517 lines
19 KiB
YAML
517 lines
19 KiB
YAML
name: Cross-platform packages
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches:
|
|
- main
|
|
tags:
|
|
- 'v*'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: packages-${{ github.ref }}
|
|
cancel-in-progress: ${{ github.ref_type != 'tag' }}
|
|
|
|
jobs:
|
|
validate:
|
|
name: Validate source
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 30
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- uses: actions/setup-node@v7
|
|
with:
|
|
node-version: 24.19.0
|
|
cache: npm
|
|
|
|
- name: Verify release tag version
|
|
if: github.ref_type == 'tag'
|
|
run: node -e "const p=require('./package.json'); const expected='v'+p.version; if(process.env.GITHUB_REF_NAME!==expected){throw new Error('Expected tag '+expected+', received '+process.env.GITHUB_REF_NAME)}"
|
|
|
|
- name: Verify bilingual release notes
|
|
if: github.ref_type == 'tag'
|
|
run: npm run release:notes:verify
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Prepare sandboxed Electron tests
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install --no-install-recommends --yes xvfb xauth
|
|
sandbox="node_modules/electron/dist/chrome-sandbox"
|
|
if [[ ! -f "$sandbox" ]]; then
|
|
rm -rf node_modules/electron/dist
|
|
force_no_cache=true node node_modules/electron/install.js
|
|
fi
|
|
test -f "$sandbox"
|
|
sudo chown root:root "$sandbox"
|
|
sudo chmod 4755 "$sandbox"
|
|
|
|
- name: Run validators
|
|
run: |
|
|
xvfb-run --auto-servernum npm test
|
|
npm run typecheck
|
|
npm run lint
|
|
|
|
- name: Build production bundle
|
|
run: npm run build:bundle
|
|
|
|
- name: Upload production bundle
|
|
if: >-
|
|
github.ref_type == 'tag' ||
|
|
(github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: goodbuddy-production-bundle
|
|
path: out
|
|
if-no-files-found: error
|
|
retention-days: 1
|
|
|
|
authorize-release:
|
|
name: Authorize desktop packaging
|
|
if: >-
|
|
github.ref_type == 'tag' ||
|
|
(github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
|
|
needs: validate
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 5
|
|
outputs:
|
|
authorized: ${{ steps.policy.outputs.authorized }}
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Verify immutable release ref policy
|
|
id: policy
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
git fetch --no-tags origin \
|
|
"+refs/heads/main:refs/remotes/origin/main"
|
|
git merge-base --is-ancestor \
|
|
"$GITHUB_SHA" refs/remotes/origin/main
|
|
|
|
case "$GITHUB_EVENT_NAME" in
|
|
push)
|
|
test "$GITHUB_REF_TYPE" = "tag"
|
|
test "$(node -p "String(require(process.env.GITHUB_EVENT_PATH).created)")" = "true"
|
|
test "$(node -p "String(require(process.env.GITHUB_EVENT_PATH).forced)")" = "false"
|
|
test "$(node -p "String(require(process.env.GITHUB_EVENT_PATH).deleted)")" = "false"
|
|
expected="v$(node -p "require('./package.json').version")"
|
|
test "$GITHUB_REF" = "refs/tags/$expected"
|
|
test "$GITHUB_REF_NAME" = "$expected"
|
|
git fetch --no-tags origin \
|
|
"+refs/tags/${GITHUB_REF_NAME}:refs/tags/${GITHUB_REF_NAME}"
|
|
test "$(git cat-file -t "refs/tags/$GITHUB_REF_NAME")" = "tag"
|
|
test "$(git rev-parse "refs/tags/$GITHUB_REF_NAME^{commit}")" = "$GITHUB_SHA"
|
|
;;
|
|
workflow_dispatch)
|
|
test "$GITHUB_REF" = "refs/heads/main"
|
|
test "$GITHUB_REF_TYPE" = "branch"
|
|
test "$GITHUB_SHA" = "$(git rev-parse refs/remotes/origin/main)"
|
|
;;
|
|
*)
|
|
echo "Desktop packaging is limited to immutable version-tag pushes or a manual run of refs/heads/main." >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
echo "authorized=true" >> "$GITHUB_OUTPUT"
|
|
|
|
package:
|
|
name: ${{ matrix.platform }} ${{ matrix.arch }}
|
|
if: >-
|
|
needs.authorize-release.result == 'success' &&
|
|
needs.authorize-release.outputs.authorized == 'true'
|
|
needs:
|
|
- validate
|
|
- authorize-release
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- platform: windows
|
|
arch: x64
|
|
runner: windows-2025
|
|
- platform: windows
|
|
arch: arm64
|
|
runner: windows-11-vs2026-arm
|
|
- platform: macos
|
|
arch: x64
|
|
runner: macos-15-intel
|
|
- platform: macos
|
|
arch: arm64
|
|
runner: macos-15
|
|
- platform: linux
|
|
arch: x64
|
|
runner: ubuntu-24.04
|
|
- platform: linux
|
|
arch: arm64
|
|
runner: ubuntu-24.04-arm
|
|
runs-on: ${{ matrix.runner }}
|
|
timeout-minutes: 75
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- uses: actions/setup-node@v7
|
|
with:
|
|
node-version: 24.19.0
|
|
cache: npm
|
|
|
|
- name: Cache packaging toolsets
|
|
uses: actions/cache@v6
|
|
with:
|
|
path: |
|
|
${{ runner.temp }}/electron
|
|
${{ runner.temp }}/electron-builder
|
|
key: packaging-${{ runner.os }}-${{ matrix.arch }}-${{ hashFiles('package-lock.json') }}
|
|
restore-keys: packaging-${{ runner.os }}-${{ matrix.arch }}-
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
env:
|
|
ELECTRON_CACHE: ${{ runner.temp }}/electron
|
|
|
|
- name: Download production bundle
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
name: goodbuddy-production-bundle
|
|
path: out
|
|
|
|
- name: Verify native runner architecture
|
|
run: node -e "if(process.arch !== '${{ matrix.arch }}'){throw new Error('Expected ${{ matrix.arch }} runner, received '+process.arch)}"
|
|
|
|
- name: Install and validate managed Python
|
|
run: npm exec vitest run tests/local-tool-environment-live.test.ts
|
|
env:
|
|
GOODBUDDY_RUN_LIVE_TOOL_ENVIRONMENT: '1'
|
|
|
|
- name: Install RPM packaging tools
|
|
if: matrix.platform == 'linux'
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
sudo apt-get update
|
|
sudo apt-get install --no-install-recommends --yes rpm
|
|
rpmbuild --version
|
|
|
|
- name: Resolve macOS signing mode
|
|
id: macos-signing
|
|
if: matrix.platform == 'macos'
|
|
shell: bash
|
|
env:
|
|
MACOS_CERTIFICATE_BASE64: ${{ secrets.MACOS_CERTIFICATE_BASE64 }}
|
|
MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
|
|
APPLE_API_KEY_BASE64: ${{ secrets.APPLE_API_KEY_BASE64 }}
|
|
APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
|
|
APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
|
|
run: |
|
|
set -euo pipefail
|
|
names=(
|
|
MACOS_CERTIFICATE_BASE64
|
|
MACOS_CERTIFICATE_PASSWORD
|
|
APPLE_API_KEY_BASE64
|
|
APPLE_API_KEY_ID
|
|
APPLE_API_ISSUER
|
|
)
|
|
configured=0
|
|
missing=()
|
|
for name in "${names[@]}"; do
|
|
if [[ -n "${!name}" ]]; then
|
|
configured=$((configured + 1))
|
|
else
|
|
missing+=("$name")
|
|
fi
|
|
done
|
|
if [[ "$configured" -eq 0 ]]; then
|
|
echo "enabled=false" >> "$GITHUB_OUTPUT"
|
|
echo "::warning title=Unsigned macOS packages::Apple signing credentials are not configured. The macOS DMG and ZIP will be unsigned and unnotarized."
|
|
{
|
|
echo "### macOS signing"
|
|
echo
|
|
echo "Apple signing credentials are not configured. This target produces unsigned and unnotarized packages that Gatekeeper may block on first launch."
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
exit 0
|
|
fi
|
|
if [[ "$configured" -ne "${#names[@]}" ]]; then
|
|
missing_names="$(IFS=,; echo "${missing[*]}")"
|
|
echo "::error title=Incomplete macOS signing credentials::Missing: $missing_names"
|
|
exit 1
|
|
fi
|
|
echo "enabled=true" >> "$GITHUB_OUTPUT"
|
|
printf '%s' "$MACOS_CERTIFICATE_BASE64" | base64 -D > "$RUNNER_TEMP/goodbuddy-developer-id.p12"
|
|
printf '%s' "$APPLE_API_KEY_BASE64" | base64 -D > "$RUNNER_TEMP/AuthKey.p8"
|
|
test -s "$RUNNER_TEMP/goodbuddy-developer-id.p12"
|
|
test -s "$RUNNER_TEMP/AuthKey.p8"
|
|
chmod 600 "$RUNNER_TEMP/goodbuddy-developer-id.p12" "$RUNNER_TEMP/AuthKey.p8"
|
|
{
|
|
echo "### macOS signing"
|
|
echo
|
|
echo "Complete Apple signing credentials were detected. This target will be signed, notarized, and verified."
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
- name: Build, sign and notarize macOS release packages
|
|
if: matrix.platform == 'macos' && steps.macos-signing.outputs.enabled == 'true'
|
|
run: npm run release:package -- --platform ${{ matrix.platform }} --arch ${{ matrix.arch }} --format dmg --skip-build
|
|
env:
|
|
ELECTRON_CACHE: ${{ runner.temp }}/electron
|
|
ELECTRON_BUILDER_CACHE: ${{ runner.temp }}/electron-builder
|
|
CSC_LINK: ${{ runner.temp }}/goodbuddy-developer-id.p12
|
|
CSC_KEY_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
|
|
CSC_IDENTITY_AUTO_DISCOVERY: 'true'
|
|
APPLE_API_KEY: ${{ runner.temp }}/AuthKey.p8
|
|
APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
|
|
APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
|
|
|
|
- name: Build unsigned macOS release packages
|
|
if: matrix.platform == 'macos' && steps.macos-signing.outputs.enabled == 'false'
|
|
run: npm run release:package -- --platform ${{ matrix.platform }} --arch ${{ matrix.arch }} --format dmg --skip-build --unsigned
|
|
env:
|
|
ELECTRON_CACHE: ${{ runner.temp }}/electron
|
|
ELECTRON_BUILDER_CACHE: ${{ runner.temp }}/electron-builder
|
|
CSC_IDENTITY_AUTO_DISCOVERY: 'false'
|
|
|
|
- name: Verify macOS signature and notarization ticket
|
|
if: matrix.platform == 'macos' && steps.macos-signing.outputs.enabled == 'true'
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
dmg="$(find "dist/release/macos-${{ matrix.arch }}" -maxdepth 1 -type f -name '*.dmg' -print -quit)"
|
|
test -n "$dmg"
|
|
mount_point="$RUNNER_TEMP/goodbuddy-dmg"
|
|
mkdir "$mount_point"
|
|
cleanup() {
|
|
hdiutil detach "$mount_point" -quiet || true
|
|
}
|
|
trap cleanup EXIT
|
|
hdiutil attach "$dmg" -nobrowse -readonly -mountpoint "$mount_point" -quiet
|
|
app="$(find "$mount_point" -maxdepth 1 -type d -name '*.app' -print -quit)"
|
|
test -n "$app"
|
|
codesign --verify --deep --strict --verbose=2 "$app"
|
|
spctl --assess --type execute --verbose=4 "$app"
|
|
xcrun stapler validate "$app"
|
|
|
|
- name: Build and verify non-macOS release packages
|
|
if: matrix.platform != 'macos'
|
|
run: npm run release:package -- --platform ${{ matrix.platform }} --arch ${{ matrix.arch }} --skip-build
|
|
env:
|
|
ELECTRON_CACHE: ${{ runner.temp }}/electron
|
|
ELECTRON_BUILDER_CACHE: ${{ runner.temp }}/electron-builder
|
|
|
|
- name: Upload release packages
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: goodbuddy-${{ matrix.platform }}-${{ matrix.arch }}
|
|
path: dist/release/${{ matrix.platform }}-${{ matrix.arch }}
|
|
if-no-files-found: error
|
|
compression-level: 0
|
|
retention-days: 30
|
|
|
|
release:
|
|
name: Publish GitHub and OSS release
|
|
if: >-
|
|
github.event_name == 'push' &&
|
|
github.ref_type == 'tag' &&
|
|
needs.authorize-release.outputs.authorized == 'true'
|
|
needs:
|
|
- authorize-release
|
|
- package
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 35
|
|
environment:
|
|
name: aliyun-oss-release
|
|
permissions:
|
|
contents: write
|
|
actions: read
|
|
id-token: write
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- uses: actions/setup-node@v7
|
|
with:
|
|
node-version: 24.19.0
|
|
|
|
- name: Verify release tag
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
expected="v$(node -p "require('./package.json').version")"
|
|
test "$GITHUB_REF_NAME" = "$expected"
|
|
test "$(git rev-parse "refs/tags/$GITHUB_REF_NAME^{commit}")" = "$GITHUB_SHA"
|
|
|
|
- name: Prepare bilingual release notes
|
|
run: node build/release-notes.cjs --output release-notes.md
|
|
|
|
- name: Download Windows packages
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
pattern: goodbuddy-windows-*
|
|
path: dist/release-downloads
|
|
|
|
- name: Download macOS packages
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
pattern: goodbuddy-macos-*
|
|
path: dist/release-downloads
|
|
|
|
- name: Download Linux packages
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
pattern: goodbuddy-linux-*
|
|
path: dist/release-downloads
|
|
|
|
- name: Verify and aggregate release assets
|
|
run: node build/aggregate-release.cjs --input dist/release-downloads --output dist/release-upload
|
|
|
|
- name: Verify OSS release configuration
|
|
shell: bash
|
|
env:
|
|
OSS_BUCKET: ${{ vars.ALIYUN_OSS_BUCKET }}
|
|
OSS_ENDPOINT: ${{ vars.ALIYUN_OSS_ENDPOINT }}
|
|
OIDC_PROVIDER_ARN: ${{ vars.ALIYUN_OIDC_PROVIDER_ARN }}
|
|
ROLE_ARN: ${{ vars.ALIYUN_ROLE_ARN }}
|
|
run: |
|
|
set -euo pipefail
|
|
test -n "$OSS_BUCKET"
|
|
test -n "$OSS_ENDPOINT"
|
|
test -n "$OIDC_PROVIDER_ARN"
|
|
test -n "$ROLE_ARN"
|
|
case "$OSS_BUCKET" in
|
|
goodbuddy) ;;
|
|
*) echo "OSS Bucket 必须与应用内置镜像地址一致" >&2; exit 1 ;;
|
|
esac
|
|
case "$OSS_ENDPOINT" in
|
|
https://oss-cn-beijing.aliyuncs.com) ;;
|
|
*) echo "OSS Endpoint 必须与应用内置镜像地址一致" >&2; exit 1 ;;
|
|
esac
|
|
case "$OIDC_PROVIDER_ARN" in
|
|
acs:ram::*:oidc-provider/*) ;;
|
|
*) echo "OIDC Provider ARN 无效" >&2; exit 1 ;;
|
|
esac
|
|
case "$ROLE_ARN" in
|
|
acs:ram::*:role/*) ;;
|
|
*) echo "RAM Role ARN 无效" >&2; exit 1 ;;
|
|
esac
|
|
|
|
- name: Authenticate to Alibaba Cloud
|
|
uses: aliyun/configure-aliyun-credentials-action@v1
|
|
with:
|
|
role-to-assume: ${{ vars.ALIYUN_ROLE_ARN }}
|
|
oidc-provider-arn: ${{ vars.ALIYUN_OIDC_PROVIDER_ARN }}
|
|
role-session-name: goodbuddy-release-${{ github.run_id }}
|
|
role-session-expiration: 3600
|
|
audience: sts.aliyuncs.com
|
|
|
|
- name: Install ossutil
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
version="2.3.0"
|
|
archive="$RUNNER_TEMP/ossutil.zip"
|
|
directory="$RUNNER_TEMP/ossutil"
|
|
curl --fail --silent --show-error --location \
|
|
"https://gosspublic.alicdn.com/ossutil/v2/$version/ossutil-$version-linux-amd64.zip" \
|
|
--output "$archive"
|
|
mkdir "$directory"
|
|
unzip -q "$archive" -d "$directory"
|
|
binary="$(find "$directory" -type f -name ossutil -print -quit)"
|
|
test -n "$binary"
|
|
chmod +x "$binary"
|
|
echo "$(dirname "$binary")" >> "$GITHUB_PATH"
|
|
|
|
- name: Prepare OSS website release index
|
|
id: oss-release
|
|
shell: bash
|
|
env:
|
|
OSS_BUCKET: ${{ vars.ALIYUN_OSS_BUCKET }}
|
|
OSS_ENDPOINT: ${{ vars.ALIYUN_OSS_ENDPOINT }}
|
|
run: |
|
|
set -euo pipefail
|
|
endpoint_host="${OSS_ENDPOINT#https://}"
|
|
oss_region="${endpoint_host#oss-}"
|
|
oss_region="${oss_region%.aliyuncs.com}"
|
|
case "$oss_region" in
|
|
*[!a-z0-9-]*|'') echo "无法从 OSS Endpoint 推导 Region" >&2; exit 1 ;;
|
|
esac
|
|
base_url="https://${OSS_BUCKET}.${endpoint_host}/releases/${GITHUB_REF_NAME}/"
|
|
node build/create-site-release.cjs \
|
|
--manifest dist/release-upload/release-manifest.json \
|
|
--base-url "$base_url" \
|
|
--output dist/site-release.json
|
|
echo "base-url=$base_url" >> "$GITHUB_OUTPUT"
|
|
echo "region=$oss_region" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Upload immutable release assets to OSS
|
|
shell: bash
|
|
env:
|
|
OSS_BUCKET: ${{ vars.ALIYUN_OSS_BUCKET }}
|
|
OSS_ENDPOINT: ${{ vars.ALIYUN_OSS_ENDPOINT }}
|
|
OSS_UPLOAD_ENDPOINT: https://oss-accelerate.aliyuncs.com
|
|
OSS_REGION: ${{ steps.oss-release.outputs.region }}
|
|
run: |
|
|
set -euo pipefail
|
|
export OSS_ACCESS_KEY_ID="$ALIBABA_CLOUD_ACCESS_KEY_ID"
|
|
export OSS_ACCESS_KEY_SECRET="$ALIBABA_CLOUD_ACCESS_KEY_SECRET"
|
|
export OSS_SESSION_TOKEN="$ALIBABA_CLOUD_SECURITY_TOKEN"
|
|
test -n "$OSS_ACCESS_KEY_ID"
|
|
test -n "$OSS_ACCESS_KEY_SECRET"
|
|
test -n "$OSS_SESSION_TOKEN"
|
|
test -n "$OSS_REGION"
|
|
for file in dist/release-upload/* dist/site-release.json; do
|
|
name="$(basename "$file")"
|
|
ossutil cp "$file" \
|
|
"oss://${OSS_BUCKET}/releases/${GITHUB_REF_NAME}/${name}" \
|
|
--endpoint "$OSS_UPLOAD_ENDPOINT" \
|
|
--region "$OSS_REGION" \
|
|
--update
|
|
done
|
|
|
|
- name: Verify public OSS release assets
|
|
run: node build/verify-site-release.cjs --manifest dist/site-release.json
|
|
|
|
- name: Create or update draft GitHub release
|
|
shell: bash
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
set -euo pipefail
|
|
tag="$GITHUB_REF_NAME"
|
|
version="$(node -p "require('./package.json').version")"
|
|
if gh release view "$tag" >/dev/null 2>&1; then
|
|
gh release edit "$tag" --draft --title "GoodBuddy $version" --notes-file release-notes.md
|
|
else
|
|
gh release create "$tag" --draft --verify-tag --title "GoodBuddy $version" --notes-file release-notes.md
|
|
fi
|
|
gh release upload "$tag" dist/release-upload/* --clobber
|
|
gh release edit "$tag" --draft=false --latest
|
|
|
|
- name: Point website to verified OSS release
|
|
shell: bash
|
|
env:
|
|
OSS_BUCKET: ${{ vars.ALIYUN_OSS_BUCKET }}
|
|
OSS_ENDPOINT: ${{ vars.ALIYUN_OSS_ENDPOINT }}
|
|
OSS_REGION: ${{ steps.oss-release.outputs.region }}
|
|
run: |
|
|
set -euo pipefail
|
|
export OSS_ACCESS_KEY_ID="$ALIBABA_CLOUD_ACCESS_KEY_ID"
|
|
export OSS_ACCESS_KEY_SECRET="$ALIBABA_CLOUD_ACCESS_KEY_SECRET"
|
|
export OSS_SESSION_TOKEN="$ALIBABA_CLOUD_SECURITY_TOKEN"
|
|
test -n "$OSS_REGION"
|
|
ossutil cp dist/site-release.json \
|
|
"oss://${OSS_BUCKET}/releases/latest.json" \
|
|
--endpoint "$OSS_ENDPOINT" \
|
|
--region "$OSS_REGION" \
|
|
--force
|