349 lines
13 KiB
YAML
349 lines
13 KiB
YAML
name: Build portable releases
|
|
|
|
run-name: >-
|
|
Portable release ${{ (github.ref_type == 'tag' && github.ref_name) || inputs.release_tag || github.ref_name }}
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
release_tag:
|
|
description: Optional tag to create after all builds pass (leave empty to build artifacts only)
|
|
required: false
|
|
type: string
|
|
prerelease:
|
|
description: Mark a manually published release as a pre-release
|
|
required: true
|
|
default: true
|
|
type: boolean
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
version:
|
|
name: Resolve app version
|
|
runs-on: ubuntu-24.04
|
|
outputs:
|
|
version: ${{ steps.resolve.outputs.version }}
|
|
tag: ${{ steps.resolve.outputs.tag }}
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
ref: ${{ github.ref }}
|
|
- name: Resolve release version
|
|
id: resolve
|
|
shell: bash
|
|
env:
|
|
REQUESTED_VERSION: ${{ (github.ref_type == 'tag' && github.ref_name) || inputs.release_tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
source_version="$(node scripts/version.mjs)"
|
|
release_tag="$REQUESTED_VERSION"
|
|
if [ -z "$release_tag" ]; then
|
|
release_tag="v$source_version"
|
|
else
|
|
case "$release_tag" in
|
|
v*) ;;
|
|
*) release_tag="v$release_tag" ;;
|
|
esac
|
|
fi
|
|
|
|
version="$(node scripts/version.mjs "${release_tag#v}")"
|
|
|
|
echo "version=$version" >> "$GITHUB_OUTPUT"
|
|
echo "tag=$release_tag" >> "$GITHUB_OUTPUT"
|
|
|
|
build:
|
|
name: Build ${{ matrix.os }}-${{ matrix.arch }}
|
|
needs: version
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- runner: ubuntu-24.04
|
|
os: linux
|
|
display_os: Linux
|
|
arch: amd64
|
|
suffix: tar.gz
|
|
- runner: ubuntu-24.04-arm
|
|
os: linux
|
|
display_os: Linux
|
|
arch: aarch64
|
|
suffix: tar.gz
|
|
- runner: macos-15-intel
|
|
os: darwin
|
|
display_os: Darwin
|
|
arch: amd64
|
|
suffix: dmg
|
|
- runner: macos-15
|
|
os: darwin
|
|
display_os: Darwin
|
|
arch: aarch64
|
|
suffix: dmg
|
|
- runner: windows-2025
|
|
os: windows
|
|
display_os: Windows
|
|
arch: amd64
|
|
suffix: zip
|
|
- runner: windows-11-arm
|
|
os: windows
|
|
display_os: Windows
|
|
arch: aarch64
|
|
suffix: zip
|
|
runs-on: ${{ matrix.runner }}
|
|
timeout-minutes: 60
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
ref: ${{ github.ref }}
|
|
- uses: oven-sh/setup-bun@v2
|
|
with:
|
|
bun-version: 1.3.14
|
|
- uses: dtolnay/rust-toolchain@1.97.0
|
|
- name: Cache Bun packages
|
|
uses: actions/cache@v5
|
|
with:
|
|
path: ~/.bun/install/cache
|
|
key: bun-${{ runner.os }}-${{ runner.arch }}-1.3.14-${{ hashFiles('bun.lock') }}
|
|
restore-keys: |
|
|
bun-${{ runner.os }}-${{ runner.arch }}-1.3.14-
|
|
- name: Cache Rust dependencies and build outputs
|
|
uses: Swatinem/rust-cache@v2
|
|
with:
|
|
workspaces: src-tauri -> target
|
|
cache-workspace-crates: true
|
|
cache-on-failure: true
|
|
- name: Cache bundled core archive
|
|
uses: actions/cache@v5
|
|
with:
|
|
path: cpa-core
|
|
key: core-v2-${{ matrix.os }}-${{ matrix.arch }}-${{ hashFiles('core-version.txt') }}
|
|
- name: Apply release version
|
|
run: node scripts/set-version.mjs "${{ needs.version.outputs.version }}"
|
|
- name: Resolve release package name
|
|
id: package
|
|
shell: bash
|
|
env:
|
|
APP_VERSION: ${{ needs.version.outputs.version }}
|
|
run: |
|
|
echo "stem=EasyCLIProxyAPI-v${APP_VERSION}-${{ matrix.display_os }}-${{ matrix.arch }}" >> "$GITHUB_OUTPUT"
|
|
echo "version=$APP_VERSION" >> "$GITHUB_OUTPUT"
|
|
- name: Install Linux dependencies
|
|
if: matrix.os == 'linux'
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
|
|
- name: Build GUI
|
|
env:
|
|
GITCODE_GUI_REPOSITORY: ${{ vars.GITCODE_GUI_REPOSITORY }}
|
|
GITCODE_CORE_REPOSITORY: ${{ vars.GITCODE_CORE_REPOSITORY }}
|
|
run: |
|
|
bun install --frozen-lockfile
|
|
bun tauri build --no-bundle
|
|
shell: bash
|
|
- name: Prepare portable directory
|
|
run: >-
|
|
node scripts/portable.mjs
|
|
--binary "src-tauri/target/release/cpa-gui${{ matrix.os == 'windows' && '.exe' || '' }}"
|
|
--output "release/${{ steps.package.outputs.stem }}"
|
|
--os "${{ matrix.os }}"
|
|
--arch "${{ matrix.arch }}"
|
|
--download true
|
|
shell: bash
|
|
- name: Prepare Windows legacy updater payload
|
|
if: matrix.os == 'windows'
|
|
shell: pwsh
|
|
run: |
|
|
$updateDir = "release/update-${{ matrix.arch }}"
|
|
New-Item -ItemType Directory -Force -Path $updateDir | Out-Null
|
|
Copy-Item -LiteralPath "release/${{ steps.package.outputs.stem }}/EasyCLIProxyAPI.exe" -Destination $updateDir
|
|
Copy-Item -LiteralPath "release/${{ steps.package.outputs.stem }}/portable-app.json" -Destination $updateDir
|
|
- name: Build signed macOS DMG
|
|
if: matrix.os == 'darwin'
|
|
shell: bash
|
|
env:
|
|
APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
|
|
APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
|
|
APPLE_ID: ${{ secrets.APPLE_ID }}
|
|
APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
|
|
APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
|
|
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
certificate_path="$RUNNER_TEMP/apple-signing-certificate.p12"
|
|
keychain_path="$RUNNER_TEMP/apple-signing.keychain-db"
|
|
keychain_password="$(uuidgen)"
|
|
signed_core_dir="$RUNNER_TEMP/signed-core"
|
|
unsigned_core_archive="$RUNNER_TEMP/unsigned-core-${{ matrix.arch }}.tar.gz"
|
|
core_archive=""
|
|
staging_dir="$RUNNER_TEMP/easycli-dmg-staging"
|
|
bundle_dir="src-tauri/target/release/bundle"
|
|
output_dmg="${{ steps.package.outputs.stem }}.dmg"
|
|
keychain_list="$(security list-keychains -d user)"
|
|
existing_keychains=()
|
|
while IFS= read -r existing_keychain; do
|
|
existing_keychain="${existing_keychain#*\"}"
|
|
existing_keychain="${existing_keychain%\"*}"
|
|
if [ -n "$existing_keychain" ]; then
|
|
existing_keychains+=("$existing_keychain")
|
|
fi
|
|
done <<< "$keychain_list"
|
|
|
|
cleanup() {
|
|
set +e
|
|
if [ -n "$core_archive" ] && [ -f "$unsigned_core_archive" ]; then
|
|
cp "$unsigned_core_archive" "$core_archive"
|
|
fi
|
|
rm -f "$certificate_path"
|
|
rm -f "$unsigned_core_archive"
|
|
rm -rf "$signed_core_dir" "$staging_dir"
|
|
security delete-keychain "$keychain_path"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
(umask 077; printf '%s' "$APPLE_CERTIFICATE" | base64 -D > "$certificate_path")
|
|
security create-keychain -p "$keychain_password" "$keychain_path"
|
|
if [ "${#existing_keychains[@]}" -gt 0 ]; then
|
|
security list-keychains -d user -s "$keychain_path" "${existing_keychains[@]}"
|
|
else
|
|
security list-keychains -d user -s "$keychain_path"
|
|
fi
|
|
security set-keychain-settings -lut 21600 "$keychain_path"
|
|
security unlock-keychain -p "$keychain_password" "$keychain_path"
|
|
security import "$certificate_path" -k "$keychain_path" -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
|
|
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$keychain_password" "$keychain_path"
|
|
|
|
core_archive="$(find cpa-core -maxdepth 1 -type f -name 'CLIProxyAPI_*_darwin_${{ matrix.arch }}.tar.gz' -print -quit)"
|
|
cp "$core_archive" "$unsigned_core_archive"
|
|
mkdir -p "$signed_core_dir"
|
|
tar -xzf "$core_archive" -C "$signed_core_dir"
|
|
core_binary="$(find "$signed_core_dir" -type f -name 'cli-proxy-api' -print -quit)"
|
|
codesign --force --options runtime --timestamp --sign "$APPLE_SIGNING_IDENTITY" --keychain "$keychain_path" "$core_binary"
|
|
signed_archive="$RUNNER_TEMP/$(basename "$core_archive")"
|
|
COPYFILE_DISABLE=1 tar -czf "$signed_archive" -C "$signed_core_dir" .
|
|
mv "$signed_archive" "$core_archive"
|
|
|
|
cp "release/${{ steps.package.outputs.stem }}/portable-app.json" portable-app.json
|
|
|
|
# Build the notarized app with Tauri, then create the DMG with hdiutil.
|
|
# Tauri's generated create-dmg script is unreliable on GitHub's macOS runners.
|
|
env -u APPLE_CERTIFICATE -u APPLE_CERTIFICATE_PASSWORD \
|
|
bun tauri bundle --bundles app --ci --config src-tauri/tauri.dmg.conf.json
|
|
|
|
app_path="$bundle_dir/macos/EasyCLIProxyAPI.app"
|
|
|
|
rm -rf "$staging_dir"
|
|
mkdir -p "$staging_dir"
|
|
ditto "$app_path" "$staging_dir/EasyCLIProxyAPI.app"
|
|
ln -s /Applications "$staging_dir/Applications"
|
|
hdiutil create \
|
|
-volname "EasyCLIProxyAPI" \
|
|
-srcfolder "$staging_dir" \
|
|
-format UDZO \
|
|
-ov \
|
|
"$output_dmg"
|
|
codesign --force --timestamp --sign "$APPLE_SIGNING_IDENTITY" --keychain "$keychain_path" "$output_dmg"
|
|
xcrun notarytool submit "$output_dmg" \
|
|
--apple-id "$APPLE_ID" \
|
|
--password "$APPLE_PASSWORD" \
|
|
--team-id "$APPLE_TEAM_ID" \
|
|
--wait
|
|
xcrun stapler staple "$output_dmg"
|
|
- name: Archive Linux release
|
|
if: matrix.os == 'linux'
|
|
run: tar -czf "${{ steps.package.outputs.stem }}.tar.gz" -C release "${{ steps.package.outputs.stem }}"
|
|
- name: Archive Windows release
|
|
if: matrix.os == 'windows'
|
|
shell: pwsh
|
|
run: |
|
|
Compress-Archive -Path "release/${{ steps.package.outputs.stem }}" -DestinationPath "${{ steps.package.outputs.stem }}.zip"
|
|
$updateArchive = "EasyCLIProxyAPI-update-v${{ steps.package.outputs.version }}-Windows-${{ matrix.arch }}.zip"
|
|
Compress-Archive -Path "release/update-${{ matrix.arch }}/*" -DestinationPath $updateArchive
|
|
- uses: actions/upload-artifact@v7
|
|
with:
|
|
name: ${{ steps.package.outputs.stem }}
|
|
path: ${{ steps.package.outputs.stem }}.${{ matrix.suffix }}
|
|
if-no-files-found: error
|
|
retention-days: 14
|
|
- uses: actions/upload-artifact@v7
|
|
if: matrix.os == 'windows'
|
|
with:
|
|
name: portable-updater-windows-${{ matrix.arch }}
|
|
path: EasyCLIProxyAPI-update-v${{ steps.package.outputs.version }}-Windows-${{ matrix.arch }}.zip
|
|
if-no-files-found: error
|
|
retention-days: 14
|
|
publish:
|
|
name: Publish GitHub release
|
|
if: >-
|
|
startsWith(github.ref, 'refs/tags/')
|
|
|| inputs.release_tag != ''
|
|
needs:
|
|
- version
|
|
- build
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 15
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
ref: ${{ github.ref }}
|
|
- uses: actions/download-artifact@v8
|
|
with:
|
|
path: artifacts
|
|
merge-multiple: true
|
|
- name: Generate portable update manifests
|
|
shell: bash
|
|
env:
|
|
RELEASE_TAG: ${{ needs.version.outputs.tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
for platform in windows linux darwin; do
|
|
node scripts/manifest.mjs \
|
|
--directory artifacts \
|
|
--platform "$platform" \
|
|
--repository "${{ github.repository }}" \
|
|
--gitcode-repository "${{ vars.GITCODE_GUI_REPOSITORY }}" \
|
|
--tag "$RELEASE_TAG"
|
|
done
|
|
- name: Publish release
|
|
shell: bash
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
GH_REPO: ${{ github.repository }}
|
|
RELEASE_TAG: ${{ needs.version.outputs.tag }}
|
|
MANUAL_PRERELEASE: ${{ inputs.prerelease }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
case "$RELEASE_TAG" in
|
|
v*) ;;
|
|
*) RELEASE_TAG="v$RELEASE_TAG" ;;
|
|
esac
|
|
|
|
prerelease="$MANUAL_PRERELEASE"
|
|
release_args=(--title "EasyCLIProxyAPI $RELEASE_TAG" --generate-notes)
|
|
if [[ "$GITHUB_REF_TYPE" == "tag" ]]; then
|
|
if [[ "$RELEASE_TAG" == *-* ]]; then
|
|
prerelease=true
|
|
else
|
|
prerelease=false
|
|
fi
|
|
else
|
|
release_args+=(--target "$GITHUB_SHA")
|
|
fi
|
|
if [[ "$prerelease" == "true" ]]; then
|
|
release_args+=(--prerelease)
|
|
fi
|
|
|
|
if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
|
|
gh release upload "$RELEASE_TAG" artifacts/* --clobber
|
|
else
|
|
gh release create "$RELEASE_TAG" "${release_args[@]}" artifacts/*
|
|
fi
|