From c4b8cdcdfec21f47329d6fdb00342a14547b5d6e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=9B=B7=E7=94=B5=E8=8A=BD=E8=A1=A3?= Date: Thu, 8 Oct 2026 01:38:53 -0400 Subject: [PATCH] Add CI verification, read the Apple key from a secret, add README Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 29 ++++++++++++++++ .github/workflows/release-build.yml | 34 ++++++------------ README.md | 54 +++++++++++++++++++++++++++++ 3 files changed, 93 insertions(+), 24 deletions(-) create mode 100644 .github/workflows/ci.yml create mode 100644 README.md diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 00000000..dad3f76e --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,29 @@ +name: CI + +on: + push: + branches: [main] + pull_request: + workflow_dispatch: + +permissions: + contents: read + +env: + COREPACK_ENABLE_DOWNLOAD_PROMPT: "0" + +jobs: + verify: + name: Typecheck, lint, tests, e2e + runs-on: windows-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version: 24 + - name: Enable pnpm via corepack + run: corepack enable pnpm + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Verify + run: pnpm verify:ci diff --git a/.github/workflows/release-build.yml b/.github/workflows/release-build.yml index 9ab09b43..ef0de336 100644 --- a/.github/workflows/release-build.yml +++ b/.github/workflows/release-build.yml @@ -1,24 +1,9 @@ name: Build Release Installers -# Builds the Windows and macOS installers whenever a release is published and -# attaches them to that release. To back-fill installers onto an older -# release, run this workflow manually with the release tag as input (note: a -# manual run builds the dispatched ref's code, not the old tag's). -# -# Runs on GitHub-hosted runners (windows-latest / macos-latest). Node 24 comes -# from actions/setup-node; pnpm is activated via corepack and pinned by the -# `packageManager` field in package.json. -# -# macOS signing: hosted runners have no Developer ID certificate in the -# keychain, so the signing-detection step falls back to ad-hoc-signed, -# un-notarized installers with a warning. To ship signed + notarized builds -# from hosted runners you would need to import the "Developer ID Application: -# Yang Zhang (9PDD8M2SMS)" certificate (e.g. a base64 P12 secret + an import -# step) and set the APPLE_API_ISSUER secret (App Store Connect issuer ID) -# used together with the API key file in the repo. -# -# (2026-08: this pipeline ran as .gitea/workflows/release-build.yml against -# self-hosted runners while the GitHub account was unavailable.) +# Builds Windows and macOS installers when a release is published and +# attaches them to it. macOS builds are signed and notarized only when the +# runner has the Developer ID identity and the APPLE_API_ISSUER and +# APPLE_API_KEY_P8 secrets are set; otherwise they are ad-hoc signed. on: release: @@ -82,23 +67,24 @@ jobs: id: signing env: APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }} + APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }} run: | - if security find-identity -v -p codesigning | grep -q "Developer ID Application: Yang Zhang (9PDD8M2SMS)" && [ -n "$APPLE_API_ISSUER" ]; then + if security find-identity -v -p codesigning | grep -q "Developer ID Application: Yang Zhang (9PDD8M2SMS)" && [ -n "$APPLE_API_ISSUER" ] && [ -n "$APPLE_API_KEY_P8" ]; then echo "signed=true" >> "$GITHUB_OUTPUT" echo "Developer ID identity and notarization credentials found: building signed + notarized installers." else echo "signed=false" >> "$GITHUB_OUTPUT" - echo "::warning::Building ad-hoc-signed, un-notarized macOS installers. To enable signing + notarization, see the setup steps in the header of this workflow file." + echo "::warning::Building ad-hoc-signed, un-notarized macOS installers." fi - name: Build installers (signed + notarized) if: steps.signing.outputs.signed == 'true' env: - APPLE_API_KEY: ${{ github.workspace }}/ApiKey_ZDCSZ5IE7071.p8 + APPLE_API_KEY: ${{ runner.temp }}/apple-api-key.p8 APPLE_API_KEY_ID: ZDCSZ5IE7071 APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }} - # forceCodeSigning makes a signing failure fail the build instead of - # silently attaching unsigned installers to the release. + APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }} run: | + printf '%s' "$APPLE_API_KEY_P8" > "$APPLE_API_KEY" pnpm build pnpm exec electron-builder --mac --x64 --arm64 --publish never -c.forceCodeSigning=true - name: Build installers (ad-hoc fallback) diff --git a/README.md b/README.md new file mode 100644 index 00000000..a25dc7d6 --- /dev/null +++ b/README.md @@ -0,0 +1,54 @@ +# AgentCompany + +A desktop app that runs a company of AI agents. You set a goal. An AI CEO hires a team, splits the goal into tasks, and the agents do the work against real model providers. You watch, chat, and approve. + +Electron, React, and SQLite. Company data lives in a local database; prompts go to the model providers you connect. + +## Run it + +Needs Node 24 and pnpm 11 (`corepack enable pnpm`). + +```sh +pnpm install +pnpm dev +``` + +## Keys + +The app ships with no keys. Add your own in **Settings > Integrations**: + +| Key | Used for | Get one | +|---|---|---| +| Composio API key | Connectors page and agent connector tools | platform.composio.dev | +| logo.dev publishable key | Connector logos | logo.dev | +| Google Antigravity OAuth client secret | Google Antigravity sign-in | Google | + +Model provider keys and sign-ins live in **Settings > Providers**. All keys are encrypted with the OS keychain. + +## Test + +```sh +pnpm verify:ci +``` + +Typecheck, lint, unit, contract, integration, replay-eval, and Electron e2e. + +## Build installers + +```sh +pnpm package:win +pnpm package:mac +pnpm package:linux +``` + +Without an Apple Developer ID, build macOS with the ad-hoc config: + +```sh +pnpm build && pnpm exec electron-builder --mac --publish never --config electron-builder.unsigned.yml +``` + +GitHub Actions runs `verify:ci` on pushes to `main` and on pull requests, and attaches installers to each published release. + +## License + +MIT