Releasing NexusLink

Which workflow

Workflow	What it needs	Produces
`.github/workflows/release-nexuslink.yml` (use this)	only the built-in `GITHUB_TOKEN`	Linux binaries + deb/rpm, server binaries, Windows exe + NSIS installers (Linux runner) + MSI (Windows runner), macOS universal pkg, container images on GHCR, a GitHub release with checksums, `getting-started.sh`, `build-images.sh`, `install.sh`
`.github/workflows-upstream/release.yml` (parked)	NetBird's infrastructure: `sign-pipelines`, `packages`, `shared-actions` repos, Docker Hub, GPG rpm key, Homebrew tap token, package-repo upload secrets	NetBird's official pipeline; kept for reference and for a future migration

Upstream workflows that only work inside NetBird's organisation live in .github/workflows-upstream/ where GitHub ignores them (tools/branding/apply_hand_edits.py moves them there after every upstream merge). The CI test workflows stay active.

Cutting a release

git checkout main                       # or the merged update branch
git tag v0.78.1-nexus.1                 # <upstream version>-nexus.<n>
git push origin main v0.78.1-nexus.1

The tag triggers the pipeline; artifacts appear on the GitHub release page and images at ghcr.io/<org>/nexuslink-server, /reverse-proxy, /dashboard tagged 0.78.1-nexus.1. Point the self-hosted installer at them with NEXUSLINK_IMAGE_REGISTRY=ghcr.io/<org> NEXUSLINK_IMAGE_TAG=0.78.1-nexus.1. The same build runs locally with tools/release/build-installers.sh all or from the manager (Builds page).

Optional secrets (Settings > Secrets and variables > Actions)

Without these everything still builds, but unsigned. Add them when you have the certificates.

Secret	Used for	How to obtain
`MACOS_CERT_P12`	codesign the app and pkg	Developer ID Application + Installer certificates exported from Keychain as one `.p12`, base64-encoded (`base64 -i cert.p12 \\| pbcopy`)
`MACOS_CERT_PASSWORD`	password of the `.p12`	chosen at export
`MACOS_SIGN_IDENTITY`	e.g. `Developer ID Application: Nexus Remote Solutions (TEAMID)`	`security find-identity -v -p codesigning`
`MACOS_INSTALLER_SIGN_IDENTITY`	e.g. `Developer ID Installer: Nexus Remote Solutions (TEAMID)`	same
`MACOS_NOTARY_APPLE_ID`, `MACOS_NOTARY_TEAM_ID`, `MACOS_NOTARY_PASSWORD`	notarise + staple the pkg	Apple ID, team id and an app-specific password (appleid.apple.com)
`WINDOWS_CERT_PFX`	Authenticode-sign exe/msi with osslsigncode	code-signing certificate exported as `.pfx`, base64-encoded
`WINDOWS_CERT_PASSWORD`	password of the `.pfx`	from the CA

Container images are pushed to GHCR with the built-in token; to publish to Docker Hub instead, add a docker/login-action step with DOCKER_USER / DOCKER_TOKEN and set NEXUSLINK_IMAGE_REGISTRY to your namespace.

Not covered by the pipeline

Android / iOS apps: separate repositories; build the SDKs with tools/mobile/*.sh (Android needs the SDK/NDK on the runner, iOS needs a macOS runner with Xcode) and publish through Google Play / App Store Connect with your own signing keys.
Linux package repositories (apt/yum): the deb/rpm files are attached to the release; hosting a repository (pkgs.<domain>) is a separate service. The rpm files are unsigned unless you add GPG signing to nfpm.
Homebrew tap: create <org>/homebrew-tap and adapt client/ui/nexuslink-ui.rb.tmpl.