Add CI verification, read the Apple key from a secret, add README

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -0,0 +1,29 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
+
+jobs:
+  verify:
+    name: Typecheck, lint, tests, e2e
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+      - name: Enable pnpm via corepack
+        run: corepack enable pnpm
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Verify
+        run: pnpm verify:ci

.github/workflows/release-build.yml

@@ -1,24 +1,9 @@
 name: Build Release Installers
 
-# Builds the Windows and macOS installers whenever a release is published and
+# Builds Windows and macOS installers when a release is published and
-# attaches them to that release. To back-fill installers onto an older
+# attaches them to it. macOS builds are signed and notarized only when the
-# release, run this workflow manually with the release tag as input (note: a
+# runner has the Developer ID identity and the APPLE_API_ISSUER and
-# manual run builds the dispatched ref's code, not the old tag's).
+# APPLE_API_KEY_P8 secrets are set; otherwise they are ad-hoc signed.
-#
-# Runs on GitHub-hosted runners (windows-latest / macos-latest). Node 24 comes
-# from actions/setup-node; pnpm is activated via corepack and pinned by the
-# `packageManager` field in package.json.
-#
-# macOS signing: hosted runners have no Developer ID certificate in the
-# keychain, so the signing-detection step falls back to ad-hoc-signed,
-# un-notarized installers with a warning. To ship signed + notarized builds
-# from hosted runners you would need to import the "Developer ID Application:
-# Yang Zhang (9PDD8M2SMS)" certificate (e.g. a base64 P12 secret + an import
-# step) and set the APPLE_API_ISSUER secret (App Store Connect issuer ID)
-# used together with the API key file in the repo.
-#
-# (2026-08: this pipeline ran as .gitea/workflows/release-build.yml against
-# self-hosted runners while the GitHub account was unavailable.)
 
 on:
   release:
@@ -82,23 +67,24 @@ jobs:
         id: signing
         env:
           APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
         run: |
-          if security find-identity -v -p codesigning | grep -q "Developer ID Application: Yang Zhang (9PDD8M2SMS)" && [ -n "$APPLE_API_ISSUER" ]; then
+          if security find-identity -v -p codesigning | grep -q "Developer ID Application: Yang Zhang (9PDD8M2SMS)" && [ -n "$APPLE_API_ISSUER" ] && [ -n "$APPLE_API_KEY_P8" ]; then
             echo "signed=true" >> "$GITHUB_OUTPUT"
             echo "Developer ID identity and notarization credentials found: building signed + notarized installers."
           else
             echo "signed=false" >> "$GITHUB_OUTPUT"
-            echo "::warning::Building ad-hoc-signed, un-notarized macOS installers. To enable signing + notarization, see the setup steps in the header of this workflow file."
+            echo "::warning::Building ad-hoc-signed, un-notarized macOS installers."
           fi
       - name: Build installers (signed + notarized)
         if: steps.signing.outputs.signed == 'true'
         env:
-          APPLE_API_KEY: ${{ github.workspace }}/ApiKey_ZDCSZ5IE7071.p8
+          APPLE_API_KEY: ${{ runner.temp }}/apple-api-key.p8
           APPLE_API_KEY_ID: ZDCSZ5IE7071
           APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
-        # forceCodeSigning makes a signing failure fail the build instead of
+          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
-        # silently attaching unsigned installers to the release.
         run: |
+          printf '%s' "$APPLE_API_KEY_P8" > "$APPLE_API_KEY"
           pnpm build
           pnpm exec electron-builder --mac --x64 --arm64 --publish never -c.forceCodeSigning=true
       - name: Build installers (ad-hoc fallback)

README.md

@@ -0,0 +1,54 @@
+# AgentCompany
+
+A desktop app that runs a company of AI agents. You set a goal. An AI CEO hires a team, splits the goal into tasks, and the agents do the work against real model providers. You watch, chat, and approve.
+
+Electron, React, and SQLite. Company data lives in a local database; prompts go to the model providers you connect.
+
+## Run it
+
+Needs Node 24 and pnpm 11 (`corepack enable pnpm`).
+
+```sh
+pnpm install
+pnpm dev
+```
+
+## Keys
+
+The app ships with no keys. Add your own in **Settings > Integrations**:
+
+| Key | Used for | Get one |
+|---|---|---|
+| Composio API key | Connectors page and agent connector tools | platform.composio.dev |
+| logo.dev publishable key | Connector logos | logo.dev |
+| Google Antigravity OAuth client secret | Google Antigravity sign-in | Google |
+
+Model provider keys and sign-ins live in **Settings > Providers**. All keys are encrypted with the OS keychain.
+
+## Test
+
+```sh
+pnpm verify:ci
+```
+
+Typecheck, lint, unit, contract, integration, replay-eval, and Electron e2e.
+
+## Build installers
+
+```sh
+pnpm package:win
+pnpm package:mac
+pnpm package:linux
+```
+
+Without an Apple Developer ID, build macOS with the ad-hoc config:
+
+```sh
+pnpm build && pnpm exec electron-builder --mac --publish never --config electron-builder.unsigned.yml
+```
+
+GitHub Actions runs `verify:ci` on pushes to `main` and on pull requests, and attaches installers to each published release.
+
+## License
+
+MIT