ci: move the release-installer build from Gitea back to GitHub Actions
GitHub-hosted windows-latest/macos-latest replace the self-hosted act_runner pair; node 24 + corepack pnpm are set up explicitly (hosted images do not preinstall pnpm), and assets attach via gh release upload --clobber instead of the Gitea-API uploader script. macOS signing falls back to ad-hoc until a Developer ID cert + APPLE_API_ISSUER secret are provisioned on GitHub. Claude-Session: https://claude.ai/code/session_01A6RcwHhhsFYYrNdQB4ASuP
This commit is contained in:
ZacharyZhang-NY committed
1 parent
e116e0efa3
commit
1ea040c0f0
2 files changed
+56
-116
No files matched your search
@@ -1,65 +1,77 @@
|
||||
name: Build Release Installers
|
||||
|
||||
# Builds the Windows and macOS installers whenever a release is published on
|
||||
# Gitea and attaches them to that release. Only releases whose tag points at a
|
||||
# commit containing this file will trigger it; to back-fill installers onto an
|
||||
# older release, run this workflow manually with the release ID as input
|
||||
# (note: a manual run builds the dispatched ref's code, not the old tag's).
|
||||
# Builds the Windows and macOS installers whenever a release is published and
|
||||
# attaches them to that release. To back-fill installers onto an older
|
||||
# release, run this workflow manually with the release tag as input (note: a
|
||||
# manual run builds the dispatched ref's code, not the old tag's).
|
||||
#
|
||||
# Runner facts these jobs rely on (host-mode act_runner on both machines):
|
||||
# - windows-latest: node 24 + pnpm + git + curl on PATH; default shell is
|
||||
# Windows PowerShell 5.1, `shell: bash` is broken (WSL stub) - use cmd.
|
||||
# - macos-latest: node 24 (nvm) + corepack on PATH, no global pnpm; Xcode and
|
||||
# notarytool installed. Signed builds additionally need:
|
||||
# 1. the "Developer ID Application: Yang Zhang (9PDD8M2SMS)" certificate
|
||||
# WITH private key imported into the runner user's login keychain, and
|
||||
# (one-time, so headless codesign does not hang on a keychain prompt):
|
||||
# security unlock-keychain ~/Library/Keychains/login.keychain-db
|
||||
# security set-key-partition-list -S apple-tool:,apple: -s \
|
||||
# ~/Library/Keychains/login.keychain-db
|
||||
# 2. the APPLE_API_ISSUER repo secret (App Store Connect issuer ID) for
|
||||
# notarization, used together with the API key file in the repo.
|
||||
# Without these the macos job falls back to ad-hoc-signed, un-notarized
|
||||
# installers and emits a warning.
|
||||
# Runs on GitHub-hosted runners (windows-latest / macos-latest). Node 24 comes
|
||||
# from actions/setup-node; pnpm is activated via corepack and pinned by the
|
||||
# `packageManager` field in package.json.
|
||||
#
|
||||
# macOS signing: hosted runners have no Developer ID certificate in the
|
||||
# keychain, so the signing-detection step falls back to ad-hoc-signed,
|
||||
# un-notarized installers with a warning. To ship signed + notarized builds
|
||||
# from hosted runners you would need to import the "Developer ID Application:
|
||||
# Yang Zhang (9PDD8M2SMS)" certificate (e.g. a base64 P12 secret + an import
|
||||
# step) and set the APPLE_API_ISSUER secret (App Store Connect issuer ID)
|
||||
# used together with the API key file in the repo.
|
||||
#
|
||||
# (2026-08: this pipeline ran as .gitea/workflows/release-build.yml against
|
||||
# self-hosted runners while the GitHub account was unavailable.)
|
||||
|
||||
on:
|
||||
release:
|
||||
types: [published]
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
release_id:
|
||||
description: "Gitea release ID to attach installers to (back-fill)"
|
||||
tag:
|
||||
description: "Release tag to attach installers to (back-fill)"
|
||||
required: true
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
|
||||
env:
|
||||
COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
|
||||
|
||||
jobs:
|
||||
windows:
|
||||
name: Windows installer (NSIS x64)
|
||||
runs-on: windows-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
- name: Enable pnpm via corepack
|
||||
run: |
|
||||
corepack enable pnpm
|
||||
pnpm --version
|
||||
- name: Install dependencies
|
||||
shell: cmd
|
||||
run: call pnpm install --frozen-lockfile
|
||||
run: pnpm install --frozen-lockfile
|
||||
- name: Build installer
|
||||
shell: cmd
|
||||
run: call pnpm run package:win
|
||||
run: pnpm run package:win
|
||||
- name: List artifacts
|
||||
shell: cmd
|
||||
run: dir release
|
||||
run: Get-ChildItem release
|
||||
- name: Upload installer to release
|
||||
shell: cmd
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
RELEASE_ID: ${{ github.event.release.id || inputs.release_id }}
|
||||
run: node scripts/ci/upload-release-assets.mjs
|
||||
GH_TOKEN: ${{ github.token }}
|
||||
TAG: ${{ github.event.release.tag_name || inputs.tag }}
|
||||
run: |
|
||||
$exts = @('.exe', '.dmg', '.zip', '.AppImage', '.deb')
|
||||
$files = Get-ChildItem release -File | Where-Object { $exts -contains $_.Extension }
|
||||
if (-not $files) { throw "no uploadable artifacts found in release/" }
|
||||
gh release upload $env:TAG @($files.FullName) --clobber
|
||||
|
||||
macos:
|
||||
name: macOS installers (dmg + zip, x64 + arm64)
|
||||
runs-on: macos-latest
|
||||
env:
|
||||
COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
- name: Enable pnpm via corepack
|
||||
run: |
|
||||
corepack enable pnpm
|
||||
@@ -98,6 +110,13 @@ jobs:
|
||||
run: ls -la release
|
||||
- name: Upload installers to release
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
RELEASE_ID: ${{ github.event.release.id || inputs.release_id }}
|
||||
run: node scripts/ci/upload-release-assets.mjs
|
||||
GH_TOKEN: ${{ github.token }}
|
||||
TAG: ${{ github.event.release.tag_name || inputs.tag }}
|
||||
run: |
|
||||
shopt -s nullglob
|
||||
files=(release/*.dmg release/*.zip)
|
||||
if [ ${#files[@]} -eq 0 ]; then
|
||||
echo "no uploadable artifacts found in release/" >&2
|
||||
exit 1
|
||||
fi
|
||||
gh release upload "$TAG" "${files[@]}" --clobber
|
||||
@@ -1,79 +0,0 @@
|
||||
#!/usr/bin/env node
|
||||
/*
|
||||
* Attaches installer artifacts from release/ to the Gitea release that
|
||||
* triggered the workflow. The new asset is uploaded first and only then are
|
||||
* older same-named assets deleted (Gitea allows duplicate attachment names),
|
||||
* so a failed re-run never removes a previously good download.
|
||||
*
|
||||
* Required env: GITHUB_SERVER_URL, GITHUB_REPOSITORY (set by the runner),
|
||||
* GITEA_TOKEN, RELEASE_ID (set by the workflow step).
|
||||
*/
|
||||
import fs from 'node:fs';
|
||||
import path from 'node:path';
|
||||
|
||||
const server = process.env.GITHUB_SERVER_URL;
|
||||
const repo = process.env.GITHUB_REPOSITORY;
|
||||
const token = process.env.GITEA_TOKEN;
|
||||
const releaseId = process.env.RELEASE_ID;
|
||||
|
||||
for (const [name, value] of Object.entries({ GITHUB_SERVER_URL: server, GITHUB_REPOSITORY: repo, GITEA_TOKEN: token, RELEASE_ID: releaseId })) {
|
||||
if (!value) {
|
||||
console.error(`missing required env var ${name}`);
|
||||
process.exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
const apiBase = `${server.replace(/\/$/, '')}/api/v1/repos/${repo}/releases/${releaseId}`;
|
||||
const authHeader = { Authorization: `token ${token}` };
|
||||
|
||||
const INSTALLER_EXTS = new Set(['.exe', '.dmg', '.zip', '.AppImage', '.deb']);
|
||||
const releaseDir = path.resolve('release');
|
||||
|
||||
const files = fs
|
||||
.readdirSync(releaseDir, { withFileTypes: true })
|
||||
.filter((e) => e.isFile() && INSTALLER_EXTS.has(path.extname(e.name)))
|
||||
.map((e) => e.name)
|
||||
.sort();
|
||||
|
||||
if (files.length === 0) {
|
||||
console.error(`no uploadable artifacts found in ${releaseDir}`);
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
const releaseRes = await fetch(apiBase, { headers: authHeader });
|
||||
if (!releaseRes.ok) {
|
||||
console.error(`failed to fetch release ${releaseId}: ${releaseRes.status} ${await releaseRes.text()}`);
|
||||
process.exit(1);
|
||||
}
|
||||
const existingAssets = (await releaseRes.json()).assets ?? [];
|
||||
|
||||
for (const name of files) {
|
||||
const filePath = path.join(releaseDir, name);
|
||||
const sizeMb = (fs.statSync(filePath).size / 1024 / 1024).toFixed(1);
|
||||
|
||||
const stale = existingAssets.filter((a) => a.name === name);
|
||||
|
||||
const form = new FormData();
|
||||
form.append('attachment', await fs.openAsBlob(filePath), name);
|
||||
const res = await fetch(`${apiBase}/assets?name=${encodeURIComponent(name)}`, {
|
||||
method: 'POST',
|
||||
headers: authHeader,
|
||||
body: form,
|
||||
});
|
||||
if (!res.ok) {
|
||||
console.error(`failed to upload ${name}: ${res.status} ${await res.text()}`);
|
||||
process.exit(1);
|
||||
}
|
||||
console.log(`uploaded ${name} (${sizeMb} MB)`);
|
||||
|
||||
for (const asset of stale) {
|
||||
const del = await fetch(`${apiBase}/assets/${asset.id}`, { method: 'DELETE', headers: authHeader });
|
||||
if (!del.ok && del.status !== 404) {
|
||||
console.error(`failed to delete stale asset ${name} (id ${asset.id}): ${del.status} ${await del.text()}`);
|
||||
process.exit(1);
|
||||
}
|
||||
console.log(`deleted stale asset ${name} (id ${asset.id})`);
|
||||
}
|
||||
}
|
||||
|
||||
console.log(`done: ${files.length} asset(s) attached to release ${releaseId}`);
|
||||
Reference in new issue
Block a user