Bring #10 to main: setup from the app, one Drive folder per Mac, README for Homebrew

.github/workflows/release.yml

@@ -1,21 +1,23 @@
 name: Release
 
-# Tag vX.Y.Z -> uniwersalny CloudMachine.app (Apple Silicon + Intel) podpisany
-# STALYM certyfikatem, .dmg w GitHub Release i zaktualizowany cask w
+# Tag vX.Y.Z -> universal CloudMachine.app (Apple Silicon + Intel) signed with
+# a STABLE certificate, a .dmg in the GitHub Release and an updated cask in
 # RenaCode/homebrew-tap (`brew install --cask renacode/tap/cloudmachine`).
 #
-# Pull request zmieniajacy budowanie albo cask przechodzi ten sam potok na
-# sucho: podpis ad-hoc, bez wydania i bez tapu, artefakty do pobrania z runu.
+# A pull request that changes the build or the cask goes through the same
+# pipeline as a dry run: ad-hoc signature, no release and no tap, artifacts
+# downloadable from the run.
 #
-# Sekrety (tylko dla tagu):
-#   CM_SIGNING_P12_BASE64, CM_SIGNING_P12_PASSWORD - certyfikat self-signed
-#     "CloudMachine Release Signing" (patrz packaging/README.md). Bez niego
-#     wydanie sie NIE buduje: podpis ad-hoc zmienia tozsamosc appki przy
-#     kazdym wydaniu i macOS cofa Pelny dostep do dysku po kazdym upgradzie.
-#   HOMEBREW_TAP_TOKEN - token z prawem zapisu do RenaCode/homebrew-tap.
+# Secrets (tag only):
+#   CM_SIGNING_P12_BASE64, CM_SIGNING_P12_PASSWORD - the self-signed
+#     "CloudMachine Release Signing" certificate (see packaging/README.md).
+#     Without it the release does NOT build: an ad-hoc signature changes the
+#     app's identity on every release and macOS revokes Full Disk Access after
+#     every upgrade.
+#   HOMEBREW_TAP_TOKEN - token with write access to RenaCode/homebrew-tap.
 #
-# Nadal brak Developer ID i notaryzacji - Gatekeeper nie zna wydawcy; cask
-# zdejmuje kwarantanne w postflight.
+# Still no Developer ID and no notarization - Gatekeeper does not know the
+# publisher; the cask removes the quarantine attribute in postflight.
 
 on:
   push:
@@ -49,7 +51,7 @@ jobs:
         run: |
           version="$(tr -d '[:space:]' < mac-app/VERSION)"
           if [ "$IS_RELEASE" = "true" ] && [ "${GITHUB_REF_NAME}" != "v${version}" ]; then
-            echo "::error::Tag ${GITHUB_REF_NAME} != v${version} z mac-app/VERSION. Podbij VERSION albo popraw tag."
+            echo "::error::Tag ${GITHUB_REF_NAME} != v${version} from mac-app/VERSION. Bump VERSION or fix the tag."
             exit 1
           fi
           echo "version=${version}" >> "$GITHUB_OUTPUT"
@@ -65,7 +67,7 @@ jobs:
           P12_PASSWORD: ${{ secrets.CM_SIGNING_P12_PASSWORD }}
         run: |
           if [ -z "$P12_BASE64" ] || [ -z "$P12_PASSWORD" ]; then
-            echo "::error::Brak sekretow CM_SIGNING_P12_*. Wydanie podpisane ad-hoc cofaloby Pelny dostep do dysku po kazdym upgradzie - przerywam. Patrz packaging/README.md."
+            echo "::error::CM_SIGNING_P12_* secrets are missing. An ad-hoc signed release would revoke Full Disk Access after every upgrade - aborting. See packaging/README.md."
             exit 1
           fi
           keychain="$RUNNER_TEMP/signing.keychain-db"
@@ -80,8 +82,8 @@ jobs:
           security import "$RUNNER_TEMP/cert.p12" -k "$keychain" -P "$P12_PASSWORD" \
             -T /usr/bin/codesign -T /usr/bin/security
           security set-key-partition-list -S apple-tool:,apple: -s -k "$keychain_password" "$keychain"
-          # Dopisujemy do listy wyszukiwania, bo `build-app` szuka certyfikatu
-          # przez `security find-certificate -c` bez wskazania keychaina.
+          # Add it to the search list, because `build-app` looks for the
+          # certificate with `security find-certificate -c` without naming a keychain.
           security list-keychains -d user -s "$keychain" $(security list-keychains -d user | tr -d '"')
           sudo security add-trusted-cert -d -r trustRoot -p codeSign \
             -k /Library/Keychains/System.keychain "$RUNNER_TEMP/cert.pem"
@@ -98,16 +100,16 @@ jobs:
             archs="$(lipo -archs "build/CloudMachine.app/Contents/MacOS/$bin")"
             echo "$bin: $archs"
             case "$archs" in *arm64*x86_64*|*x86_64*arm64*) ;; *)
-              echo "::error::$bin nie jest uniwersalny ($archs)"; exit 1 ;;
+              echo "::error::$bin is not universal ($archs)"; exit 1 ;;
             esac
           done
           codesign --verify --deep --strict build/CloudMachine.app
           signature="$(codesign -dv --verbose=2 build/CloudMachine.app 2>&1)"
           echo "$signature"
-          # `build-app` po cichu spada do ad-hoc, gdy nie znajdzie certyfikatu -
-          # tu to musi byc blad, nie ostrzezenie.
+          # `build-app` silently falls back to ad-hoc when it cannot find the
+          # certificate - here that has to be an error, not a warning.
           if [ "$IS_RELEASE" = "true" ] && ! grep -qF "Authority=$CM_SIGNING_CERT_NAME" <<<"$signature"; then
-            echo "::error::Wydanie nie jest podpisane certyfikatem '$CM_SIGNING_CERT_NAME'."
+            echo "::error::The release is not signed with the '$CM_SIGNING_CERT_NAME' certificate."
             exit 1
           fi
 
@@ -124,13 +126,13 @@ jobs:
           sed -e "s/__VERSION__/${version}/" -e "s/__SHA256__/${sha256}/" \
             packaging/homebrew/cloudmachine.rb.in > mac-app/build/cloudmachine.rb
           if grep -q '__[A-Z0-9]*__' mac-app/build/cloudmachine.rb; then
-            echo "::error::W casku zostal niewypelniony znacznik."; exit 1
+            echo "::error::An unfilled placeholder is left in the cask."; exit 1
           fi
           echo "${sha256}  CloudMachine-${version}.dmg" > "mac-app/build/CloudMachine-${version}.dmg.sha256"
           echo "dmg=${dmg}" >> "$GITHUB_OUTPUT"
 
-      # Reguly dla caskow `brew style` stosuje tylko do plikow w Casks/ tapu -
-      # na luznym pliku sprawdza go jak zwykly Ruby i przepuszcza bledy caska.
+      # `brew style` applies the cask rules only to files in a tap's Casks/ -
+      # on a loose file it checks it as plain Ruby and lets cask errors through.
       - name: brew style + audit
         env:
           HOMEBREW_NO_AUTO_UPDATE: "1"
@@ -167,7 +169,7 @@ jobs:
           TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
         run: |
           if [ -z "$TAP_TOKEN" ]; then
-            echo "::error::Wydanie opublikowane, ale brak HOMEBREW_TAP_TOKEN - cask w tapie NIE zostal zaktualizowany. Zawartosc do recznego wstawienia:"
+            echo "::error::Release published, but HOMEBREW_TAP_TOKEN is missing - the cask in the tap was NOT updated. Contents to insert manually:"
             cat mac-app/build/cloudmachine.rb
             exit 1
           fi
@@ -190,7 +192,7 @@ jobs:
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git add Casks/cloudmachine.rb
           if git diff --cached --quiet; then
-            echo "Cask bez zmian."; exit 0
+            echo "Cask unchanged."; exit 0
           fi
           git commit -m "cloudmachine ${{ steps.version.outputs.version }}"
           git push

.gitignore

@@ -1,34 +1,34 @@
-# Konfiguracja z danymi osobistymi (nazwy maszyn, limity) - kazdy uzytkownik ma wlasna
+# Configuration with personal data (machine names, limits) - every user has their own
 config/machines.json
 
-# Logi
+# Logs
 *.log
 logs/
 
-# rclone config (zawiera tokeny OAuth) - nigdy nie commitowac
+# rclone config (contains OAuth tokens) - never commit
 rclone.conf
 *.conf
 
-# Wygenerowane pliki launchd (zawieraja lokalne sciezki uzytkownika)
+# Generated launchd files (contain the user's local paths)
 launchd/*.plist
 !launchd/*.plist.template
 
 # OS
 .DS_Store
 
-# Robocze/testowe sparsebundle uzywane recznie do eksperymentow z hdiutil/rclone -
-# to sa binarne pliki testowe, nie kod projektu.
+# Scratch/test sparsebundles used manually for hdiutil/rclone experiments -
+# these are binary test files, not project code.
 scratch/
 
-# Globalny ~/.gitignore_global na tym koncie ignoruje katalogi "scripts" -
-# to jest kluczowy kod tego projektu, wiec jawnie go odignorowujemy.
+# The global ~/.gitignore_global on this account ignores "scripts" directories -
+# that is key code for this project, so we explicitly un-ignore it.
 !scripts/
 !scripts/*.sh
 
-# Lokalny stan narzedzi Claude / claude-flow / ruflo.
-# To sa artefakty konkretnej maszyny i sesji (liczniki edycji, polityki,
-# przyjeta konfiguracja) - nie opisuja projektu i nie naleza do repozytorium.
-# Definicje agentow (.claude/agents/) i CLAUDE.md zostaja SLEDZONE celowo.
+# Local state of the Claude / claude-flow / ruflo tools.
+# These are artifacts of a specific machine and session (edit counters, policies,
+# adopted configuration) - they do not describe the project and do not belong in
+# the repository. Agent definitions (.claude/agents/) and CLAUDE.md stay TRACKED on purpose.
 .claude-flow/
 .claude/proven-config.json
 .claude/.proven-config-version