R1

docs/RELEASE.md

@@ -0,0 +1,29 @@
+# Release checklist
+
+## Local verification
+
+1. Confirm Node 22, GNOME dependencies, PipeWire, portal access, and a QVAC
+   GPU backend with `npm run gpu-doctor`, `npm run cu-doctor`, and
+   `npm run voice-doctor`.
+2. Run `npm ci`, `npm test`, and `npm run package:test`.
+3. Review `dist/SHA256SUMS` and test the user installer in a disposable user
+   session with `packaging/install.sh --enable`.
+4. Run the typed first-run smoke test and the computer-use acceptance flow.
+
+## Gitea rolling release
+
+`.gitea/workflows/rolling-release.yml` runs on pushes to `main`. It tests the
+tree, builds the `.deb`, extension zip, and checksums, then uses the repository
+secret `RELEASE_TOKEN` to move the `rolling` tag and replace the `rolling`
+prerelease through the Gitea REST API. The token is passed only as an Actions
+secret and is never written to artifacts or logs.
+
+Release artifacts are intentionally marked prerelease. Create a permanent
+release by downloading the rolling artifacts, validating them on the target
+Ubuntu release, and using a separately reviewed tag.
+
+## Rollback
+
+Use the previous commit's artifacts or rerun the workflow for that commit. The
+rolling tag is mutable by design; permanent tags remain immutable release
+records.