238 lines
9.4 KiB
YAML
238 lines
9.4 KiB
YAML
name: Desktop release
|
|
|
|
on:
|
|
push:
|
|
tags: ["v*"]
|
|
# Manual runs are artifact-only, unsigned, and NEVER create a release.
|
|
# Use this for the first Windows/Linux dress rehearsal without secrets.
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
# Serialize separate runs for the same ref; never cancel an upload in flight.
|
|
concurrency:
|
|
group: release-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
env:
|
|
NEXT_TELEMETRY_DISABLED: "1"
|
|
|
|
jobs:
|
|
quality:
|
|
name: Release gates
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 20
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: actions/setup-node@v7
|
|
with:
|
|
node-version: "26"
|
|
cache: npm
|
|
- run: npm ci
|
|
- name: Tag must match package.json
|
|
if: github.event_name == 'push'
|
|
run: |
|
|
node --input-type=module -e '
|
|
import fs from "node:fs";
|
|
const {version} = JSON.parse(fs.readFileSync("package.json", "utf8"));
|
|
if (process.env.GITHUB_REF_NAME !== `v${version}`) {
|
|
console.error("Release tag must equal v" + version);
|
|
process.exit(1);
|
|
}
|
|
'
|
|
- run: npm run typecheck
|
|
- run: npm test
|
|
- run: npm run lint
|
|
|
|
draft:
|
|
name: Prepare one draft
|
|
needs: quality
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 5
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
# This job succeeds without creating anything on manual rehearsals.
|
|
# Preparing once avoids the publisher's list-miss/create race between OS jobs.
|
|
- name: Create or reuse the tag's draft
|
|
if: github.event_name == 'push'
|
|
uses: actions/github-script@v9
|
|
with:
|
|
script: |
|
|
const {owner, repo} = context.repo;
|
|
const tag = context.ref.replace(/^refs\/tags\//, "");
|
|
const version = tag.slice(1);
|
|
const releases = await github.paginate(github.rest.repos.listReleases, {
|
|
owner, repo, per_page: 100,
|
|
});
|
|
const matches = releases.filter(release =>
|
|
release.tag_name === tag || release.tag_name === version);
|
|
if (matches.length > 1) {
|
|
throw new Error(`Multiple releases match ${tag}; resolve them before uploading.`);
|
|
}
|
|
if (matches.length === 1) {
|
|
if (!matches[0].draft) {
|
|
throw new Error(`${tag} is already published; refusing to modify it.`);
|
|
}
|
|
core.info(`Reusing draft ${matches[0].id} for ${tag}`);
|
|
return;
|
|
}
|
|
const {data} = await github.rest.repos.createRelease({
|
|
owner, repo, tag_name: tag, name: version, draft: true,
|
|
});
|
|
core.info(`Created draft ${data.id} for ${tag}`);
|
|
|
|
package:
|
|
name: Package (${{ matrix.platform }})
|
|
needs: [quality, draft]
|
|
permissions:
|
|
contents: write
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- os: macos-26
|
|
platform: mac-arm64
|
|
builder_args: --mac --arm64
|
|
- os: windows-2025
|
|
platform: windows-x64
|
|
builder_args: --win --x64
|
|
- os: ubuntu-24.04
|
|
platform: linux-x64
|
|
builder_args: --linux --x64
|
|
runs-on: ${{ matrix.os }}
|
|
# Apple's notarization queue has taken ~2 hours for this team.
|
|
timeout-minutes: 180
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: actions/setup-node@v7
|
|
with:
|
|
node-version: "26"
|
|
cache: npm
|
|
# The mac icon is the Icon Composer document (build/icon.icon);
|
|
# compiling it needs both macOS 26+ and actool ≥ 26 (Xcode 26+).
|
|
# Xcode 26's asset compiler crashes on macOS 15's older frameworks.
|
|
# Select the latest stable Xcode; no-op for Windows/Linux.
|
|
- name: Select Xcode 26+ for actool (mac icon compile)
|
|
if: runner.os == 'macOS'
|
|
uses: maxim-lobanov/setup-xcode@v1
|
|
with:
|
|
xcode-version: latest-stable
|
|
- run: npm ci
|
|
- name: Native renderer tests on this OS
|
|
run: npx electron --import tsx --test tests/pdf-native-render.test.ts tests/pdf-ops.test.ts tests/svg-native-render.test.ts tests/browser-service.test.ts
|
|
env:
|
|
NODE_ENV: test
|
|
ELECTRON_RUN_AS_NODE: "1"
|
|
- run: npm run build
|
|
- run: node scripts/build-server.mjs
|
|
- run: node scripts/smoke-server.mjs --electron
|
|
- name: Validate macOS release secrets
|
|
if: github.event_name == 'push' && runner.os == 'macOS'
|
|
env:
|
|
CSC_LINK: ${{ secrets.MAC_CSC_LINK }}
|
|
CSC_KEY_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
|
|
APPLE_ID: ${{ secrets.APPLE_ID }}
|
|
APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
|
|
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
run: |
|
|
for name in CSC_LINK CSC_KEY_PASSWORD APPLE_ID APPLE_APP_SPECIFIC_PASSWORD APPLE_TEAM_ID; do
|
|
if [[ -z "${!name}" ]]; then
|
|
echo "::error::Missing signing/notarization secret: $name"
|
|
exit 1
|
|
fi
|
|
done
|
|
- name: Signed and notarized macOS release → draft
|
|
if: github.event_name == 'push' && runner.os == 'macOS'
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
CSC_LINK: ${{ secrets.MAC_CSC_LINK }}
|
|
CSC_KEY_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
|
|
APPLE_ID: ${{ secrets.APPLE_ID }}
|
|
APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
|
|
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
run: npx electron-builder ${{ matrix.builder_args }} --publish always -c.forceCodeSigning=true
|
|
- name: Windows/Linux release → draft
|
|
if: github.event_name == 'push' && runner.os != 'macOS'
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: npx electron-builder ${{ matrix.builder_args }} --publish always
|
|
- name: Unsigned macOS rehearsal (no publish, no notarization)
|
|
if: github.event_name == 'workflow_dispatch' && runner.os == 'macOS'
|
|
env:
|
|
CSC_IDENTITY_AUTO_DISCOVERY: "false"
|
|
run: npx electron-builder ${{ matrix.builder_args }} --publish never -c.mac.notarize=false
|
|
- name: Windows/Linux rehearsal (no publish)
|
|
if: github.event_name == 'workflow_dispatch' && runner.os != 'macOS'
|
|
run: npx electron-builder ${{ matrix.builder_args }} --publish never
|
|
- name: Save installers and update metadata
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: learnharness-${{ matrix.platform }}
|
|
retention-days: 7
|
|
if-no-files-found: error
|
|
path: |
|
|
dist/*.dmg
|
|
dist/*.zip
|
|
dist/*.exe
|
|
dist/*.AppImage
|
|
dist/*.deb
|
|
dist/*.blockmap
|
|
dist/latest*.yml
|
|
|
|
# The last gate before a human publishes: after ALL three packaging jobs
|
|
# have uploaded, fail the run unless the tag's single draft release holds
|
|
# exactly the 11 verified assets (4 installers + mac updater ZIP + their
|
|
# blockmaps + 3 latest*.yml feeds) and the feeds reference those uploads
|
|
# by exact name at the package.json version. Read-only: it never creates,
|
|
# edits, publishes, or deletes anything. Manual rehearsals upload nothing,
|
|
# so there is no draft to verify and the job stays skipped.
|
|
verify:
|
|
name: Verify draft release
|
|
needs: package
|
|
if: github.event_name == 'push'
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
steps:
|
|
# The tagged revision — verify exactly what was packaged, not a moving default.
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
ref: ${{ github.sha }}
|
|
- uses: actions/setup-node@v7
|
|
with:
|
|
node-version: "26"
|
|
cache: npm
|
|
- run: npm ci
|
|
- name: List every release, drafts included
|
|
# --slurp wraps the paginated pages into one JSON document
|
|
# ([[release,...],[release,...]]); the validator flattens it.
|
|
run: gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/releases?per_page=100" > "$RUNNER_TEMP/releases.json"
|
|
- name: Select the tag's single draft
|
|
# Machine JSON on stdout (release id + asset ids); warnings on stderr.
|
|
run: npx tsx scripts/verify-release.ts select "$RUNNER_TEMP/releases.json" --tag "$GITHUB_REF_NAME" > "$RUNNER_TEMP/draft.json"
|
|
- name: Download the three update feeds
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir -p "$RUNNER_TEMP/metadata"
|
|
for name in latest-mac.yml latest.yml latest-linux.yml; do
|
|
id=$(DRAFT="$RUNNER_TEMP/draft.json" NAME="$name" node -e '
|
|
const fs = require("node:fs");
|
|
const draft = JSON.parse(fs.readFileSync(process.env.DRAFT, "utf8"));
|
|
const asset = draft.assets.find((entry) => entry.name === process.env.NAME);
|
|
if (asset == null) { console.error("draft has no " + process.env.NAME); process.exit(1); }
|
|
console.log(asset.id);
|
|
')
|
|
gh api "repos/$GITHUB_REPOSITORY/releases/assets/$id" -H "Accept: application/octet-stream" > "$RUNNER_TEMP/metadata/$name"
|
|
echo "downloaded $name ($(wc -c < "$RUNNER_TEMP/metadata/$name") bytes)"
|
|
done
|
|
- name: Verify draft assets and update feeds
|
|
run: npx tsx scripts/verify-release.ts verify "$RUNNER_TEMP/releases.json" "$RUNNER_TEMP/metadata" --tag "$GITHUB_REF_NAME"
|