Releasing nurb

One release ships everything under one version: the signed DMGs, the in-app update feed, and the site changelog. The engine is not published on its own; the app bundles its wheel, so the vX.Y.Z GitHub release carries the DMGs and the updater archives, and the rolling desktop-latest prerelease carries the latest.json installed apps poll. This skill runs the whole ceremony. The one human act left in it is merging the bump PR, and that merge is the user approving the release.

Step 0: Preflight

All of these must pass before touching anything. If one fails, say which and stop.

gh auth status
test -f desktop/.env
test -f ~/.tauri/nurb-desktop.key
security find-identity -v -p codesigning | grep -q "Developer ID Application"
command -v shlock
git fetch origin main --tags

The updater key check matters most: without ~/.tauri/nurb-desktop.key shipped apps cannot update, and generating a fresh key would strand every existing install. If it is missing, stop and tell the user; never regenerate it. The gh login must be able to write to Shpigford/nurb; the script checks that before it builds.