# Validate A Release

Validate the release, check the released binaries, is 0.18.x safe to roll out, prove a...

- Repository: https://github.com/different-ai/openwork (24362 stars)
- Category: Engineering
- License: see repository
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add different-ai/openwork --skill validate-a-release -g -a claude-code -y`
Codex: `npx skills add different-ai/openwork --skill validate-a-release -g -a codex -y`
Cursor: `npx skills add different-ai/openwork --skill validate-a-release -g -a cursor -y`
Gemini CLI: `npx skills add different-ai/openwork --skill validate-a-release -g -a gemini-cli -y`

## Description

Validate the release, check the released binaries, is 0.18.x safe to roll out, prove a published desktop release. Checks the RELEASED mac-arm64 enterprise and cloud binaries' signing and notarization and the updater manifests, and publishes evidence.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Skill: validate-a-release

Run after `release` reports the GitHub release published. Every check runs on
the artifacts users download, never on a local build. macOS arm64 host, `gh`
authenticated.

Booting packaged builds is covered before release, not here: the Linux
packaged smoke (`app-smoke`, "Packaged desktop smoke", which every alpha
release waits for) and the macOS signed update install
(`packaged-update-install`) in the scheduled `ci-tests.yml` run. Check that
the release commit's alpha run and latest scheduled run passed both.

## 1. Download and unpack

`V` is the release under test.

```bash
export V=0.18.45
export R=/tmp/ow-release-$V; mkdir -p $R && cd $R
gh release download v$V -R different-ai/openwork -p "openwork-enterprise-mac-arm64-$V.zip" -p "openwork-cloud-mac-arm64-$V.zip" -p '*.yml' --clobber
for f in enterprise cloud; do rm -rf $f-$V; mkdir $f-$V
  ditto -x -k openwork-$f-mac-arm64-$V.zip $f-$V && xattr -dr com.apple.quarantine $f-$V; done
export ENT="$R/enterprise-$V/OpenWork Enterprise.app" CLOUD="$R/cloud-$V/OpenWork Cloud.app"
```

## 2. Signing and notarization

```bash
for app in "$ENT" "$CLOUD"; do codesign --verify --deep --strict "$app" && spctl -a -t exec -vv "$app"; done
```

Expect `accepted`, `source=Notarized Developer ID`, `origin=Developer ID Application: Different AI inc. (F5DJWB4CCV)`.

## 3. Updater manifests

The rest: https://github.com/different-ai/openwork/blob/HEAD/.opencode/skills/validate-a-release/SKILL.md