根因:CI 上没有 Apple Developer 证书,electron-builder 跳过签名, 生成完全未签名的 .app。electron-updater 的 ShipIt 进程在应用更新时 校验 code signature,未签名的 app 被拒绝: "Code signature did not pass validation: 代码未能满足指定的代码要求" 修复: 1. scripts/after-pack.js — 在所有文件修改(better-sqlite3 替换) 完成后,对 macOS .app 执行 ad-hoc 签名(codesign --force --deep -s -)。 Ad-hoc 签名不需要证书,但能通过 ShipIt 的基本校验。 如果将来配置了真实证书,electron-builder 的签名步骤会覆盖 ad-hoc。 2. .github/workflows/build.yml — macOS 构建添加 CSC_IDENTITY_AUTO_DISCOVERY=false,防止 electron-builder 尝试查找不存在的证书时产生不可预期的行为。 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
183 lines
5.4 KiB
YAML
183 lines
5.4 KiB
YAML
name: Build & Package
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
platform:
|
|
description: "Target platform"
|
|
required: true
|
|
default: "all"
|
|
type: choice
|
|
options:
|
|
- all
|
|
- windows
|
|
- macos
|
|
- linux
|
|
push:
|
|
tags:
|
|
- "v*"
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
build-windows:
|
|
if: ${{ github.event_name == 'push' || inputs.platform == 'all' || inputs.platform == 'windows' }}
|
|
runs-on: windows-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
cache: npm
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Build Electron app
|
|
run: npm run electron:build
|
|
|
|
- name: Package for Windows
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: npx electron-builder --win --config electron-builder.yml --publish always
|
|
|
|
build-macos:
|
|
if: ${{ github.event_name == 'push' || inputs.platform == 'all' || inputs.platform == 'macos' }}
|
|
runs-on: macos-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
cache: npm
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Build Electron app
|
|
run: npm run electron:build
|
|
|
|
- name: Package for macOS (x64 + arm64)
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
CSC_IDENTITY_AUTO_DISCOVERY: "false"
|
|
run: npx electron-builder --mac --config electron-builder.yml --publish always
|
|
|
|
build-linux:
|
|
if: ${{ github.event_name == 'push' || inputs.platform == 'all' || inputs.platform == 'linux' }}
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
matrix:
|
|
arch: [x64, arm64]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
cache: npm
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Build Electron app
|
|
run: npm run electron:build
|
|
|
|
- name: Package for Linux (${{ matrix.arch }})
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: npx electron-builder --linux --${{ matrix.arch }} --config electron-builder.yml --publish always
|
|
|
|
release:
|
|
if: ${{ always() && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && !contains(needs.*.result, 'cancelled') }}
|
|
needs: [build-windows, build-macos, build-linux]
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Get version and previous tag
|
|
id: meta
|
|
run: |
|
|
VERSION=${GITHUB_REF_NAME#v}
|
|
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
|
|
PREV_TAG=$(git tag --sort=-creatordate | grep '^v' | sed -n '2p' || echo "")
|
|
echo "prev_tag=$PREV_TAG" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Generate changelog
|
|
id: changelog
|
|
run: |
|
|
PREV_TAG="${{ steps.meta.outputs.prev_tag }}"
|
|
if [ -n "$PREV_TAG" ]; then
|
|
RANGE="${PREV_TAG}..HEAD"
|
|
else
|
|
RANGE="HEAD"
|
|
fi
|
|
{
|
|
echo "changelog<<CHANGELOG_EOF"
|
|
git log "$RANGE" --pretty=format:'| `%h` | %s |'
|
|
echo ""
|
|
echo "CHANGELOG_EOF"
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Update release notes
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
VERSION="${{ steps.meta.outputs.version }}"
|
|
PREV_TAG="${{ steps.meta.outputs.prev_tag }}"
|
|
|
|
cat > release-notes.md << 'NOTES_EOF'
|
|
## Downloads
|
|
|
|
**Windows**
|
|
- **CodePilot Setup ${{ steps.meta.outputs.version }}.exe** — Windows installer (x64 + arm64)
|
|
|
|
**macOS**
|
|
- **CodePilot-${{ steps.meta.outputs.version }}-arm64.dmg** — macOS Apple Silicon (M1/M2/M3/M4)
|
|
- **CodePilot-${{ steps.meta.outputs.version }}-x64.dmg** — macOS Intel
|
|
|
|
**Linux**
|
|
- **AppImage / deb / rpm** — x64 and arm64
|
|
|
|
## Installation
|
|
|
|
**Windows**: Download the exe installer, double-click to install.
|
|
|
|
**macOS**:
|
|
1. Download the DMG for your chip architecture
|
|
2. Open the DMG, drag CodePilot into Applications
|
|
3. If you see a security prompt on first launch, go to **System Settings > Privacy & Security** and click "Open Anyway"
|
|
4. Configure your Anthropic API Key in Settings
|
|
|
|
**Linux**: Run the AppImage directly, or install via deb/rpm package.
|
|
|
|
## Requirements
|
|
|
|
- Windows 10+ / macOS 12.0+ / Linux (glibc 2.31+)
|
|
- Anthropic API Key or `ANTHROPIC_API_KEY` environment variable
|
|
- Claude Code CLI recommended for code features
|
|
|
|
## Changelog
|
|
NOTES_EOF
|
|
|
|
if [ -n "$PREV_TAG" ]; then
|
|
echo "" >> release-notes.md
|
|
echo "| Commit | Description |" >> release-notes.md
|
|
echo "|--------|-------------|" >> release-notes.md
|
|
cat >> release-notes.md << 'CHANGELOG_INLINE_EOF'
|
|
${{ steps.changelog.outputs.changelog }}
|
|
CHANGELOG_INLINE_EOF
|
|
fi
|
|
|
|
# Update the draft release created by electron-builder with full notes
|
|
gh release edit "${GITHUB_REF_NAME}" \
|
|
--title "CodePilot v${VERSION}" \
|
|
--notes-file release-notes.md \
|
|
--latest \
|
|
--draft=false
|