ZacharyZhang-NYandClaude Opus 5.5
7b07bcea02
CI / Typecheck, lint, tests, e2e (push) Successful in 3m37s
v1.5.1 shipped ad-hoc macOS installers with only a warning: the runner ran as a system LaunchDaemon, outside the login keychain's session. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
125 lines
4.5 KiB
YAML
125 lines
4.5 KiB
YAML
name: Build Release Installers
|
|
|
|
# A pushed v* tag builds Windows, Linux and macOS installers on the Gitea
|
|
# runners and attaches them to the tag's release. The tag must equal
|
|
# "v" + package.json version. macOS builds are signed and notarized when the
|
|
# APPLE_API_* secrets are set (the Developer ID identity must then be reachable,
|
|
# or the job fails); without those secrets they are ad-hoc signed.
|
|
|
|
on:
|
|
push:
|
|
tags: ["v*"]
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
env:
|
|
COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
|
|
GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
jobs:
|
|
release:
|
|
name: Release for the tag
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- uses: actions/setup-node@v5
|
|
with:
|
|
node-version: 24
|
|
package-manager-cache: false
|
|
- name: Check version and create the release
|
|
run: node scripts/gitea-release.mjs create
|
|
|
|
windows:
|
|
name: Windows installer (NSIS x64)
|
|
needs: release
|
|
runs-on: windows-latest
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- uses: actions/setup-node@v5
|
|
with:
|
|
node-version: 24
|
|
package-manager-cache: false
|
|
- name: Enable pnpm via corepack
|
|
run: corepack enable pnpm
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Build installer
|
|
run: pnpm run package:win
|
|
- name: Upload installer
|
|
run: node scripts/gitea-release.mjs upload release
|
|
|
|
linux:
|
|
name: Linux packages (AppImage + deb x64)
|
|
needs: release
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- uses: actions/setup-node@v5
|
|
with:
|
|
node-version: 24
|
|
package-manager-cache: false
|
|
- name: Enable pnpm via corepack
|
|
run: corepack enable pnpm
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Build packages
|
|
run: pnpm run package:linux
|
|
- name: Upload packages
|
|
run: node scripts/gitea-release.mjs upload release
|
|
|
|
macos:
|
|
name: macOS installers (dmg + zip, x64 + arm64)
|
|
needs: release
|
|
runs-on: macos-latest
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- uses: actions/setup-node@v5
|
|
with:
|
|
node-version: 24
|
|
package-manager-cache: false
|
|
- name: Enable pnpm via corepack
|
|
run: corepack enable pnpm
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Detect signing capability
|
|
id: signing
|
|
env:
|
|
CSC_LINK: ${{ secrets.CSC_LINK }}
|
|
APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
|
|
APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
|
|
APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
|
|
run: |
|
|
if [ -z "$APPLE_API_ISSUER" ] || [ -z "$APPLE_API_KEY_ID" ] || [ -z "$APPLE_API_KEY_P8" ]; then
|
|
echo "signed=false" >> "$GITHUB_OUTPUT"
|
|
echo "::warning::No notarization secrets: building ad-hoc-signed, un-notarized macOS installers."
|
|
elif [ -n "$CSC_LINK" ] || security find-identity -v -p codesigning | grep -q "Developer ID Application: Yang Zhang (9PDD8M2SMS)"; then
|
|
echo "signed=true" >> "$GITHUB_OUTPUT"
|
|
echo "Developer ID certificate and notarization credentials found: building signed + notarized installers."
|
|
else
|
|
security find-identity -v -p codesigning
|
|
echo "::error::Notarization secrets are set but this runner cannot reach the Developer ID identity; run the runner in the login session or set CSC_LINK."
|
|
exit 1
|
|
fi
|
|
- name: Build installers (signed + notarized)
|
|
if: steps.signing.outputs.signed == 'true'
|
|
env:
|
|
CSC_LINK: ${{ secrets.CSC_LINK }}
|
|
CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
|
|
APPLE_API_KEY: ${{ runner.temp }}/apple-api-key.p8
|
|
APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
|
|
APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
|
|
APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
|
|
run: |
|
|
printf '%s' "$APPLE_API_KEY_P8" > "$APPLE_API_KEY"
|
|
trap 'rm -f "$APPLE_API_KEY"' EXIT
|
|
pnpm build
|
|
pnpm exec electron-builder --mac --x64 --arm64 --publish never -c.forceCodeSigning=true
|
|
- name: Build installers (ad-hoc fallback)
|
|
if: steps.signing.outputs.signed != 'true'
|
|
run: |
|
|
pnpm build
|
|
pnpm exec electron-builder --mac --x64 --arm64 --publish never --config electron-builder.unsigned.yml
|
|
- name: Upload installers
|
|
run: node scripts/gitea-release.mjs upload release
|