298 lines
11 KiB
YAML
298 lines
11 KiB
YAML
name: Build portable releases
|
|
|
|
run-name: >-
|
|
Portable release ${{ github.event.release.tag_name || (github.ref_type == 'tag' && github.ref_name) || inputs.release_tag || github.ref_name }}
|
|
|
|
on:
|
|
release:
|
|
types:
|
|
- published
|
|
workflow_dispatch:
|
|
inputs:
|
|
release_tag:
|
|
description: Optional tag to create after all builds pass (leave empty to build artifacts only)
|
|
required: false
|
|
type: string
|
|
prerelease:
|
|
description: Mark a manually published release as a pre-release
|
|
required: true
|
|
default: true
|
|
type: boolean
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
validate:
|
|
name: Validate source
|
|
if: github.event_name != 'release' || github.event.release.prerelease == true
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
ref: ${{ github.event_name == 'release' && github.event.release.tag_name || github.ref }}
|
|
- uses: oven-sh/setup-bun@v2
|
|
with:
|
|
bun-version: 1.3.14
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
components: clippy, rustfmt
|
|
- name: Install Linux dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
|
|
- name: Install frontend dependencies
|
|
run: bun install --frozen-lockfile
|
|
- name: Validate desktop icons
|
|
shell: bash
|
|
run: |
|
|
test -s src-tauri/icons/icon.png
|
|
test -s src-tauri/icons/icon.ico
|
|
test -s src-tauri/icons/icon.icns
|
|
- name: Validate frontend
|
|
run: |
|
|
bun run check
|
|
bun test
|
|
- name: Validate Rust
|
|
run: |
|
|
cargo fmt --manifest-path src-tauri/Cargo.toml -- --check
|
|
cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings
|
|
cargo test --manifest-path src-tauri/Cargo.toml
|
|
|
|
build:
|
|
name: Build ${{ matrix.os }}-${{ matrix.arch }}
|
|
needs: validate
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- runner: ubuntu-24.04
|
|
os: linux
|
|
display_os: Linux
|
|
arch: amd64
|
|
suffix: tar.gz
|
|
- runner: ubuntu-24.04-arm
|
|
os: linux
|
|
display_os: Linux
|
|
arch: aarch64
|
|
suffix: tar.gz
|
|
- runner: macos-15-intel
|
|
os: darwin
|
|
display_os: Darwin
|
|
arch: amd64
|
|
suffix: tar.gz
|
|
- runner: macos-15
|
|
os: darwin
|
|
display_os: Darwin
|
|
arch: aarch64
|
|
suffix: tar.gz
|
|
- runner: windows-2025
|
|
os: windows
|
|
display_os: Windows
|
|
arch: amd64
|
|
suffix: zip
|
|
- runner: windows-11-arm
|
|
os: windows
|
|
display_os: Windows
|
|
arch: aarch64
|
|
suffix: zip
|
|
runs-on: ${{ matrix.runner }}
|
|
timeout-minutes: 60
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
ref: ${{ github.event_name == 'release' && github.event.release.tag_name || github.ref }}
|
|
- uses: oven-sh/setup-bun@v2
|
|
with:
|
|
bun-version: 1.3.14
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- name: Resolve release package name
|
|
id: package
|
|
shell: bash
|
|
env:
|
|
REQUESTED_VERSION: ${{ github.event.release.tag_name || (github.ref_type == 'tag' && github.ref_name) || inputs.release_tag }}
|
|
run: |
|
|
source_version="$(node -p 'require("./package.json").version')"
|
|
version="$REQUESTED_VERSION"
|
|
if [ -z "$version" ]; then
|
|
version="v$source_version"
|
|
else
|
|
case "$version" in
|
|
v*) ;;
|
|
*) version="v$version" ;;
|
|
esac
|
|
fi
|
|
|
|
if ! node -e 'process.exit(/^v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:0|[1-9]\d*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.test(process.argv[1]) ? 0 : 1)' "$version"; then
|
|
echo "Invalid release version: $version" >&2
|
|
exit 1
|
|
fi
|
|
|
|
RELEASE_VERSION="${version#v}" node <<'NODE'
|
|
const { readFileSync, writeFileSync } = require('node:fs');
|
|
|
|
const version = process.env.RELEASE_VERSION;
|
|
for (const file of ['package.json', 'src-tauri/tauri.conf.json']) {
|
|
const manifest = JSON.parse(readFileSync(file, 'utf8'));
|
|
manifest.version = version;
|
|
writeFileSync(file, `${JSON.stringify(manifest, null, 2)}\n`);
|
|
}
|
|
|
|
const cargoManifest = 'src-tauri/Cargo.toml';
|
|
const contents = readFileSync(cargoManifest, 'utf8');
|
|
const updated = contents.replace(/^version = "[^"]+"$/m, `version = "${version}"`);
|
|
if (updated === contents) {
|
|
throw new Error(`Could not update version in ${cargoManifest}`);
|
|
}
|
|
writeFileSync(cargoManifest, updated);
|
|
NODE
|
|
|
|
echo "stem=EasyCLIProxyAPI-${version}-${{ matrix.display_os }}-${{ matrix.arch }}" >> "$GITHUB_OUTPUT"
|
|
- name: Install Linux dependencies
|
|
if: matrix.os == 'linux'
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
|
|
- name: Build GUI
|
|
env:
|
|
RUSTFLAGS: -D warnings
|
|
run: |
|
|
bun install --frozen-lockfile
|
|
bun tauri build --no-bundle
|
|
shell: bash
|
|
- name: Sign macOS binary
|
|
if: matrix.os == 'darwin'
|
|
shell: bash
|
|
env:
|
|
APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
|
|
APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
|
|
APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
certificate_path="$RUNNER_TEMP/apple-signing-certificate.p12"
|
|
keychain_path="$RUNNER_TEMP/apple-signing.keychain-db"
|
|
keychain_password="$(uuidgen)"
|
|
binary="src-tauri/target/release/cpa-gui"
|
|
|
|
cleanup() {
|
|
rm -f "$certificate_path"
|
|
security delete-keychain "$keychain_path" || true
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
test -n "$APPLE_CERTIFICATE"
|
|
test -n "$APPLE_CERTIFICATE_PASSWORD"
|
|
test -n "$APPLE_SIGNING_IDENTITY"
|
|
test -f "$binary"
|
|
|
|
printf '%s' "$APPLE_CERTIFICATE" | base64 -D > "$certificate_path"
|
|
security create-keychain -p "$keychain_password" "$keychain_path"
|
|
security set-keychain-settings -lut 21600 "$keychain_path"
|
|
security unlock-keychain -p "$keychain_password" "$keychain_path"
|
|
security import "$certificate_path" -k "$keychain_path" -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
|
|
if ! security find-identity -v -p codesigning "$keychain_path" | grep -F -- "$APPLE_SIGNING_IDENTITY"; then
|
|
echo "Signing identity was not imported into the temporary keychain" >&2
|
|
exit 1
|
|
fi
|
|
|
|
codesign --force --options runtime --timestamp --sign "$APPLE_SIGNING_IDENTITY" --keychain "$keychain_path" "$binary"
|
|
codesign --verify --strict --verbose=2 "$binary"
|
|
- name: Prepare portable directory
|
|
run: >-
|
|
node scripts/prepare-portable.mjs
|
|
--binary "src-tauri/target/release/cpa-gui${{ matrix.os == 'windows' && '.exe' || '' }}"
|
|
--output "release/${{ steps.package.outputs.stem }}"
|
|
--os "${{ matrix.os }}"
|
|
--arch "${{ matrix.arch }}"
|
|
--download true
|
|
shell: bash
|
|
- name: Verify archive-only core payload
|
|
shell: bash
|
|
env:
|
|
CORE_DIR: release/${{ steps.package.outputs.stem }}/cpa-core
|
|
run: |
|
|
node - <<'NODE'
|
|
const { readdirSync } = require('node:fs');
|
|
const entries = readdirSync(process.env.CORE_DIR, { withFileTypes: true });
|
|
const valid = entries.length === 1
|
|
&& entries[0].isFile()
|
|
&& /\.(zip|tar\.gz)$/.test(entries[0].name);
|
|
if (!valid) {
|
|
throw new Error(`cpa-core must contain exactly one archive; found: ${entries.map((entry) => entry.name).join(', ')}`);
|
|
}
|
|
NODE
|
|
- name: Archive Unix release
|
|
if: matrix.os != 'windows'
|
|
run: tar -czf "${{ steps.package.outputs.stem }}.tar.gz" -C release "${{ steps.package.outputs.stem }}"
|
|
- name: Archive Windows release
|
|
if: matrix.os == 'windows'
|
|
shell: pwsh
|
|
run: Compress-Archive -Path "release/${{ steps.package.outputs.stem }}" -DestinationPath "${{ steps.package.outputs.stem }}.zip"
|
|
- uses: actions/upload-artifact@v7
|
|
with:
|
|
name: ${{ steps.package.outputs.stem }}
|
|
path: ${{ steps.package.outputs.stem }}.${{ matrix.suffix }}
|
|
if-no-files-found: error
|
|
retention-days: 14
|
|
|
|
publish:
|
|
name: Publish GitHub release
|
|
if: >-
|
|
(github.event_name == 'release' && github.event.release.prerelease == true)
|
|
|| startsWith(github.ref, 'refs/tags/')
|
|
|| inputs.release_tag != ''
|
|
needs: build
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 15
|
|
steps:
|
|
- uses: actions/download-artifact@v8
|
|
with:
|
|
path: artifacts
|
|
merge-multiple: true
|
|
- name: Publish release
|
|
shell: bash
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
GH_REPO: ${{ github.repository }}
|
|
RELEASE_TAG: ${{ github.event.release.tag_name || (github.ref_type == 'tag' && github.ref_name) || inputs.release_tag }}
|
|
MANUAL_PRERELEASE: ${{ github.event_name == 'release' && github.event.release.prerelease || inputs.prerelease }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
case "$RELEASE_TAG" in
|
|
v*) ;;
|
|
*) RELEASE_TAG="v$RELEASE_TAG" ;;
|
|
esac
|
|
|
|
if ! node -e 'process.exit(/^v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:0|[1-9]\d*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.test(process.argv[1]) ? 0 : 1)' "$RELEASE_TAG"; then
|
|
echo "Invalid release tag: $RELEASE_TAG" >&2
|
|
exit 1
|
|
fi
|
|
|
|
prerelease="$MANUAL_PRERELEASE"
|
|
release_args=(--title "EasyCLIProxyAPI $RELEASE_TAG" --generate-notes)
|
|
if [[ "$GITHUB_REF_TYPE" == "tag" ]]; then
|
|
release_args+=(--verify-tag)
|
|
if [[ "$RELEASE_TAG" == *-* ]]; then
|
|
prerelease=true
|
|
else
|
|
prerelease=false
|
|
fi
|
|
else
|
|
release_args+=(--target "$GITHUB_SHA")
|
|
fi
|
|
if [[ "$prerelease" == "true" ]]; then
|
|
release_args+=(--prerelease)
|
|
fi
|
|
|
|
if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
|
|
gh release upload "$RELEASE_TAG" artifacts/* --clobber
|
|
else
|
|
gh release create "$RELEASE_TAG" "${release_args[@]}" artifacts/*
|
|
fi
|