feat: add CI release pipeline, self-update, Apple signing, and Homebrew

arcaven · arcaven · commit 391d0e899921 · 2026-04-05T00:04:34.000-05:00
Per-commit releases from main: build for darwin-arm64, linux-amd64,
linux-arm64. Apple code signing and notarization for macOS. Homebrew
formula at arcavenae/tap/kos. Self-update via `kos update`. Build-time
version injection via build.rs.

New files: build.rs, src/updater.rs, scripts/create-{app,dmg,pkg}.sh,
packaging/Info.plist, Formula/kos.rb. New dep: reqwest (blocking, rustls).
New subcommands: kos update, kos version. justfile: just install.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -36,6 +36,12 @@ regex = "1"
 # Content hashing for drift detection
 sha2 = "0.10"
 
+# Self-update (GitHub releases API)
+reqwest = { version = "0.12", default-features = false, features = ["blocking", "json", "rustls-tls"] }
+
+[build-dependencies]
+chrono = "0.4"
+
 [dev-dependencies]
 insta = { version = "1", features = ["yaml", "json"] }
 tempfile = "3"
diff --git a/Formula/kos.rb b/Formula/kos.rb
@@ -0,0 +1,27 @@
+# Homebrew formula for kos
+# Updated automatically by CI on every push to main
+# macOS only (arm64). Linux users: download from GitHub releases.
+
+class Kos < Formula
+  desc "Knowledge Operating System — graph-based knowledge accumulation for designed systems"
+  homepage "https://github.com/arcavenae/kos"
+  url "https://github.com/arcavenae/kos/releases/download/TAG_PLACEHOLDER/kos-darwin-arm64"
+  version "VERSION_PLACEHOLDER"
+  sha256 "SHA256_ARM64_PLACEHOLDER"
+  license "Apache-2.0"
+
+  def install
+    bin.install "kos-darwin-arm64" => "kos"
+  end
+
+  def caveats
+    <<~EOS
+      kos updates on every push to main.
+      Self-update: kos update
+    EOS
+  end
+
+  test do
+    assert_match "kos", shell_output("#{bin}/kos --version 2>&1")
+  end
+end
diff --git a/build.rs b/build.rs
@@ -0,0 +1,39 @@
+use std::env;
+use std::process::Command;
+
+fn main() {
+    let version = env::var("CARGO_PKG_VERSION").unwrap_or_else(|_| "0.0.0".to_string());
+
+    let commit = Command::new("git")
+        .args(["rev-parse", "--short", "HEAD"])
+        .output()
+        .ok()
+        .and_then(|o| {
+            if o.status.success() {
+                String::from_utf8(o.stdout)
+                    .ok()
+                    .map(|s| s.trim().to_string())
+            } else {
+                None
+            }
+        })
+        .unwrap_or_else(|| "unknown".to_string());
+
+    let build_time = chrono::Utc::now().to_rfc3339();
+
+    let channel = env::var("KOS_CHANNEL").unwrap_or_else(|_| "main".to_string());
+    let tag = env::var("KOS_TAG").unwrap_or_else(|_| format!("{version}-{commit}"));
+
+    let long_version = format!("{tag} ({commit}, {channel})");
+
+    println!("cargo:rustc-env=KOS_VERSION={version}");
+    println!("cargo:rustc-env=KOS_COMMIT={commit}");
+    println!("cargo:rustc-env=KOS_BUILD_TIME={build_time}");
+    println!("cargo:rustc-env=KOS_CHANNEL={channel}");
+    println!("cargo:rustc-env=KOS_TAG={tag}");
+    println!("cargo:rustc-env=KOS_LONG_VERSION={long_version}");
+
+    println!("cargo:rerun-if-changed=.git/HEAD");
+    println!("cargo:rerun-if-env-changed=KOS_CHANNEL");
+    println!("cargo:rerun-if-env-changed=KOS_TAG");
+}
diff --git a/deny.toml b/deny.toml
@@ -14,5 +14,9 @@ allow = [
   "CC0-1.0",
 ]
 
+[[licenses.exceptions]]
+allow = ["CDLA-Permissive-2.0"]
+name = "webpki-roots"
+
 [bans]
 multiple-versions = "warn"
diff --git a/justfile b/justfile
@@ -14,6 +14,12 @@ build:
 build-release:
     cargo build --release
 
+# Install to ~/.local/bin
+install: build-release
+    mkdir -p ~/.local/bin
+    cp target/release/kos ~/.local/bin/kos
+    @echo "Installed kos to ~/.local/bin/kos"
+
 # Run kos with arguments
 run *args:
     cargo run -- {{args}}
diff --git a/packaging/Info.plist b/packaging/Info.plist
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleIdentifier</key>
+	<string>com.arcavenae.kos</string>
+	<key>CFBundleName</key>
+	<string>Kos</string>
+	<key>CFBundleDisplayName</key>
+	<string>Kos</string>
+	<key>CFBundleExecutable</key>
+	<string>kos</string>
+	<key>CFBundleVersion</key>
+	<string>VERSION_PLACEHOLDER</string>
+	<key>CFBundleShortVersionString</key>
+	<string>VERSION_PLACEHOLDER</string>
+	<key>CFBundlePackageType</key>
+	<string>APPL</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>LSMinimumSystemVersion</key>
+	<string>12.0</string>
+	<key>LSUIElement</key>
+	<true/>
+	<key>NSHighResolutionCapable</key>
+	<true/>
+</dict>
+</plist>
diff --git a/scripts/create-app.sh b/scripts/create-app.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+set -euo pipefail
+
+# create-app.sh - Create a macOS .app bundle
+# Usage: ./scripts/create-app.sh <binary-path> <version> <output-dir>
+
+BINARY_PATH="${1:?Usage: create-app.sh <binary-path> <version> <output-dir>}"
+VERSION="${2:?Version required}"
+OUTPUT_DIR="${3:?Output directory required}"
+
+if [ ! -f "$BINARY_PATH" ]; then
+  echo "Error: binary not found: $BINARY_PATH" >&2
+  exit 1
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+APP_BUNDLE="${OUTPUT_DIR}/Kos.app"
+
+rm -rf "$APP_BUNDLE"
+mkdir -p "$APP_BUNDLE/Contents/MacOS"
+mkdir -p "$APP_BUNDLE/Contents/Resources"
+
+cp "$BINARY_PATH" "$APP_BUNDLE/Contents/MacOS/kos"
+chmod +x "$APP_BUNDLE/Contents/MacOS/kos"
+
+sed "s/VERSION_PLACEHOLDER/$VERSION/g" "$PROJECT_ROOT/packaging/Info.plist" \
+  > "$APP_BUNDLE/Contents/Info.plist"
+
+echo "APPL????" > "$APP_BUNDLE/Contents/PkgInfo"
+
+echo "Created app bundle: $APP_BUNDLE"
diff --git a/scripts/create-dmg.sh b/scripts/create-dmg.sh
@@ -0,0 +1,37 @@
+#!/bin/bash
+set -euo pipefail
+
+# create-dmg.sh - Create a macOS .dmg disk image
+# Usage: ./scripts/create-dmg.sh <app-bundle-path> <version> <output-path>
+
+APP_PATH="${1:?Usage: create-dmg.sh <app-bundle-path> <version> <output-path>}"
+VERSION="${2:?Version required}"
+OUTPUT_PATH="${3:?Output path required}"
+
+if [ ! -d "$APP_PATH" ]; then
+  echo "Error: app bundle not found: $APP_PATH" >&2
+  exit 1
+fi
+
+STAGING_DIR=$(mktemp -d)
+trap 'rm -rf "$STAGING_DIR"' EXIT
+
+cp -R "$APP_PATH" "$STAGING_DIR/"
+ln -s /Applications "$STAGING_DIR/Applications"
+
+rm -f "$OUTPUT_PATH"
+sync
+sleep 1
+hdiutil create -volname "Kos $VERSION" \
+  -srcfolder "$STAGING_DIR" \
+  -ov -format UDZO \
+  "$OUTPUT_PATH" || {
+  echo "Retrying after hdiutil failure..."
+  sleep 3
+  hdiutil create -volname "Kos $VERSION" \
+    -srcfolder "$STAGING_DIR" \
+    -ov -format UDZO \
+    "$OUTPUT_PATH"
+}
+
+echo "Created dmg: $OUTPUT_PATH"
diff --git a/scripts/create-pkg.sh b/scripts/create-pkg.sh
@@ -0,0 +1,36 @@
+#!/bin/bash
+set -euo pipefail
+
+# create-pkg.sh - Create a signed macOS pkg installer
+# Usage: ./scripts/create-pkg.sh <binary-path> <version> <signing-identity> <output-path>
+
+if [ "${SKIP_SIGNING:-}" = "true" ]; then
+  echo "Skipping pkg creation (SKIP_SIGNING=true)"
+  exit 0
+fi
+
+BINARY_PATH="${1:?Usage: create-pkg.sh <binary-path> <version> <signing-identity> <output-path>}"
+VERSION="${2:?Version required}"
+SIGNING_IDENTITY="${3:?Signing identity required}"
+OUTPUT_PATH="${4:?Output path required}"
+
+if [ ! -f "$BINARY_PATH" ]; then
+  echo "Error: binary not found: $BINARY_PATH" >&2
+  exit 1
+fi
+
+STAGING_DIR=$(mktemp -d)
+trap 'rm -rf "$STAGING_DIR"' EXIT
+
+mkdir -p "$STAGING_DIR/usr/local/bin"
+cp "$BINARY_PATH" "$STAGING_DIR/usr/local/bin/kos"
+chmod +x "$STAGING_DIR/usr/local/bin/kos"
+
+pkgbuild --root "$STAGING_DIR" \
+  --identifier com.arcavenae.kos \
+  --version "$VERSION" \
+  --install-location / \
+  --sign "$SIGNING_IDENTITY" \
+  "$OUTPUT_PATH"
+
+echo "Created pkg: $OUTPUT_PATH"
diff --git a/src/error.rs b/src/error.rs
@@ -28,6 +28,9 @@ pub enum KosError {
 
     #[error("init error: {message}")]
     Init { message: String },
+
+    #[error("update error: {message}")]
+    Update { message: String },
 }
 
 pub type Result<T> = std::result::Result<T, KosError>;
diff --git a/src/lib.rs b/src/lib.rs
@@ -8,5 +8,6 @@ pub mod graph;
 pub mod init;
 pub mod model;
 pub mod orient;
+pub mod updater;
 pub mod validate;
 pub mod workspace;
diff --git a/src/main.rs b/src/main.rs
@@ -10,7 +10,7 @@ use clap::Parser;
 /// Reads typed YAML nodes, validates schema, renders graphs,
 /// and detects drift across the knowledge substrate.
 #[derive(Parser)]
-#[command(name = "kos", version, about)]
+#[command(name = "kos", version = env!("KOS_LONG_VERSION"), about)]
 struct Cli {
     #[command(subcommand)]
     command: Commands,
@@ -92,6 +92,12 @@ enum Commands {
         #[arg(long)]
         fix: bool,
     },
+
+    /// Update kos to the latest release
+    Update,
+
+    /// Show version, commit, build time, and channel
+    Version,
 }
 
 fn main() -> anyhow::Result<()> {
@@ -232,6 +238,47 @@ fn main() -> anyhow::Result<()> {
             let workspace = kos::workspace::Workspace::discover(&cwd)?;
             kos::doctor::run(&workspace, &cwd, merged, fix)?;
         }
+
+        Commands::Update => {
+            let method = kos::updater::detect_install_method()?;
+            match method {
+                kos::updater::InstallMethod::Homebrew => {
+                    println!("kos was installed via Homebrew. Run: brew upgrade kos");
+                    return Ok(());
+                }
+                kos::updater::InstallMethod::LinuxPackageManager { manager } => {
+                    println!(
+                        "kos was installed via {manager}. Use your package manager to update."
+                    );
+                    return Ok(());
+                }
+                kos::updater::InstallMethod::DirectBinary => {}
+            }
+
+            let current_tag = env!("KOS_TAG");
+            match kos::updater::check_for_update()? {
+                Some(latest) if latest == current_tag => {
+                    println!("Already up to date: {current_tag}");
+                }
+                Some(latest) => {
+                    println!("Current: {current_tag}");
+                    println!("Latest:  {latest}");
+                    let new_tag = kos::updater::download_and_install()?;
+                    println!("Updated to {new_tag}. Restart kos to use the new version.");
+                }
+                None => {
+                    println!("No releases found.");
+                }
+            }
+        }
+
+        Commands::Version => {
+            println!("kos {}", env!("KOS_LONG_VERSION"));
+            println!("  version:    {}", env!("KOS_VERSION"));
+            println!("  commit:     {}", env!("KOS_COMMIT"));
+            println!("  build time: {}", env!("KOS_BUILD_TIME"));
+            println!("  channel:    {}", env!("KOS_CHANNEL"));
+        }
     }
 
     Ok(())
diff --git a/src/updater.rs b/src/updater.rs

Original file line number	Diff line number	Diff line change
`@@ -14,5 +14,9 @@ allow = [`
`14`	`14`	`"CC0-1.0",`
`15`	`15`	`]`
`16`	`16`
	`17`	`+[[licenses.exceptions]]`
	`18`	`+allow = ["CDLA-Permissive-2.0"]`
	`19`	`+name = "webpki-roots"`
	`20`	`+`
`17`	`21`	`[bans]`
`18`	`22`	`multiple-versions = "warn"`