Releases on git.crt.fyi from a workflow: a v* tag push runs .forgejo/workflows/release.yml (tag = package.json version and every version copy, the full CI, Linux AppImage + deb and Windows NSIS on the VDS runners, privacy scan with the private terms, one Forgejo release with short CHANGELOG-summary notes, the installers and SHA256SUMS, older release entries deleted, tags kept); workflow_dispatch dry run makes a draft test-<sha> and deletes it; desktop.yml folded in, ci.yml and release.yml share .forgejo/actions/linux-setup and ci-run; tools/forgejo-release.ts (notes, upsert, prune, delete; uploads over 100 MB go to the origin because Cloudflare refuses them); desktop-release.ts upload-forgejo adds the notarized DMG and updater bundle from the Mac; docs/desktop-release.md release order

CHANGELOG.md

@@ -144,6 +144,12 @@ TestFlight distribute from real use (2026-10-13, pitfall 42):
   parameter the operation does not declare in `cli/api/apple.gen.ts`, or one in the new `APPLE_LIVE_REJECTED` list
   (declared, refused live). `storebound api apple` refuses those parameters too. The fake App Store Connect in the
   tests answers 400 PARAMETER_ERROR.ILLEGAL to such parameters, as the live API does.
+- **Releases on git.crt.fyi come from a workflow.** A `v*` tag push runs `.forgejo/workflows/release.yml`: version
+  checks, the full CI, the Linux and Windows installers, the privacy scan, then one Forgejo release with short notes
+  (the CHANGELOG summary, install line, links), the installers and SHA256SUMS; older release entries are deleted
+  (tags stay). The Mac adds the notarized DMG with `desktop-release.ts upload-forgejo`. A dry run (workflow_dispatch)
+  makes a draft `test-<sha>` and deletes it. `desktop.yml` is folded into release.yml; ci.yml and release.yml share
+  their setup (`.forgejo/actions/`).
 
 ## 0.7.1 · 2026-10-13