fix: unify GoodBuddy release signing identity

Use one generic GoodBuddy Ed25519 identity for the Agent bundle, bundled Runtime, outer package, and signed catalog while preserving each layer's existing signature domain. Rename the production Environment contract to GOODBUDDY_SIGNING_*, register the matching production public key, and keep desktop and branch CI workflows isolated from the private key.
2026-08-25 22:02:47 +08:00
parent bcd347e092
commit 0cb7007429
12 changed files with 47 additions and 60 deletions
@@ -227,12 +227,12 @@ Release note: 修复左上角项目设置与消息通道项目设置不一致的
  the checked-in public key registry.
 - `.github/workflows/agent-release.yml` is the only production compound Agent
  publication path. It requires an annotated immutable Agent tag, the protected
-  `agent-signing` Environment, native x64/arm64 builds, one production Agent
-  signing identity for every layer of the compound package and catalog, a
-  non-Latest GitHub Agent Release, and synchronized immutable Beijing OSS
-  objects plus the final signed latest-catalog pointer.
+  `agent-signing` Environment, native x64/arm64 builds, one production
+  GoodBuddy signing identity for every layer of the compound package and
+  catalog, a non-Latest GitHub Agent Release, and synchronized immutable
+  Beijing OSS objects plus the final signed latest-catalog pointer.
 - `.github/workflows/packages.yml` and `release:package` build only desktop
-  products. Missing Agent packages, remote Runtime inputs, or Agent signing
+  products. Missing Agent packages, remote Runtime inputs, or GoodBuddy signing
  credentials must never block an ordinary desktop package or release.
 - Keep electron-builder invocations on `--publish never`. Main-branch builds
  run validation and build the production bundle without running the native