mirror of
https://github.com/fluxerapp/fluxer
synced 2026-10-17 13:05:32 +09:00
860 lines
34 KiB
YAML
860 lines
34 KiB
YAML
name: build desktop
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
channel:
|
|
description: Release channel label (stable or canary). Source is always this repository's main branch.
|
|
required: false
|
|
type: choice
|
|
options:
|
|
- stable
|
|
- canary
|
|
default: stable
|
|
build_version:
|
|
description: Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation.
|
|
required: false
|
|
default: ""
|
|
type: string
|
|
skip_targets:
|
|
description: Comma-separated platforms or targets to skip, such as windows, macos, linux-x64.
|
|
required: false
|
|
default: ""
|
|
type: string
|
|
permissions:
|
|
contents: write
|
|
id-token: write
|
|
actions: read
|
|
|
|
concurrency:
|
|
group: desktop-${{ inputs.channel }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
CHANNEL: ${{ inputs.channel }}
|
|
BUILD_CHANNEL: ${{ inputs.channel == 'canary' && 'canary' || 'stable' }}
|
|
|
|
jobs:
|
|
meta:
|
|
name: Resolve build metadata
|
|
runs-on: ubuntu-24.04-arm
|
|
environment: desktop-releases
|
|
timeout-minutes: 25
|
|
permissions:
|
|
contents: read
|
|
outputs:
|
|
version: ${{ steps.meta.outputs.version }}
|
|
pub_date: ${{ steps.meta.outputs.pub_date }}
|
|
channel: ${{ steps.meta.outputs.channel }}
|
|
build_channel: ${{ steps.meta.outputs.build_channel }}
|
|
source_sha: ${{ steps.meta.outputs.source_sha }}
|
|
steps:
|
|
- name: Checkout source
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
|
|
with:
|
|
ref: main
|
|
|
|
- name: Set up Rust toolchain (CI helpers)
|
|
uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
|
|
with:
|
|
toolchain: "1.98.1"
|
|
|
|
- name: Create token
|
|
id: create-token
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
|
|
with:
|
|
client-id: ${{ vars.FLUXER_CI_APP_ID }}
|
|
private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
|
|
owner: fluxerapp
|
|
repositories: fluxer
|
|
permission-contents: read
|
|
- name: Set metadata
|
|
id: meta
|
|
env:
|
|
GH_TOKEN: ${{ steps.create-token.outputs.token }}
|
|
FLUXER_BUILD_VERSION: ${{ inputs.build_version }}
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
|
|
--step set_metadata
|
|
--channel "${{ inputs.channel }}"
|
|
|
|
matrix:
|
|
name: Resolve build matrix
|
|
runs-on: ubuntu-24.04-arm
|
|
environment: desktop-releases
|
|
timeout-minutes: 25
|
|
permissions:
|
|
contents: read
|
|
outputs:
|
|
matrix: ${{ steps.set-matrix.outputs.matrix }}
|
|
steps:
|
|
- name: Checkout source
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
|
|
|
|
- name: Set up Rust toolchain (CI helpers)
|
|
uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
|
|
with:
|
|
toolchain: "1.98.1"
|
|
|
|
- name: Build platform matrix
|
|
id: set-matrix
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
|
|
--step set_matrix
|
|
--skip-targets "${{ inputs.skip_targets }}"
|
|
|
|
shared_assets:
|
|
name: Build shared renderer assets
|
|
needs:
|
|
- meta
|
|
runs-on: ubuntu-24.04
|
|
environment: desktop-releases
|
|
timeout-minutes: 60
|
|
permissions:
|
|
contents: read
|
|
env:
|
|
CHANNEL: ${{ needs.meta.outputs.channel }}
|
|
BUILD_CHANNEL: ${{ needs.meta.outputs.build_channel }}
|
|
RELEASE_CHANNEL: ${{ needs.meta.outputs.build_channel }}
|
|
PUBLIC_RELEASE_CHANNEL: ${{ needs.meta.outputs.build_channel }}
|
|
VERSION: ${{ needs.meta.outputs.version }}
|
|
BUILD_VERSION: ${{ needs.meta.outputs.version }}
|
|
PUBLIC_BUILD_VERSION: ${{ needs.meta.outputs.version }}
|
|
SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
|
|
steps:
|
|
- name: Checkout CI helpers
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
|
|
with:
|
|
ref: ${{ needs.meta.outputs.source_sha }}
|
|
path: _ci
|
|
|
|
- name: Checkout source
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
|
|
with:
|
|
ref: ${{ needs.meta.outputs.source_sha }}
|
|
path: source
|
|
|
|
- name: Set up Rust toolchain (renderer wasm)
|
|
uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
|
|
with:
|
|
toolchain: "1.98.1"
|
|
targets: wasm32-unknown-unknown
|
|
|
|
- name: Set workdir (Unix)
|
|
env:
|
|
SUBST_TARGET: ${{ github.workspace }}/source
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step set_workdir_unix
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
|
|
with:
|
|
node-version: 26
|
|
|
|
- name: Set up pnpm
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step setup_pnpm
|
|
|
|
- name: Resolve pnpm store path (Unix)
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step resolve_pnpm_store_unix
|
|
|
|
- name: Cache pnpm store
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
|
|
with:
|
|
path: ${{ env.PNPM_STORE_PATH }}
|
|
key: ${{ runner.os }}-shared-renderer-pnpm-store-${{ hashFiles('source/pnpm-lock.yaml') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-shared-renderer-pnpm-store-
|
|
|
|
- name: Cache cargo registry
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
|
|
with:
|
|
path: |
|
|
~/.cargo/registry
|
|
~/.cargo/git
|
|
key: ${{ runner.os }}-shared-renderer-cargo-registry-${{ hashFiles('source/Cargo.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-shared-renderer-cargo-registry-
|
|
|
|
- name: Install dependencies
|
|
working-directory: ${{ env.WORKDIR }}/fluxer_desktop
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step install_dependencies
|
|
|
|
- name: Update version
|
|
working-directory: ${{ env.WORKDIR }}/fluxer_desktop
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step update_version
|
|
|
|
- name: Set build channel
|
|
working-directory: ${{ env.WORKDIR }}/fluxer_desktop
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step set_build_channel
|
|
|
|
- name: Build shared renderer assets
|
|
working-directory: ${{ env.WORKDIR }}/fluxer_desktop
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step build_shared_assets
|
|
|
|
- name: Prepare shared renderer artifact
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step prepare_shared_assets
|
|
|
|
- name: Upload shared renderer artifact
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
|
|
with:
|
|
name: desktop-shared-${{ needs.meta.outputs.build_channel }}-${{ needs.meta.outputs.version }}-${{ needs.meta.outputs.source_sha }}
|
|
path: source/desktop-shared-assets
|
|
if-no-files-found: error
|
|
retention-days: 1
|
|
compression-level: 0
|
|
|
|
- name: Split renderer into desktop modules
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step split_modules
|
|
|
|
- name: Pack desktop modules
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step pack_modules
|
|
|
|
- name: Upload desktop module packages
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
|
|
with:
|
|
name: desktop-modules-${{ needs.meta.outputs.build_channel }}-${{ needs.meta.outputs.version }}-${{ needs.meta.outputs.source_sha }}
|
|
path: |
|
|
source/desktop-modules/classification.json
|
|
source/desktop-modules/*/module.json
|
|
source/desktop-modules/*/package.br
|
|
source/desktop-modules/*/package.br.sha256
|
|
if-no-files-found: error
|
|
retention-days: 1
|
|
compression-level: 0
|
|
|
|
build:
|
|
name: Build ${{ matrix.platform }} (${{ matrix.arch }})
|
|
needs:
|
|
- meta
|
|
- matrix
|
|
- shared_assets
|
|
runs-on: ${{ matrix.os }}
|
|
environment: desktop-releases
|
|
timeout-minutes: 180
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
id-token: write
|
|
strategy:
|
|
fail-fast: false
|
|
matrix: ${{ fromJson(needs.matrix.outputs.matrix) }}
|
|
env:
|
|
CHANNEL: ${{ needs.meta.outputs.channel }}
|
|
BUILD_CHANNEL: ${{ needs.meta.outputs.build_channel }}
|
|
RELEASE_CHANNEL: ${{ needs.meta.outputs.build_channel }}
|
|
PUBLIC_RELEASE_CHANNEL: ${{ needs.meta.outputs.build_channel }}
|
|
VERSION: ${{ needs.meta.outputs.version }}
|
|
BUILD_VERSION: ${{ needs.meta.outputs.version }}
|
|
PUBLIC_BUILD_VERSION: ${{ needs.meta.outputs.version }}
|
|
PUB_DATE: ${{ needs.meta.outputs.pub_date }}
|
|
SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
|
|
DESKTOP_PLATFORM: ${{ matrix.platform }}
|
|
DESKTOP_ARCH: ${{ matrix.arch }}
|
|
FLUXER_MODULES: "1"
|
|
PLATFORM: ${{ matrix.platform }}
|
|
ARCH: ${{ matrix.arch }}
|
|
ELECTRON_ARCH: ${{ matrix.electron_arch }}
|
|
steps:
|
|
- name: Checkout CI helpers
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
|
|
with:
|
|
ref: ${{ needs.meta.outputs.source_sha }}
|
|
path: _ci
|
|
|
|
- name: Checkout source
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
|
|
with:
|
|
ref: ${{ needs.meta.outputs.source_sha }}
|
|
path: source
|
|
|
|
- name: Set up Rust toolchain (CI helpers)
|
|
uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
|
|
with:
|
|
toolchain: "1.98.1"
|
|
|
|
- name: Set up Python (Windows)
|
|
if: runner.os == 'Windows'
|
|
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
|
|
with:
|
|
python-version: "3.14"
|
|
|
|
- name: Ensure python3 command (Windows)
|
|
if: runner.os == 'Windows'
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step ensure_python3_windows
|
|
|
|
- name: Shorten Windows paths and pin pnpm store
|
|
if: runner.os == 'Windows'
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step windows_paths
|
|
env:
|
|
SUBST_TARGET: ${{ github.workspace }}/source
|
|
|
|
- name: Set workdir (Unix)
|
|
if: runner.os != 'Windows'
|
|
env:
|
|
SUBST_TARGET: ${{ github.workspace }}/source
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step set_workdir_unix
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
|
|
with:
|
|
node-version: 26
|
|
|
|
- name: Set up pnpm
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step setup_pnpm
|
|
|
|
- name: Resolve pnpm store path (Windows)
|
|
if: runner.os == 'Windows'
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step resolve_pnpm_store_windows
|
|
|
|
- name: Resolve pnpm store path (Unix)
|
|
if: runner.os != 'Windows'
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step resolve_pnpm_store_unix
|
|
|
|
- name: Cache pnpm store
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
|
|
with:
|
|
path: ${{ env.PNPM_STORE_PATH }}
|
|
key: ${{ runner.os }}-${{ matrix.arch }}-pnpm-store-${{ hashFiles('source/pnpm-lock.yaml') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-${{ matrix.arch }}-pnpm-store-
|
|
|
|
- name: Install Python setuptools (Windows ARM64)
|
|
if: matrix.platform == 'windows' && matrix.arch == 'arm64'
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step install_setuptools_windows_arm64
|
|
|
|
- name: Install Python setuptools (macOS)
|
|
if: matrix.platform == 'macos'
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step install_setuptools_macos
|
|
|
|
- name: Install Linux dependencies
|
|
if: matrix.platform == 'linux'
|
|
env:
|
|
DEBIAN_FRONTEND: noninteractive
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step install_linux_deps
|
|
|
|
- name: Set up Rust toolchain (Unix)
|
|
if: matrix.platform != 'windows'
|
|
uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
|
|
with:
|
|
toolchain: "1.98.1"
|
|
targets: ${{ matrix.platform == 'macos' && 'aarch64-apple-darwin,x86_64-apple-darwin' || (matrix.arch == 'arm64' && 'aarch64-unknown-linux-gnu' || 'x86_64-unknown-linux-gnu') }}
|
|
|
|
- name: Install MSVC ARM64 build tools
|
|
if: matrix.platform == 'windows' && matrix.arch == 'arm64'
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step install_msvc_arm64_tools
|
|
|
|
- name: Set up MSVC env (Windows)
|
|
if: matrix.platform == 'windows'
|
|
uses: TheMrMilchmann/setup-msvc-dev@368ef7d1ee4d1171b31d4a7f67f4d954f903f5a9
|
|
with:
|
|
arch: ${{ matrix.arch == 'arm64' && 'amd64_arm64' || 'amd64' }}
|
|
|
|
- name: Set up Rust toolchain (Windows)
|
|
if: matrix.platform == 'windows'
|
|
env:
|
|
ARCH: ${{ matrix.arch }}
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step install_rust_windows_targets
|
|
|
|
- name: Install dependencies
|
|
working-directory: ${{ env.WORKDIR }}/fluxer_desktop
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step install_dependencies
|
|
|
|
- name: Update version
|
|
working-directory: ${{ env.WORKDIR }}/fluxer_desktop
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step update_version
|
|
|
|
- name: Set build channel
|
|
working-directory: ${{ env.WORKDIR }}/fluxer_desktop
|
|
env:
|
|
BUILD_CHANNEL: ${{ env.BUILD_CHANNEL }}
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step set_build_channel
|
|
|
|
- name: Download shared renderer artifact
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
|
|
with:
|
|
name: desktop-shared-${{ needs.meta.outputs.build_channel }}-${{ needs.meta.outputs.version }}-${{ needs.meta.outputs.source_sha }}
|
|
path: source/desktop-shared-assets
|
|
|
|
- name: Restore shared renderer assets
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step restore_shared_assets
|
|
|
|
- name: Build Electron main process
|
|
working-directory: ${{ env.WORKDIR }}/fluxer_desktop
|
|
env:
|
|
BUILD_CHANNEL: ${{ env.BUILD_CHANNEL }}
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step build_electron_main
|
|
|
|
- name: Set up .NET SDK (Windows)
|
|
if: matrix.platform == 'windows'
|
|
uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
|
|
with:
|
|
dotnet-version: "10.0.x"
|
|
|
|
- name: Install Velopack CLI
|
|
if: matrix.platform == 'windows'
|
|
working-directory: ${{ env.WORKDIR }}/fluxer_desktop
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step install_velopack_cli
|
|
|
|
- name: Build Electron app (macOS)
|
|
if: matrix.platform == 'macos'
|
|
working-directory: ${{ env.WORKDIR }}/fluxer_desktop
|
|
env:
|
|
BUILD_CHANNEL: ${{ env.BUILD_CHANNEL }}
|
|
CSC_LINK: ${{ secrets.APPLE_CERTIFICATE }}
|
|
CSC_KEY_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
|
|
APPLE_ID: ${{ secrets.APPLE_ID }}
|
|
APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
|
|
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step build_app_macos
|
|
|
|
- name: Verify macOS artifact (bundle ID + profile + signature)
|
|
if: matrix.platform == 'macos'
|
|
working-directory: ${{ env.WORKDIR }}/fluxer_desktop
|
|
env:
|
|
BUILD_CHANNEL: ${{ env.BUILD_CHANNEL }}
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step verify_bundle_id
|
|
|
|
- name: Build Electron app (Windows)
|
|
if: matrix.platform == 'windows'
|
|
working-directory: ${{ env.WORKDIR }}/fluxer_desktop
|
|
env:
|
|
BUILD_CHANNEL: ${{ env.BUILD_CHANNEL }}
|
|
TEMP: C:\t
|
|
TMP: C:\t
|
|
ELECTRON_BUILDER_CACHE: C:\ebcache
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step build_app_windows
|
|
|
|
- name: Validate Windows signing inputs
|
|
if: matrix.platform == 'windows'
|
|
env:
|
|
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
|
|
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
|
|
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
|
|
AZURE_ARTIFACT_SIGNING_ENDPOINT: ${{ secrets.AZURE_ARTIFACT_SIGNING_ENDPOINT }}
|
|
AZURE_ARTIFACT_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_ARTIFACT_SIGNING_ACCOUNT_NAME }}
|
|
AZURE_ARTIFACT_SIGNING_CERTIFICATE_PROFILE_NAME: ${{ secrets.AZURE_ARTIFACT_SIGNING_CERTIFICATE_PROFILE_NAME }}
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step validate_windows_signing_inputs
|
|
|
|
- name: Azure login for Artifact Signing
|
|
if: matrix.platform == 'windows'
|
|
uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906
|
|
with:
|
|
client-id: ${{ secrets.AZURE_CLIENT_ID }}
|
|
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
|
|
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
|
|
|
|
- name: Write Velopack Trusted Signing metadata
|
|
if: matrix.platform == 'windows'
|
|
env:
|
|
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
|
|
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
|
|
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
|
|
AZURE_ARTIFACT_SIGNING_ENDPOINT: ${{ secrets.AZURE_ARTIFACT_SIGNING_ENDPOINT }}
|
|
AZURE_ARTIFACT_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_ARTIFACT_SIGNING_ACCOUNT_NAME }}
|
|
AZURE_ARTIFACT_SIGNING_CERTIFICATE_PROFILE_NAME: ${{ secrets.AZURE_ARTIFACT_SIGNING_CERTIFICATE_PROFILE_NAME }}
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step write_windows_signing_metadata
|
|
|
|
- name: Resolve unpacked Windows app directory
|
|
id: resolve_unpacked
|
|
if: matrix.platform == 'windows'
|
|
working-directory: ${{ env.WORKDIR }}/fluxer_desktop
|
|
env:
|
|
BUILD_CHANNEL: ${{ env.BUILD_CHANNEL }}
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step resolve_windows_unpacked_dir
|
|
|
|
- name: Sign unpacked Windows binaries with Artifact Signing
|
|
if: matrix.platform == 'windows'
|
|
uses: azure/artifact-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82
|
|
with:
|
|
endpoint: ${{ secrets.AZURE_ARTIFACT_SIGNING_ENDPOINT }}
|
|
signing-account-name: ${{ secrets.AZURE_ARTIFACT_SIGNING_ACCOUNT_NAME }}
|
|
certificate-profile-name: ${{ secrets.AZURE_ARTIFACT_SIGNING_CERTIFICATE_PROFILE_NAME }}
|
|
files-folder: ${{ steps.resolve_unpacked.outputs.unpacked_dir }}
|
|
files-folder-filter: exe,dll,node
|
|
files-folder-recurse: true
|
|
file-digest: SHA256
|
|
timestamp-rfc3161: http://timestamp.acs.microsoft.com
|
|
timestamp-digest: SHA256
|
|
exclude-environment-credential: true
|
|
|
|
- name: Verify unpacked Windows signatures
|
|
if: matrix.platform == 'windows'
|
|
working-directory: ${{ env.WORKDIR }}/fluxer_desktop
|
|
env:
|
|
BUILD_CHANNEL: ${{ env.BUILD_CHANNEL }}
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step verify_windows_unpacked_signatures
|
|
|
|
- name: Verify the packaged shell starts and boots its bundled renderer (Windows)
|
|
if: matrix.platform == 'windows' && matrix.arch == 'x64'
|
|
working-directory: ${{ env.WORKDIR }}/fluxer_desktop
|
|
env:
|
|
BUILD_CHANNEL: ${{ env.BUILD_CHANNEL }}
|
|
BUILD_VERSION: ${{ env.VERSION }}
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step verify_bundled_renderer_windows
|
|
|
|
- name: Create portable ZIP (Windows)
|
|
if: matrix.platform == 'windows'
|
|
working-directory: ${{ env.WORKDIR }}/fluxer_desktop
|
|
env:
|
|
BUILD_CHANNEL: ${{ env.BUILD_CHANNEL }}
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step create_portable_zip_windows
|
|
|
|
- name: Package Windows app with Velopack
|
|
if: matrix.platform == 'windows'
|
|
working-directory: ${{ env.WORKDIR }}/fluxer_desktop
|
|
env:
|
|
BUILD_CHANNEL: ${{ env.BUILD_CHANNEL }}
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step package_app_windows_velopack
|
|
|
|
- name: Analyze Velopack nupkg for long paths
|
|
if: matrix.platform == 'windows'
|
|
working-directory: ${{ env.WORKDIR }}/fluxer_desktop
|
|
env:
|
|
BUILD_VERSION: ${{ env.VERSION }}
|
|
BUILD_CHANNEL: ${{ env.BUILD_CHANNEL }}
|
|
MAX_WINDOWS_PATH_LEN: 260
|
|
PATH_HEADROOM: 10
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step analyse_velopack_paths
|
|
|
|
- name: Build Electron app (Linux)
|
|
if: matrix.platform == 'linux'
|
|
working-directory: ${{ env.WORKDIR }}/fluxer_desktop
|
|
env:
|
|
BUILD_CHANNEL: ${{ env.BUILD_CHANNEL }}
|
|
USE_SYSTEM_FPM: true
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step build_app_linux
|
|
|
|
- name: Verify the packaged shell boots its bundled renderer (Linux)
|
|
if: matrix.platform == 'linux' && matrix.arch == 'x64'
|
|
working-directory: ${{ env.WORKDIR }}/fluxer_desktop
|
|
env:
|
|
BUILD_CHANNEL: ${{ env.BUILD_CHANNEL }}
|
|
BUILD_VERSION: ${{ env.VERSION }}
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step verify_bundled_renderer_linux
|
|
|
|
- name: Verify signed Windows artifacts
|
|
if: matrix.platform == 'windows'
|
|
working-directory: ${{ env.WORKDIR }}/fluxer_desktop
|
|
env:
|
|
BUILD_CHANNEL: ${{ env.BUILD_CHANNEL }}
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step verify_windows_signed_artifacts
|
|
|
|
- name: Prepare artifacts (Windows)
|
|
if: runner.os == 'Windows'
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step prepare_artifacts_windows
|
|
|
|
- name: Prepare artifacts (Unix)
|
|
if: runner.os != 'Windows'
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step prepare_artifacts_unix
|
|
|
|
- name: Build AppImage update feed (Linux)
|
|
if: matrix.platform == 'linux'
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step build_appimage_update_feed
|
|
|
|
- name: Normalize updater YAML (macOS)
|
|
if: matrix.platform == 'macos'
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step normalise_updater_yaml
|
|
|
|
- name: Generate SHA256 checksums (Unix)
|
|
if: runner.os != 'Windows'
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step generate_checksums_unix
|
|
|
|
- name: Generate SHA256 checksums (Windows)
|
|
if: runner.os == 'Windows'
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step generate_checksums_windows
|
|
|
|
- name: Stage build artifacts
|
|
id: handoff
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
|
|
--step stage_handoff
|
|
|
|
- name: Upload build artifacts
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
|
|
with:
|
|
name: ${{ steps.handoff.outputs.artifact_name }}
|
|
path: upload_staging
|
|
if-no-files-found: error
|
|
retention-days: 1
|
|
compression-level: 0
|
|
|
|
verify_windows_arm64:
|
|
name: Verify windows (arm64)
|
|
if: ${{ !cancelled() && needs.build.result == 'success' }}
|
|
needs:
|
|
- meta
|
|
- build
|
|
runs-on: windows-11-arm
|
|
timeout-minutes: 30
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
env:
|
|
CHANNEL: ${{ needs.meta.outputs.build_channel }}
|
|
VERSION: ${{ needs.meta.outputs.version }}
|
|
steps:
|
|
- name: Checkout source
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
|
|
with:
|
|
ref: ${{ needs.meta.outputs.source_sha }}
|
|
sparse-checkout: fluxer_desktop/scripts
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
|
|
with:
|
|
node-version: 24
|
|
|
|
- name: Download windows arm64 build artifacts
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
|
|
with:
|
|
path: artifacts
|
|
pattern: fluxer-desktop-${{ needs.meta.outputs.build_channel }}-windows-arm64*
|
|
|
|
- name: Verify the packaged shell starts and boots its bundled renderer
|
|
shell: pwsh
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$zip = Get-ChildItem -Path artifacts -Recurse -Filter "*-$env:VERSION-portable-win-arm64.zip" | Select-Object -First 1
|
|
if ($null -eq $zip) { Write-Host 'This build has no windows arm64 portable zip'; exit 0 }
|
|
$app = Join-Path $env:RUNNER_TEMP 'app'
|
|
Expand-Archive -Path $zip.FullName -DestinationPath $app
|
|
$exe = Get-ChildItem -Path $app -Recurse -Filter 'Fluxer*.exe' | Where-Object { $_.Name -notlike '*_ExecutionStub.exe' } | Select-Object -First 1
|
|
if ($null -eq $exe) { throw "$($zip.Name) holds no Fluxer executable" }
|
|
node fluxer_desktop/scripts/release-check.mjs --app $exe.DirectoryName --channel $env:CHANNEL --expect-renderer $env:VERSION --expect-source bundled --package-origin http://127.0.0.1:9 --app-arg=--disable-gpu --workdir (Join-Path $env:RUNNER_TEMP 'runs') --timeout-seconds 240
|
|
if ($LASTEXITCODE -ne 0) { throw "The windows arm64 build fails its release check" }
|
|
|
|
upload:
|
|
name: Assemble desktop release assets
|
|
if: ${{ !cancelled() && needs.build.result == 'success' && needs.verify_windows_arm64.result == 'success' }}
|
|
needs:
|
|
- meta
|
|
- shared_assets
|
|
- build
|
|
- verify_windows_arm64
|
|
runs-on: ubuntu-24.04-arm
|
|
environment: desktop-releases
|
|
timeout-minutes: 180
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
env:
|
|
CHANNEL: ${{ needs.meta.outputs.build_channel }}
|
|
DISPLAY_CHANNEL: ${{ needs.meta.outputs.channel }}
|
|
RELEASE_CHANNEL: ${{ needs.meta.outputs.build_channel }}
|
|
PUBLIC_RELEASE_CHANNEL: ${{ needs.meta.outputs.build_channel }}
|
|
VERSION: ${{ needs.meta.outputs.version }}
|
|
BUILD_VERSION: ${{ needs.meta.outputs.version }}
|
|
PUBLIC_BUILD_VERSION: ${{ needs.meta.outputs.version }}
|
|
PUB_DATE: ${{ needs.meta.outputs.pub_date }}
|
|
SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
|
|
PUBLIC_DL_BASE: https://api.fluxer.app/dl
|
|
steps:
|
|
- name: Checkout source
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
|
|
with:
|
|
ref: ${{ needs.meta.outputs.source_sha }}
|
|
|
|
- name: Set up Rust toolchain (CI helpers)
|
|
uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
|
|
with:
|
|
toolchain: "1.98.1"
|
|
|
|
- name: Download build artifacts
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
|
|
with:
|
|
path: artifacts
|
|
pattern: fluxer-desktop-${{ needs.meta.outputs.build_channel }}-*
|
|
|
|
- name: Build payload layout (+ manifest.json)
|
|
env:
|
|
VERSION: ${{ needs.meta.outputs.version }}
|
|
PUB_DATE: ${{ needs.meta.outputs.pub_date }}
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
|
|
--step build_payload
|
|
|
|
- name: Download desktop module packages
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
|
|
with:
|
|
name: desktop-modules-${{ needs.meta.outputs.build_channel }}-${{ needs.meta.outputs.version }}-${{ needs.meta.outputs.source_sha }}
|
|
path: desktop-modules
|
|
|
|
- name: Build desktop module manifest
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
|
|
--step build_module_manifest
|
|
|
|
- name: Prepare GitHub release assets
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
|
|
--step prepare_release_assets
|
|
|
|
- name: Upload GitHub release assets
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
|
|
with:
|
|
name: fluxer-desktop-release-assets
|
|
path: release_assets
|
|
if-no-files-found: error
|
|
retention-days: 1
|
|
compression-level: 0
|
|
|
|
- name: Build summary
|
|
run: >-
|
|
cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
|
|
--step build_summary
|
|
|
|
publish_release:
|
|
name: Publish GitHub desktop release
|
|
if: ${{ !cancelled() && needs.upload.result == 'success' }}
|
|
needs:
|
|
- meta
|
|
- upload
|
|
runs-on: ubuntu-24.04-arm
|
|
environment: desktop-releases
|
|
timeout-minutes: 60
|
|
permissions:
|
|
contents: write
|
|
env:
|
|
CHANNEL: ${{ needs.meta.outputs.build_channel }}
|
|
VERSION: ${{ needs.meta.outputs.version }}
|
|
steps:
|
|
- name: Checkout source
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
|
|
with:
|
|
ref: ${{ needs.meta.outputs.source_sha }}
|
|
|
|
- name: Set up Rust toolchain (CI helpers)
|
|
uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
|
|
with:
|
|
toolchain: "1.98.1"
|
|
|
|
- name: Download GitHub release assets
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
|
|
with:
|
|
name: fluxer-desktop-release-assets
|
|
path: release_assets
|
|
|
|
- name: Create token
|
|
id: create-token
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
|
|
with:
|
|
client-id: ${{ vars.FLUXER_CI_APP_ID }}
|
|
private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
|
|
owner: fluxerapp
|
|
repositories: fluxer
|
|
permission-contents: write
|
|
- name: Publish GitHub desktop release
|
|
env:
|
|
GH_TOKEN: ${{ steps.create-token.outputs.token }}
|
|
CHANNEL: ${{ needs.meta.outputs.build_channel }}
|
|
VERSION: ${{ needs.meta.outputs.version }}
|
|
SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
|
|
RELEASE_BASELINE_SHA: ${{ vars.RELEASE_BASELINE_SHA }}
|
|
run: |
|
|
set -euo pipefail
|
|
release_args=(
|
|
release publish
|
|
--component "fluxer-desktop-${CHANNEL}"
|
|
--build-version "${VERSION}"
|
|
--source-sha "${SOURCE_SHA}"
|
|
--previous-sha "${RELEASE_BASELINE_SHA}"
|
|
--asset-dir release_assets
|
|
)
|
|
if [[ "${CHANNEL}" == "canary" ]]; then
|
|
release_args+=(--prerelease)
|
|
fi
|
|
cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- "${release_args[@]}"
|