@pablozaiden/installer 0.0.6 → 0.0.8

package/README.md

@@ -26,6 +26,36 @@ Supported targets are:
 
 Tags may be provided as `1.2.3` or `v1.2.3`; release assets are always resolved with the `v` tag form published by GitHub releases.
 
+## Reusable build version action
+
+Use the shared action to resolve the version embedded in a build:
+
+```yaml
+- name: Resolve build version
+  id: version
+  uses: pablozaiden/installer/.github/actions/resolve-version@main
+  with:
+    mode: main
+    github_token: ${{ github.token }}
+    update_package_version: true
+```
+
+The action exposes `steps.version.outputs.version` and
+`steps.version.outputs.base_version`. In `release` mode, it removes the leading
+`v` from `release_tag` (or `GITHUB_REF_NAME`). In `main` mode, it reads the
+latest published release, increments its patch component, and appends the UTC
+timestamp and seven-character commit SHA:
+
+```text
+8.5.9 -> 8.5.10-main-2026-07-11-14-48-abcdef1
+```
+
+If the repository has no published release, the base version is `0.0.0`, so
+the first main build is `0.0.1-main-<timestamp>-<short-sha>`. Set
+`latest_release_tag` when the release lookup must be supplied explicitly.
+Pin the action to an immutable commit in production workflows instead of
+using `main`.
+
 ## Generic one-line installer
 
 Use the installer directly from this repository:
@@ -223,6 +253,9 @@ jobs:
     uses: pablozaiden/installer/.github/workflows/reusable-binary-release.yml@main
     permissions:
       contents: write
+    secrets:
+      macos_signing_certificate_base64: ${{ secrets.MACOS_SIGNING_CERTIFICATE_BASE64 }}
+      macos_signing_certificate_password: ${{ secrets.MACOS_SIGNING_CERTIFICATE_PASSWORD }}
     with:
       prebuild_command: bun run build
       binaries: |
@@ -236,6 +269,16 @@ jobs:
         ]
 ```
 
+When both macOS signing secrets are provided, the workflow imports the
+Base64-encoded PKCS#12 certificate into a temporary keychain on each macOS
+runner and signs every macOS binary before staging it. The password is never
+written to the workflow environment after keychain setup. If neither secret is
+provided, macOS artifacts remain unsigned; providing only one secret fails the
+macOS job. The PKCS#12 must contain the code-signing certificate and its private key.
+The workflow trusts that certificate for code signing on the ephemeral runner;
+self-signed certificates are supported when their certificate and private key
+are supplied together.
+
 For a project with multiple binaries:
 
 ```yaml
@@ -290,6 +333,8 @@ Manual `workflow_dispatch` publishes with the `unstable` tag.
 
 ## Development
 
+This package type-checks with TypeScript 7.
+
 ```bash
 bun install
 bun run build

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pablozaiden/installer",
-  "version": "0.0.6",
+  "version": "0.0.8",
   "description": "Reusable GitHub release binary installer and updater utilities",
   "repository": {
     "type": "git",
@@ -33,9 +33,10 @@
     "test": "bun test"
   },
   "devDependencies": {
-    "@types/bun": "latest"
+    "@types/bun": "^1.3.13",
+    "typescript": "^7.0.2"
   },
   "peerDependencies": {
-    "typescript": "^5"
+    "typescript": "^7.0.0"
   }
 }