed by hand as part of each release. The packaging page catalogs their build instructions and upstream submission statuses.

  • The Alpine APKBUILD overlay (packaging/alpine/) pins the released version and the checksums of its source archives. So does the MacPorts Portfile overlay (packaging/macports/).

  • The Chocolatey nuspec (packaging/choco/) pins the released version and the checksums of the Windows binaries.

  • The openSUSE spec (packaging/opensuse/) pins the released version, and its .changes file logs it.

  • The Ubuntu PPA has no pin: packaging/ppa/build-source.py packages the newest tag, and each series is uploaded by hand.

  • Void Linux has no spec in this repository: its templates live in a pull request outside it.

Antivirus false positives on Windows binaries

Moved to the binaries catalog, which pairs the engineering background, false-positive playbook, and long-term mitigations with the live per-release detection data.