wehub-resource-sync
404 lines
13 KiB
YAML
404 lines
13 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- release
|
|
workflow_dispatch:
|
|
inputs:
|
|
dry_run:
|
|
description: "Run all build jobs but skip publish (no tag, no GitHub Release)"
|
|
type: boolean
|
|
default: true
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
concurrency:
|
|
group: release
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
prepare:
|
|
name: Prepare Release
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
version: ${{ steps.version.outputs.version }}
|
|
tag: ${{ steps.version.outputs.tag }}
|
|
tag_exists: ${{ steps.check.outputs.exists }}
|
|
is_dry_run: ${{ steps.mode.outputs.is_dry_run }}
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Read version from package.json
|
|
id: version
|
|
run: |
|
|
VERSION=$(node -p "require('./package.json').version")
|
|
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
|
|
echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"
|
|
echo "Release version: v$VERSION"
|
|
|
|
- name: Check if tag already exists
|
|
id: check
|
|
run: |
|
|
if git ls-remote --tags origin "refs/tags/v${{ steps.version.outputs.version }}" | grep -q .; then
|
|
echo "exists=true" >> "$GITHUB_OUTPUT"
|
|
echo "Tag v${{ steps.version.outputs.version }} already exists — skipping."
|
|
else
|
|
echo "exists=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Compute dry-run flag
|
|
id: mode
|
|
run: |
|
|
if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ inputs.dry_run }}" = "true" ]; then
|
|
echo "is_dry_run=true" >> "$GITHUB_OUTPUT"
|
|
echo "Dry run: builds will run, publish will be skipped."
|
|
else
|
|
echo "is_dry_run=false" >> "$GITHUB_OUTPUT"
|
|
echo "Real release: publish will run if tag does not exist."
|
|
fi
|
|
|
|
release_mac:
|
|
name: Build macOS (${{ matrix.arch }})
|
|
needs: prepare
|
|
if: needs.prepare.outputs.tag_exists == 'false'
|
|
runs-on: macos-latest
|
|
strategy:
|
|
matrix:
|
|
arch: [x64, arm64]
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Rebuild native dependencies for target arch
|
|
run: npx electron-builder install-app-deps --arch=${{ matrix.arch }}
|
|
|
|
- name: Build app
|
|
env:
|
|
VITE_ANALYTICS_BASE_URL: ${{ vars.VITE_ANALYTICS_BASE_URL }}
|
|
VITE_ANALYTICS_API_KEY: ${{ secrets.VITE_ANALYTICS_API_KEY }}
|
|
MAIN_VITE_HERMES_API_URL: ${{ vars.HERMES_API_URL }}
|
|
MAIN_VITE_HERMES_API_KEY: ${{ secrets.HERMES_API_KEY }}
|
|
run: npm run build
|
|
|
|
- name: Stage App Store Connect API key
|
|
env:
|
|
ASC_API_KEY_BASE64: ${{ secrets.ASC_API_KEY }}
|
|
ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${ASC_API_KEY_BASE64:-}" ]; then
|
|
echo "ASC_API_KEY secret is missing — notarization will fail." >&2
|
|
exit 1
|
|
fi
|
|
KEY_DIR="$RUNNER_TEMP/appstore"
|
|
mkdir -p "$KEY_DIR"
|
|
KEY_PATH="$KEY_DIR/AuthKey_${ASC_KEY_ID}.p8"
|
|
printf '%s' "$ASC_API_KEY_BASE64" | base64 --decode > "$KEY_PATH"
|
|
chmod 600 "$KEY_PATH"
|
|
echo "APPLE_API_KEY=$KEY_PATH" >> "$GITHUB_ENV"
|
|
|
|
- name: Package macOS artifacts
|
|
env:
|
|
CSC_LINK: ${{ secrets.CSC_LINK }}
|
|
CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
|
|
APPLE_API_KEY_ID: ${{ secrets.ASC_KEY_ID }}
|
|
APPLE_API_ISSUER: ${{ secrets.ASC_ISSUER_ID }}
|
|
run: npx electron-builder --mac dmg zip --${{ matrix.arch }} --publish never
|
|
|
|
- name: Verify native module architecture
|
|
run: |
|
|
set -euo pipefail
|
|
NODE_FILE="dist/mac-${{ matrix.arch }}/Hermes One.app/Contents/Resources/app.asar.unpacked/node_modules/better-sqlite3/build/Release/better_sqlite3.node"
|
|
if [ ! -f "$NODE_FILE" ]; then
|
|
NODE_FILE="dist/mac/Hermes One.app/Contents/Resources/app.asar.unpacked/node_modules/better-sqlite3/build/Release/better_sqlite3.node"
|
|
fi
|
|
file "$NODE_FILE"
|
|
case "${{ matrix.arch }}" in
|
|
x64) file "$NODE_FILE" | grep -q "x86_64" ;;
|
|
arm64) file "$NODE_FILE" | grep -q "arm64" ;;
|
|
esac
|
|
|
|
- name: Upload artifacts
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: mac-${{ matrix.arch }}-artifacts
|
|
path: |
|
|
dist/*.dmg
|
|
dist/*.zip
|
|
dist/*.blockmap
|
|
|
|
release_linux:
|
|
name: Build Linux (${{ matrix.arch }})
|
|
needs: prepare
|
|
if: needs.prepare.outputs.tag_exists == 'false'
|
|
runs-on: ${{ matrix.runs-on }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- arch: x64
|
|
runs-on: ubuntu-latest
|
|
targets: AppImage deb rpm
|
|
- arch: arm64
|
|
runs-on: ubuntu-24.04-arm
|
|
targets: AppImage
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Rebuild native dependencies for target arch
|
|
run: npx electron-builder install-app-deps --arch=${{ matrix.arch }}
|
|
|
|
- name: Build app
|
|
env:
|
|
VITE_ANALYTICS_BASE_URL: ${{ vars.VITE_ANALYTICS_BASE_URL }}
|
|
VITE_ANALYTICS_API_KEY: ${{ secrets.VITE_ANALYTICS_API_KEY }}
|
|
MAIN_VITE_HERMES_API_URL: ${{ vars.HERMES_API_URL }}
|
|
MAIN_VITE_HERMES_API_KEY: ${{ secrets.HERMES_API_KEY }}
|
|
run: npm run build
|
|
|
|
- name: Install rpmbuild
|
|
if: contains(matrix.targets, 'rpm')
|
|
run: sudo apt-get update && sudo apt-get install -y rpm
|
|
|
|
- name: Package Linux artifacts
|
|
run: npx electron-builder --linux ${{ matrix.targets }} --${{ matrix.arch }} --publish never
|
|
|
|
- name: Upload x64 artifacts
|
|
if: matrix.arch == 'x64'
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: linux-x64-artifacts
|
|
path: |
|
|
dist/*.AppImage
|
|
dist/*.deb
|
|
dist/*.rpm
|
|
dist/latest-linux.yml
|
|
|
|
- name: Upload arm64 artifacts
|
|
if: matrix.arch == 'arm64'
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: linux-arm64-artifacts
|
|
path: |
|
|
dist/*.AppImage
|
|
|
|
release_windows:
|
|
name: Build Windows
|
|
needs: prepare
|
|
if: needs.prepare.outputs.tag_exists == 'false'
|
|
runs-on: windows-latest
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Build app
|
|
env:
|
|
VITE_ANALYTICS_BASE_URL: ${{ vars.VITE_ANALYTICS_BASE_URL }}
|
|
VITE_ANALYTICS_API_KEY: ${{ secrets.VITE_ANALYTICS_API_KEY }}
|
|
MAIN_VITE_HERMES_API_URL: ${{ vars.HERMES_API_URL }}
|
|
MAIN_VITE_HERMES_API_KEY: ${{ secrets.HERMES_API_KEY }}
|
|
run: npm run build
|
|
|
|
- name: Package Windows artifacts
|
|
run: npx electron-builder --win nsis portable --x64 --publish never
|
|
|
|
- name: Upload artifacts
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: windows-artifacts
|
|
path: |
|
|
dist/*.exe
|
|
dist/*.exe.blockmap
|
|
dist/latest.yml
|
|
|
|
generate_winget:
|
|
name: Generate winget manifests
|
|
needs: [prepare, release_windows]
|
|
if: needs.prepare.outputs.tag_exists == 'false'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
|
|
- name: Download Windows installer artifact
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: windows-artifacts
|
|
path: dist/
|
|
|
|
- name: Generate winget manifests
|
|
env:
|
|
VERSION: ${{ needs.prepare.outputs.version }}
|
|
PUBLISH_OWNER: fathah
|
|
run: node scripts/generate-winget-manifests.mjs
|
|
|
|
- name: Upload winget manifests artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: winget-manifests-${{ needs.prepare.outputs.version }}
|
|
path: dist/winget/
|
|
|
|
publish:
|
|
name: Publish Release
|
|
needs:
|
|
[prepare, release_mac, release_linux, release_windows, generate_winget]
|
|
if: needs.prepare.outputs.is_dry_run == 'false' && needs.prepare.outputs.tag_exists == 'false'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Create tag
|
|
run: |
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "github-actions[bot]@users.noreply.github.com"
|
|
git tag ${{ needs.prepare.outputs.tag }}
|
|
git push origin ${{ needs.prepare.outputs.tag }}
|
|
|
|
- name: Download all artifacts
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
path: artifacts
|
|
merge-multiple: true
|
|
|
|
- name: Generate macOS update metadata
|
|
env:
|
|
VERSION: ${{ needs.prepare.outputs.version }}
|
|
run: |
|
|
node <<'NODE'
|
|
const crypto = require("crypto");
|
|
const fs = require("fs");
|
|
const path = require("path");
|
|
|
|
const artifactsDir = path.join(process.cwd(), "artifacts");
|
|
const version = process.env.VERSION;
|
|
const zipNames = fs
|
|
.readdirSync(artifactsDir)
|
|
.filter(
|
|
(name) =>
|
|
name.startsWith(`hermes-desktop-${version}-`) &&
|
|
name.endsWith("-mac.zip"),
|
|
)
|
|
.sort((a, b) => {
|
|
if (a.includes("-x64-")) return -1;
|
|
if (b.includes("-x64-")) return 1;
|
|
return a.localeCompare(b);
|
|
});
|
|
|
|
if (
|
|
zipNames.length < 2 ||
|
|
!zipNames.some((name) => name.includes("-x64-")) ||
|
|
!zipNames.some((name) => name.includes("-arm64-"))
|
|
) {
|
|
throw new Error(
|
|
`Expected x64 and arm64 macOS zips, found: ${zipNames.join(", ")}`,
|
|
);
|
|
}
|
|
|
|
const files = zipNames.map((name) => {
|
|
const filePath = path.join(artifactsDir, name);
|
|
return {
|
|
url: name,
|
|
sha512: crypto
|
|
.createHash("sha512")
|
|
.update(fs.readFileSync(filePath))
|
|
.digest("base64"),
|
|
size: fs.statSync(filePath).size,
|
|
};
|
|
});
|
|
const primary = files.find((file) => file.url.includes("-x64-")) || files[0];
|
|
const releaseDate = new Date().toISOString();
|
|
const lines = [
|
|
`version: ${version}`,
|
|
"files:",
|
|
...files.flatMap((file) => [
|
|
` - url: ${file.url}`,
|
|
` sha512: ${file.sha512}`,
|
|
` size: ${file.size}`,
|
|
]),
|
|
`path: ${primary.url}`,
|
|
`sha512: ${primary.sha512}`,
|
|
`releaseDate: '${releaseDate}'`,
|
|
"",
|
|
];
|
|
|
|
fs.writeFileSync(path.join(artifactsDir, "latest-mac.yml"), lines.join("\n"));
|
|
NODE
|
|
|
|
- name: Publish GitHub release
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
tag_name: ${{ needs.prepare.outputs.tag }}
|
|
name: Hermes Desktop ${{ needs.prepare.outputs.tag }}
|
|
generate_release_notes: true
|
|
files: |
|
|
artifacts/*.dmg
|
|
artifacts/*.zip
|
|
artifacts/*.AppImage
|
|
artifacts/*.deb
|
|
artifacts/*.rpm
|
|
artifacts/*.exe
|
|
artifacts/*.blockmap
|
|
artifacts/latest.yml
|
|
artifacts/latest-linux.yml
|
|
artifacts/latest-mac.yml
|
|
|
|
rebuild_landing_page:
|
|
name: Rebuild landing page
|
|
needs: [prepare, publish]
|
|
# Only after a real release that actually published a new tag.
|
|
if: needs.prepare.outputs.is_dry_run == 'false' && needs.prepare.outputs.tag_exists == 'false'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Wait for release to propagate
|
|
# Give GitHub's releases/latest API time to settle before the landing
|
|
# page rebuilds and re-fetches the latest version.
|
|
run: sleep 300
|
|
|
|
- name: Trigger landing page deploy
|
|
# SITE_DEPLOY_TOKEN is a fine-grained PAT with "Actions: read and write"
|
|
# on fathah/hermes-landing-page. The default GITHUB_TOKEN cannot dispatch
|
|
# workflows in another repository.
|
|
env:
|
|
GH_TOKEN: ${{ secrets.SITE_DEPLOY_TOKEN }}
|
|
run: |
|
|
gh workflow run deploy.yml \
|
|
--repo fathah/hermes-landing-page \
|
|
--ref main
|