Skip to content

Merge pull request #491 from mountaindude/main #68

Merge pull request #491 from mountaindude/main

Merge pull request #491 from mountaindude/main #68

Workflow file for this run

name: ci
on:
workflow_dispatch:
push:
branches:
- main
jobs:
release-please:
runs-on: ubuntu-latest
outputs:
releases_created: ${{ steps.release.outputs.releases_created }}
release_tag_name: ${{ steps.release.outputs['tag_name'] }}
release_version: ${{ steps.release.outputs['version'] }}
release_upload_url: ${{ steps.release.outputs['upload_url'] }}
env:
GITHUB_REF: ${{ github.ref }}
GITHUB_TOKEN: ${{ secrets.RELEASE_PLEASE_PAT }}
DIST_FILE_NAME: ctrl-q
permissions:
contents: write
pull-requests: write
steps:
- name: Show github.ref
run: echo "$GITHUB_REF"
- uses: googleapis/release-please-action@v4
id: release
if: |
github.repository_owner == 'ptarmiganlabs'
with:
token: ${{ secrets.RELEASE_PLEASE_PAT }}
# optional. customize path to release-please-config.json
config-file: release-please-config.json
# optional. customize path to .release-please-manifest.json
manifest-file: .release-please-manifest.json
target-branch: main
- name: Show output from Release-Please
if: always()
env:
RELEASE_PLEASE_OUTPUT: ${{ toJSON(steps.release.outputs) }}
run: echo "$RELEASE_PLEASE_OUTPUT"
- name: Show output from Release-Please
run: |
echo "releases_created: ${{ steps.release.outputs.releases_created }}"
echo "release_created : ${{ steps.release.outputs.release_created }}"
echo "draft : ${{ steps.release.outputs['draft'] }}"
echo "path : ${{ steps.release.outputs['path'] }}"
echo "upload_url : ${{ steps.release.outputs['upload_url'] }}"
echo "html_url : ${{ steps.release.outputs['html_url'] }}"
echo "tag_name : ${{ steps.release.outputs['tag_name'] }}"
echo "version : ${{ steps.release.outputs['version'] }}"
echo "major : ${{ steps.release.outputs['major'] }}"
echo "minor : ${{ steps.release.outputs['minor'] }}"
echo "patch : ${{ steps.release.outputs['patch'] }}"
echo "sha : ${{ steps.release.outputs['sha'] }}"
#####################
release-macos:
needs: release-please
runs-on:
- self-hosted
- x64
- macos
- sp53
# timeout-minutes: 15
if: needs.release-please.outputs.releases_created == 'true'
env:
DIST_FILE_NAME: ctrl-q
GITHUB_TOKEN: ${{ secrets.RELEASE_PLEASE_PAT }}
MACOS_CERTIFICATE: ${{ secrets.PROD_MACOS_CERTIFICATE_BASE64_CODESIGN }}
MACOS_CERTIFICATE_PWD: ${{ secrets.PROD_MACOS_CERTIFICATE_CODESIGN_PWD }}
MACOS_CERTIFICATE_NAME: ${{ secrets.PROD_MACOS_CERTIFICATE_CODESIGN_NAME }}
MACOS_CI_KEYCHAIN_PWD: ${{ secrets.PROD_MACOS_CI_KEYCHAIN_PWD }}
PROD_MACOS_NOTARIZATION_APPLE_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_APPLE_ID }}
PROD_MACOS_NOTARIZATION_TEAM_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_TEAM_ID }}
PROD_MACOS_NOTARIZATION_PWD: ${{ secrets.PROD_MACOS_NOTARIZATION_PWD }}
steps:
- name: Release tag and upload url from previous job
run: |
echo "tag_name : ${{ needs.release-please.outputs.release_tag_name }}"
echo "version : ${{ needs.release-please.outputs.release_version }}"
echo "upload_url : ${{ needs.release-please.outputs.release_upload_url }}"
- name: Checkout repository
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: lts/*
- name: Install tool for creating stand-alone executables
run: |
npm install pkg --location=global
npm install --save-exact esbuild
- name: Install dependencies
run: |
pwd
npm ci --include=prod
- name: Build binaries
run: |
pwd
./node_modules/.bin/esbuild src/ctrl-q.js --bundle --external:axios --external:xdg-open --external:enigma.js --outfile=build.cjs --format=cjs --platform=node --target=node18 --minify --inject:./src/lib/util/import-meta-url.js --define:import.meta.url=import_meta_url
pkg --output "./${DIST_FILE_NAME}" -t node18-macos-x64 ./build.cjs --config package.json --compress GZip
chmod +x "${DIST_FILE_NAME}"
security delete-keychain build.keychain || true
# Turn our base64-encoded certificate back to a regular .p12 file
echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
# We need to create a new keychain, otherwise using the certificate will prompt
# with a UI dialog asking for the certificate password, which we can't
# use in a headless CI environment
security create-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
security list-keychains -d user -s build.keychain
security default-keychain -d user -s build.keychain
security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
codesign --force -s "$MACOS_CERTIFICATE_NAME" -v "./${DIST_FILE_NAME}" --deep --strict --options=runtime --timestamp --entitlements ./release-config/${DIST_FILE_NAME}.entitlements
# We can't notarize an app bundle directly, but we need to compress it as an archive.
# Therefore, we create a zip file containing our app bundle, so that we can send it to the
# notarization service
# Notarize release binary
echo "Creating temp notarization archive for release binary"
# ditto -c -k --keepParent "./${DIST_FILE_NAME}" "./${DIST_FILE_NAME}.zip"
ditto -c -k --keepParent "./${DIST_FILE_NAME}" "./${DIST_FILE_NAME}-${{ needs.release-please.outputs.release_version }}-macos.zip"
# Here we send the notarization request to the Apple's Notarization service, waiting for the result.
# This typically takes a few seconds inside a CI environment, but it might take more depending on the App
# characteristics. Visit the Notarization docs for more information and strategies on how to optimize it if
# you're curious
echo "Notarize release app"
xcrun notarytool submit "./${DIST_FILE_NAME}-${{ needs.release-please.outputs.release_version }}-macos.zip" --keychain-profile "notarytool-profile" --wait
# Delete build keychain
security delete-keychain build.keychain
- name: Upload to existing release
uses: ncipollo/release-action@v1
with:
allowUpdates: true
omitBodyDuringUpdate: true
omitNameDuringUpdate: true
artifactContentType: raw
# artifactContentType: application/zip
draft: true
tag: ${{ needs.release-please.outputs.release_tag_name }}
artifacts: ./ctrl-q-${{ needs.release-please.outputs.release_version }}-macos.zip
token: ${{ github.token }}
- name: Tidy up before existing
run: |
pwd
ls -la
rm build.cjs
rm "./${DIST_FILE_NAME}"
rm "./${DIST_FILE_NAME}-${{ needs.release-please.outputs.release_version }}-macos.zip"
#####################
release-win64:
needs: release-please
runs-on:
- self-hosted
- x64
- windows
- sp53
- win-code-sign
# timeout-minutes: 15
if: needs.release-please.outputs.releases_created == 'true'
env:
DIST_FILE_NAME: ctrl-q
GITHUB_TOKEN: ${{ secrets.RELEASE_PLEASE_PAT }}
# CODESIGN_PWD: ${{ secrets.WIN_CODESIGN_PWD}}
# CODESIGN_INTERMEDIATE_BASE64: ${{ secrets.WIN_CODESIGN_INTERMEDIATE_BASE64 }}
# CODESIGN_BASE64: ${{ secrets.WIN_CODESIGN_BASE64}}
CODESIGN_WIN_THUMBPRINT: ${{ secrets.WIN_CODESIGN_THUMBPRINT}}
steps:
- name: Release tag and upload url from previous job
run: |
Write-Output 'tag_name : ${{ needs.release-please.outputs.release_tag_name }}'
Write-Output 'version : ${{ needs.release-please.outputs.release_version }}'
Write-Output 'upload_url : ${{ needs.release-please.outputs.release_upload_url }}'
- name: Checkout repository
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: lts/*
- name: Install tool for creating stand-alone executables
run: |
npm install pkg --location=global
- name: Install dependencies
run: |
pwd
npm ci --include=prod
- name: Build binaries
run: |
./node_modules/.bin/esbuild src/ctrl-q.js --bundle --external:axios --external:xdg-open --external:enigma.js --outfile=build.cjs --format=cjs --platform=node --target=node18 --minify --inject:./src/lib/util/import-meta-url.js --define:import.meta.url=import_meta_url
pkg --output "./${env:DIST_FILE_NAME}.exe" -t node18-win-x64 ./build.cjs --config package.json --compress GZip
# Sign the executable
# 1st signing
$processOptions1 = @{
FilePath = "C:\Program Files (x86)/Windows Kits/10/bin/10.0.22621.0/x64/signtool.exe"
Wait = $true
ArgumentList = "sign", "/sha1", "$env:CODESIGN_WIN_THUMBPRINT", "/tr", "http://time.certum.pl", "/td", "sha256", "/fd", "sha1", "/v", "./${env:DIST_FILE_NAME}.exe"
WorkingDirectory = "."
NoNewWindow = $true
}
Start-Process @processOptions1
# 2nd signing
$processOptions2 = @{
FilePath = "C:\Program Files (x86)/Windows Kits/10/bin/10.0.22621.0/x64/signtool.exe"
Wait = $true
ArgumentList = "sign", "/sha1", "$env:CODESIGN_WIN_THUMBPRINT", "/tr", "http://time.certum.pl", "/td", "sha256", "/fd", "sha256", "/v", "./${env:DIST_FILE_NAME}.exe"
WorkingDirectory = "."
NoNewWindow = $true
}
Start-Process @processOptions2
# Create release binary zip
$compress = @{
Path = "./${env:DIST_FILE_NAME}.exe"
CompressionLevel = "Fastest"
DestinationPath = "${env:DIST_FILE_NAME}-${{ needs.release-please.outputs.release_version }}-win.zip"
}
Compress-Archive @compress
- name: Upload to existing release
uses: ncipollo/release-action@v1
with:
allowUpdates: true
omitBodyDuringUpdate: true
omitNameDuringUpdate: true
artifactContentType: raw
# artifactContentType: application/zip
draft: true
tag: ${{ needs.release-please.outputs.release_tag_name }}
artifacts: ./ctrl-q-${{ needs.release-please.outputs.release_version }}-win.zip
token: ${{ github.token }}
- name: Tidy up before existing
run: |
dir
del build.cjs
del "./${env:DIST_FILE_NAME}.exe"
del "./${env:DIST_FILE_NAME}-${{ needs.release-please.outputs.release_version }}-win.zip"
#####################
release-linux:
needs: release-please
runs-on: ubuntu-latest
# timeout-minutes: 15
if: needs.release-please.outputs.releases_created == 'true'
env:
DIST_FILE_NAME: ctrl-q
GITHUB_TOKEN: ${{ secrets.RELEASE_PLEASE_PAT }}
steps:
- name: Release tag and upload url from previous job
run: |
echo "tag_name : ${{ needs.release-please.outputs.release_tag_name }}"
echo "version : ${{ needs.release-please.outputs.release_version }}"
echo "upload_url : ${{ needs.release-please.outputs.release_upload_url }}"
- name: Checkout repository
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: lts/*
- name: Install tool for creating stand-alone executables
run: |
npm install pkg --location=global
- name: Install dependencies
run: |
pwd
npm ci
- name: Build binaries
run: |
./node_modules/.bin/esbuild src/ctrl-q.js --bundle --external:axios --external:xdg-open --external:enigma.js --outfile=build.cjs --format=cjs --platform=node --target=node18 --minify --inject:./src/lib/util/import-meta-url.js --define:import.meta.url=import_meta_url
pkg --output "./${DIST_FILE_NAME}" -t node18-linux-x64 ./build.cjs --config package.json --compress GZip
chmod +x ${DIST_FILE_NAME}
- name: Make binary executable
run: |
chmod +x ./${DIST_FILE_NAME}
- name: Compress release binary
run: |
ls -la
zip -9 -r ./${DIST_FILE_NAME}-${{ needs.release-please.outputs.release_version }}-linux.zip ${DIST_FILE_NAME}
- name: Debug
run: |
ls -la
- name: Upload to existing release
uses: ncipollo/release-action@v1
with:
allowUpdates: true
omitBodyDuringUpdate: true
omitNameDuringUpdate: true
artifactContentType: raw
# artifactContentType: application/zip
draft: true
tag: ${{ needs.release-please.outputs.release_tag_name }}
artifacts: ./ctrl-q-${{ needs.release-please.outputs.release_version }}-linux.zip
token: ${{ github.token }}
- name: Tidy up before existing
run: |
pwd
ls -la
rm build.cjs
rm "./${DIST_FILE_NAME}"
rm "./${DIST_FILE_NAME}-${{ needs.release-please.outputs.release_version }}-linux.zip"