# Release checklist

## Local verification

1. Confirm Node 22, GNOME dependencies, PipeWire, portal access, and a QVAC
   GPU backend with `npm run gpu-doctor`, `npm run cu-doctor`, and
   `npm run voice-doctor`.
2. Run `npm ci`, `npm test`, and `npm run package:test`.
3. Review `dist/SHA256SUMS` and test the user installer in a disposable user
   session with `packaging/install.sh --enable`.
4. Run the typed first-run smoke test and the computer-use acceptance flow.

## Gitea rolling release

`.gitea/workflows/rolling-release.yml` runs on pushes to `main`. It tests the
tree, builds the `.deb`, extension zip, and checksums, then uses the repository
secret `RELEASE_TOKEN` to move the `rolling` tag and replace the `rolling`
prerelease through the Gitea REST API. The token is passed only as an Actions
secret and is never written to artifacts or logs.

Release artifacts are intentionally marked prerelease. Create a permanent
release by downloading the rolling artifacts, validating them on the target
Ubuntu release, and using a separately reviewed tag.

## Rollback

Use the previous commit's artifacts or rerun the workflow for that commit. The
rolling tag is mutable by design; permanent tags remain immutable release
records.