SafeCall Docs

Appearance

Release Scripts ​

The scripts/release/ directory contains automated release pipelines for the server, Ariadne, Theseus, and Keryx.

Server Release (release/server.ts) ​

Interactive pipeline that tests, bumps the version, builds, and pushes a tagged release.

bash
bun commit                            # interactive (prompts for type + message)
bun commit patch                      # prompts for message only
bun commit patch "Fix important bug"  # runs directly
bun commit --vm patch "Fix bug"       # also runs the VM test suite on VirtualBox before upload

Pipeline:

  1. Prompt for bump type (major / minor / patch) and commit message
  2. With --vm: check the VirtualBox VM starts, accepts the login and can sudo
  3. Run server tests (bun test)
  4. With --full: run E2E frontend tests (Playwright)
  5. Run contract tests (scripts/test/contracts.ts)
  6. Bump VERSION and BUILD_DATE in server/src/server.ts
  7. Build (frontend + embeds + Linux binaries via scripts/build/server.sh), including the binary smoke test
  8. With --vm: run the VM test suite on VirtualBox against the new offline bundle (server.sh --vm-test)
  9. Upload docs, website, binaries and installer artifacts (part of server.sh)
  10. Git commit, tag (vX.Y.Z), and push

If any step fails, the pipeline aborts before the git commit — a broken build never gets tagged. With --vm, a failing VM suite also stops the build before anything is uploaded.

Ariadne Release (release/ariadne.ts) ​

Interactive pipeline for Ariadne app releases.

bash
bun release:ariadne                            # interactive
bun release:ariadne patch                      # prompts for message only
bun release:ariadne patch "Fix navigation bug" # runs directly

Pipeline:

  1. Prompt for bump type and commit message
  2. Run server tests
  3. Run contract tests
  4. Run Flutter analyze
  5. Run Flutter tests
  6. Bump version and build in ariadne/pubspec.yaml
  7. Signed Android AAB (fails closed without key.properties + keystore)
  8. Signed iOS IPA (macOS; fails closed without ExportOptions.plist)
  9. Git commit, tag (ariadne-vX.Y.Z), and push
  10. Print Internal upload checklist (Play Internal + TestFlight Internal)

Missing signing files abort the pipeline. Debug signing is never used for store artifacts.

Theseus Release (release/theseus.ts) ​

bash
bun release:theseus
bun release:theseus patch "Internal track"

Requires THESEUS_UNLOCK_HASH, THESEUS_OPS_SERVER_URL, and THESEUS_OPS_SUBSCRIBE_AUTH from NAS / Apple Passwords (not git). Upload to Play Internal and TestFlight Internal only. Where each value is and how to load it: Theseus release.

Keryx Release (release/keryx.ts and release/keryx-commit.ts) ​

bash
bun keryx                            # bump, signed AAB+IPA, commit, tag, push
bun run release:keryx                # rebuild current pubspec (no git)

Signed artifacts are copied to releases/keryx.aab and releases/Keryx.ipa (same gitignored layout as Ariadne / Theseus). Store upload stays manual.

Lab deploy (deploy.ts) ​

bash
bun run lab:deploy

Builds web --release, generates embeds, rsyncs runtime trees only (config/, lib/, server/, web/build/, web/src/lib/contracts.ts) to con.ssh:/home/thomas/websites/safecall-lab.sourcectl.com, remote bun install in lib/ and server/, restarts safecall-lab.service. Never overwrites config/main.config.json, server/db/, or server/maps/. Packet: lab-server.md.

Version Sources ​

  • Server version: const VERSION in server/src/server.ts
  • Ariadne version: version: field in ariadne/pubspec.yaml
  • Theseus version: version: field in theseus/pubspec.yaml
  • Keryx version: version: field in keryx/pubspec.yaml
  • Semantic versioning (MAJOR.MINOR.PATCH)