From 1ea040c0f04cd02beef8a8732dbf906d98eb3803 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=9B=B7=E7=94=B5=E8=8A=BD=E8=A1=A3?= Date: Tue, 1 Sep 2026 01:10:07 -0400 Subject: [PATCH] ci: move the release-installer build from Gitea back to GitHub Actions GitHub-hosted windows-latest/macos-latest replace the self-hosted act_runner pair; node 24 + corepack pnpm are set up explicitly (hosted images do not preinstall pnpm), and assets attach via gh release upload --clobber instead of the Gitea-API uploader script. macOS signing falls back to ad-hoc until a Developer ID cert + APPLE_API_ISSUER secret are provisioned on GitHub. Claude-Session: https://claude.ai/code/session_01A6RcwHhhsFYYrNdQB4ASuP --- .../workflows/release-build.yml | 93 +++++++++++-------- scripts/ci/upload-release-assets.mjs | 79 ---------------- 2 files changed, 56 insertions(+), 116 deletions(-) rename {.gitea => .github}/workflows/release-build.yml (50%) delete mode 100644 scripts/ci/upload-release-assets.mjs diff --git a/.gitea/workflows/release-build.yml b/.github/workflows/release-build.yml similarity index 50% rename from .gitea/workflows/release-build.yml rename to .github/workflows/release-build.yml index ded13b49..9ab09b43 100644 --- a/.gitea/workflows/release-build.yml +++ b/.github/workflows/release-build.yml @@ -1,65 +1,77 @@ name: Build Release Installers -# Builds the Windows and macOS installers whenever a release is published on -# Gitea and attaches them to that release. Only releases whose tag points at a -# commit containing this file will trigger it; to back-fill installers onto an -# older release, run this workflow manually with the release ID as input -# (note: a manual run builds the dispatched ref's code, not the old tag's). +# Builds the Windows and macOS installers whenever a release is published and +# attaches them to that release. To back-fill installers onto an older +# release, run this workflow manually with the release tag as input (note: a +# manual run builds the dispatched ref's code, not the old tag's). # -# Runner facts these jobs rely on (host-mode act_runner on both machines): -# - windows-latest: node 24 + pnpm + git + curl on PATH; default shell is -# Windows PowerShell 5.1, `shell: bash` is broken (WSL stub) - use cmd. -# - macos-latest: node 24 (nvm) + corepack on PATH, no global pnpm; Xcode and -# notarytool installed. Signed builds additionally need: -# 1. the "Developer ID Application: Yang Zhang (9PDD8M2SMS)" certificate -# WITH private key imported into the runner user's login keychain, and -# (one-time, so headless codesign does not hang on a keychain prompt): -# security unlock-keychain ~/Library/Keychains/login.keychain-db -# security set-key-partition-list -S apple-tool:,apple: -s \ -# ~/Library/Keychains/login.keychain-db -# 2. the APPLE_API_ISSUER repo secret (App Store Connect issuer ID) for -# notarization, used together with the API key file in the repo. -# Without these the macos job falls back to ad-hoc-signed, un-notarized -# installers and emits a warning. +# Runs on GitHub-hosted runners (windows-latest / macos-latest). Node 24 comes +# from actions/setup-node; pnpm is activated via corepack and pinned by the +# `packageManager` field in package.json. +# +# macOS signing: hosted runners have no Developer ID certificate in the +# keychain, so the signing-detection step falls back to ad-hoc-signed, +# un-notarized installers with a warning. To ship signed + notarized builds +# from hosted runners you would need to import the "Developer ID Application: +# Yang Zhang (9PDD8M2SMS)" certificate (e.g. a base64 P12 secret + an import +# step) and set the APPLE_API_ISSUER secret (App Store Connect issuer ID) +# used together with the API key file in the repo. +# +# (2026-08: this pipeline ran as .gitea/workflows/release-build.yml against +# self-hosted runners while the GitHub account was unavailable.) on: release: types: [published] workflow_dispatch: inputs: - release_id: - description: "Gitea release ID to attach installers to (back-fill)" + tag: + description: "Release tag to attach installers to (back-fill)" required: true +permissions: + contents: write + +env: + COREPACK_ENABLE_DOWNLOAD_PROMPT: "0" + jobs: windows: name: Windows installer (NSIS x64) runs-on: windows-latest steps: - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version: 24 + - name: Enable pnpm via corepack + run: | + corepack enable pnpm + pnpm --version - name: Install dependencies - shell: cmd - run: call pnpm install --frozen-lockfile + run: pnpm install --frozen-lockfile - name: Build installer - shell: cmd - run: call pnpm run package:win + run: pnpm run package:win - name: List artifacts - shell: cmd - run: dir release + run: Get-ChildItem release - name: Upload installer to release - shell: cmd env: - GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }} - RELEASE_ID: ${{ github.event.release.id || inputs.release_id }} - run: node scripts/ci/upload-release-assets.mjs + GH_TOKEN: ${{ github.token }} + TAG: ${{ github.event.release.tag_name || inputs.tag }} + run: | + $exts = @('.exe', '.dmg', '.zip', '.AppImage', '.deb') + $files = Get-ChildItem release -File | Where-Object { $exts -contains $_.Extension } + if (-not $files) { throw "no uploadable artifacts found in release/" } + gh release upload $env:TAG @($files.FullName) --clobber macos: name: macOS installers (dmg + zip, x64 + arm64) runs-on: macos-latest - env: - COREPACK_ENABLE_DOWNLOAD_PROMPT: "0" steps: - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version: 24 - name: Enable pnpm via corepack run: | corepack enable pnpm @@ -98,6 +110,13 @@ jobs: run: ls -la release - name: Upload installers to release env: - GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }} - RELEASE_ID: ${{ github.event.release.id || inputs.release_id }} - run: node scripts/ci/upload-release-assets.mjs + GH_TOKEN: ${{ github.token }} + TAG: ${{ github.event.release.tag_name || inputs.tag }} + run: | + shopt -s nullglob + files=(release/*.dmg release/*.zip) + if [ ${#files[@]} -eq 0 ]; then + echo "no uploadable artifacts found in release/" >&2 + exit 1 + fi + gh release upload "$TAG" "${files[@]}" --clobber diff --git a/scripts/ci/upload-release-assets.mjs b/scripts/ci/upload-release-assets.mjs deleted file mode 100644 index 39b49231..00000000 --- a/scripts/ci/upload-release-assets.mjs +++ /dev/null @@ -1,79 +0,0 @@ -#!/usr/bin/env node -/* - * Attaches installer artifacts from release/ to the Gitea release that - * triggered the workflow. The new asset is uploaded first and only then are - * older same-named assets deleted (Gitea allows duplicate attachment names), - * so a failed re-run never removes a previously good download. - * - * Required env: GITHUB_SERVER_URL, GITHUB_REPOSITORY (set by the runner), - * GITEA_TOKEN, RELEASE_ID (set by the workflow step). - */ -import fs from 'node:fs'; -import path from 'node:path'; - -const server = process.env.GITHUB_SERVER_URL; -const repo = process.env.GITHUB_REPOSITORY; -const token = process.env.GITEA_TOKEN; -const releaseId = process.env.RELEASE_ID; - -for (const [name, value] of Object.entries({ GITHUB_SERVER_URL: server, GITHUB_REPOSITORY: repo, GITEA_TOKEN: token, RELEASE_ID: releaseId })) { - if (!value) { - console.error(`missing required env var ${name}`); - process.exit(1); - } -} - -const apiBase = `${server.replace(/\/$/, '')}/api/v1/repos/${repo}/releases/${releaseId}`; -const authHeader = { Authorization: `token ${token}` }; - -const INSTALLER_EXTS = new Set(['.exe', '.dmg', '.zip', '.AppImage', '.deb']); -const releaseDir = path.resolve('release'); - -const files = fs - .readdirSync(releaseDir, { withFileTypes: true }) - .filter((e) => e.isFile() && INSTALLER_EXTS.has(path.extname(e.name))) - .map((e) => e.name) - .sort(); - -if (files.length === 0) { - console.error(`no uploadable artifacts found in ${releaseDir}`); - process.exit(1); -} - -const releaseRes = await fetch(apiBase, { headers: authHeader }); -if (!releaseRes.ok) { - console.error(`failed to fetch release ${releaseId}: ${releaseRes.status} ${await releaseRes.text()}`); - process.exit(1); -} -const existingAssets = (await releaseRes.json()).assets ?? []; - -for (const name of files) { - const filePath = path.join(releaseDir, name); - const sizeMb = (fs.statSync(filePath).size / 1024 / 1024).toFixed(1); - - const stale = existingAssets.filter((a) => a.name === name); - - const form = new FormData(); - form.append('attachment', await fs.openAsBlob(filePath), name); - const res = await fetch(`${apiBase}/assets?name=${encodeURIComponent(name)}`, { - method: 'POST', - headers: authHeader, - body: form, - }); - if (!res.ok) { - console.error(`failed to upload ${name}: ${res.status} ${await res.text()}`); - process.exit(1); - } - console.log(`uploaded ${name} (${sizeMb} MB)`); - - for (const asset of stale) { - const del = await fetch(`${apiBase}/assets/${asset.id}`, { method: 'DELETE', headers: authHeader }); - if (!del.ok && del.status !== 404) { - console.error(`failed to delete stale asset ${name} (id ${asset.id}): ${del.status} ${await del.text()}`); - process.exit(1); - } - console.log(`deleted stale asset ${name} (id ${asset.id})`); - } -} - -console.log(`done: ${files.length} asset(s) attached to release ${releaseId}`);