diff --git a/atom.gyp b/atom.gyp
deleted file mode 100644
index 46eff41c9..000000000
--- a/atom.gyp
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  'targets': [
-    {
-      'target_name': 'Atom',
-      'type': 'none',
-      'postbuilds': [
-        {
-          'postbuild_name': 'Create Atom, basically do everything',
-          'action': ['script/constructicon/build'],
-        },
-      ],
-    },
-  ],
-}
diff --git a/build/Gruntfile.coffee b/build/Gruntfile.coffee
index 85edc9c49..b00957cab 100644
--- a/build/Gruntfile.coffee
+++ b/build/Gruntfile.coffee
@@ -147,8 +147,10 @@ module.exports = (grunt) ->
         'dot-atom/**/*.coffee'
         'exports/**/*.coffee'
         'src/**/*.coffee'
-        'tasks/**/*.coffee'
-        'Gruntfile.coffee'
+      ]
+      build: [
+        'build/tasks/**/*.coffee'
+        'build/Gruntfile.coffee'
       ]
       test: [
         'spec/*.coffee'
@@ -221,7 +223,7 @@ module.exports = (grunt) ->
   grunt.registerTask('compile', ['coffee', 'prebuild-less', 'cson', 'peg'])
   grunt.registerTask('lint', ['coffeelint', 'csslint', 'lesslint'])
   grunt.registerTask('test', ['shell:kill-atom', 'run-specs'])
-  grunt.registerTask('ci', ['output-disk-space', 'download-atom-shell', 'build', 'set-development-version', 'lint', 'test', 'publish-build'])
+  grunt.registerTask('ci', ['output-disk-space', 'download-atom-shell', 'codesign', 'build', 'set-development-version', 'lint', 'test', 'publish-build'])
   grunt.registerTask('deploy', ['partial-clean', 'download-atom-shell', 'build', 'codesign'])
   grunt.registerTask('docs', ['markdown:guides', 'build-docs'])
   grunt.registerTask('default', ['download-atom-shell', 'build', 'set-development-version', 'install'])
diff --git a/build/tasks/codesign-task.coffee b/build/tasks/codesign-task.coffee
index fd4592eba..93920d7a7 100644
--- a/build/tasks/codesign-task.coffee
+++ b/build/tasks/codesign-task.coffee
@@ -3,6 +3,23 @@ module.exports = (grunt) ->
 
   grunt.registerTask 'codesign', 'Codesign the app', ->
     done = @async()
+
+    if process.env.XCODE_KEYCHAIN
+      unlockKeychain (error) ->
+        if error?
+          done(error)
+        else
+          signApp(done)
+    else
+      signApp(done)
+
+  unlockKeychain = (callback) ->
+    cmd = 'security'
+    {XCODE_KEYCHAIN_PASSWORD, XCODE_KEYCHAIN} = process.env
+    args = ['unlock-keychain', '-p', XCODE_KEYCHAIN_PASSWORD, XCODE_KEYCHAIN]
+    spawn {cmd, args}, (error) -> callback(error)
+
+  signApp = (callback) ->
     cmd = 'codesign'
     args = ['-f', '-v', '-s', 'Developer ID Application: GitHub', grunt.config.get('atom.shellAppDir')]
-    spawn {cmd, args}, (error) -> done(error)
+    spawn {cmd, args}, (error) -> callback(error)
diff --git a/build/tasks/publish-build-task.coffee b/build/tasks/publish-build-task.coffee
index 3f8dc909a..19f0aff90 100644
--- a/build/tasks/publish-build-task.coffee
+++ b/build/tasks/publish-build-task.coffee
@@ -24,13 +24,19 @@ module.exports = (gruntObject) ->
 
     done = @async()
 
-    createRelease (error, release) ->
+    createBuildRelease (error, release) ->
       return done(error) if error?
       zipApp (error) ->
         return done(error) if error?
         uploadAsset release, (error) ->
           return done(error) if error?
-          publishRelease(release, done)
+          publishRelease release, (error) ->
+            return done(error) if error?
+            getAtomDraftRelease (error, release) ->
+              return done(error) if error?
+              deleteExistingAsset release, (error) ->
+                return done(error) if error?
+                uploadAsset(release, done)
 
 logError = (message, error, details) ->
   grunt.log.error(message)
@@ -65,6 +71,18 @@ getRelease = (callback) ->
         return
       callback()
 
+getAtomDraftRelease = (callback) ->
+  atomRepo = new GitHub({repo: 'atom/atom', token})
+  atomRepo.getReleases (error, releases=[]) ->
+    if error?
+      logError('Fetching atom/atom releases failed', error, releases)
+      callback(error)
+    else
+      for release in releases when release.draft
+        callback(null, release)
+        return
+      callback(new Error('No draft release in atom/atom repo'))
+
 deleteRelease = (release) ->
   options =
     uri: release.url
@@ -92,7 +110,7 @@ deleteExistingAsset = (release, callback) ->
 
   callback()
 
-createRelease = (callback) ->
+createBuildRelease = (callback) ->
   getRelease (error, release) ->
     if error?
       callback(error)
@@ -123,7 +141,7 @@ createRelease = (callback) ->
 
 uploadAsset = (release, callback) ->
   options =
-    uri: "https://uploads.github.com/repos/atom/atom-master-builds/releases/#{release.id}/assets?name=#{assetName}"
+    uri: release.upload_url.replace(/\{.*$/, "?name=#{assetName}")
     method: 'POST'
     headers: _.extend({
       'Content-Type': 'application/zip'
diff --git a/script/cibuild b/script/cibuild
index c5b1a0423..6c7cb8ef5 100755
--- a/script/cibuild
+++ b/script/cibuild
@@ -10,11 +10,9 @@ if (process.platform == 'linux')
 
 var homeDir = process.platform == 'win32' ? process.env.USERPROFILE : process.env.HOME;
 
-function readEnvironmentVariables() {
-  var credentialsPath = '/var/lib/jenkins/config/atomcredentials';
+function loadEnvironmentVariables(filePath) {
   try {
-    var credentials = fs.readFileSync(credentialsPath, 'utf8');
-    var lines = credentials.trim().split('\n');
+    var lines = fs.readFileSync(filePath, 'utf8').trim().split('\n');
     for (i in lines) {
       var parts = lines[i].split('=');
       var key = parts[0].trim();
@@ -24,6 +22,11 @@ function readEnvironmentVariables() {
   } catch(error) { }
 }
 
+function readEnvironmentVariables() {
+  loadEnvironmentVariables('/var/lib/jenkins/config/atomcredentials')
+  loadEnvironmentVariables('/var/lib/jenkins/config/xcodekeychain')
+}
+
 readEnvironmentVariables();
 cp.safeExec.bind(global, 'node script/bootstrap', function(error) {
   if (error)
diff --git a/script/constructicon/build b/script/constructicon/build
deleted file mode 100755
index 5b0bd2b98..000000000
--- a/script/constructicon/build
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/bin/sh
-
-set -ex
-
-# This entire file is a hack so that constructicon can build Atom via
-# xcode
-
-cd "$(dirname "$0")/../.."
-rm -fr node_modules
-rm -fr vendor/apm/node_modules
-rm -fr build/node_modules
-./script/bootstrap --no-color
-./build/node_modules/.bin/grunt --no-color --build-dir="$BUILT_PRODUCTS_DIR" deploy
-
-echo "TARGET_BUILD_DIR=$BUILT_PRODUCTS_DIR"
-echo "FULL_PRODUCT_NAME=Atom.app"
-echo "PRODUCT_NAME=Atom"
diff --git a/script/constructicon/prebuild b/script/constructicon/prebuild
deleted file mode 100755
index 600a56afa..000000000
--- a/script/constructicon/prebuild
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/bin/sh
-
-set -ex
-cd "$(dirname "$0")/../.."
-export PATH="atom-shell/Atom.app/Contents/Resources/:${PATH}"
-
-rm -rf atom.xcodeproj
-gyp --depth=. atom.gyp