feat: release OpsXShell 2.1.0 native Tauri edition

2026-07-30 23:32:51 +08:00
1 parent e9a0d21758
commit a3dba0c6ed
@@ -0,0 +1,104 @@
+name: Tauri Release Builds
+
+permissions:
+  contents: read
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - 'tauri-v*'
+
+jobs:
+  bundle:
+    name: ${{ matrix.name }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: macos-arm64
+            os: macos-14
+            args: --target aarch64-apple-darwin
+          - name: windows-x64
+            os: windows-latest
+            args: ''
+    env:
+      REQUIRE_SIGNING: ${{ startsWith(github.ref, 'refs/tags/tauri-v') }}
+      APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+      APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+      APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+      APPLE_ID: ${{ secrets.APPLE_ID }}
+      APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+      WINDOWS_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_CERTIFICATE_BASE64 }}
+      WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.name == 'macos-arm64' && 'aarch64-apple-darwin' || '' }}
+
+      - run: npm ci
+
+      - name: Validate release signing configuration
+        shell: bash
+        run: node scripts/release-preflight.mjs ${{ runner.os == 'macOS' && 'macos' || 'windows' }}
+
+      - name: Import Windows signing certificate
+        if: runner.os == 'Windows' && env.WINDOWS_CERTIFICATE_BASE64 != ''
+        shell: pwsh
+        run: |
+          $pfxPath = Join-Path $env:RUNNER_TEMP 'opsxshell-signing.pfx'
+          [IO.File]::WriteAllBytes($pfxPath, [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE_BASE64))
+          $password = ConvertTo-SecureString $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force
+          $certificate = Import-PfxCertificate -FilePath $pfxPath -CertStoreLocation Cert:\CurrentUser\My -Password $password
+          $config = @{ bundle = @{ windows = @{
+            certificateThumbprint = $certificate.Thumbprint
+            digestAlgorithm = 'sha256'
+            timestampUrl = 'http://timestamp.digicert.com'
+          } } } | ConvertTo-Json -Depth 4
+          Set-Content -Path src-tauri/tauri.signing.conf.json -Value $config
+
+      - name: Import Apple Developer ID certificate
+        if: runner.os == 'macOS' && env.APPLE_CERTIFICATE != ''
+        uses: apple-actions/import-codesign-certs@v3
+        with:
+          p12-file-base64: ${{ env.APPLE_CERTIFICATE }}
+          p12-password: ${{ env.APPLE_CERTIFICATE_PASSWORD }}
+
+      - name: Configure Apple Developer ID signing
+        if: runner.os == 'macOS' && env.APPLE_CERTIFICATE != ''
+        shell: bash
+        run: |
+          node -e "require('fs').writeFileSync('src-tauri/tauri.signing.conf.json', JSON.stringify({ bundle: { macOS: { signingIdentity: process.env.APPLE_SIGNING_IDENTITY } } }))"
+
+      - name: Build native package
+        if: (runner.os != 'Windows' || env.WINDOWS_CERTIFICATE_BASE64 == '') && (runner.os != 'macOS' || env.APPLE_CERTIFICATE == '')
+        run: npm run build:tauri -- ${{ matrix.args }}
+
+      - name: Build signed Windows package
+        if: runner.os == 'Windows' && env.WINDOWS_CERTIFICATE_BASE64 != ''
+        run: npm run build:tauri -- --config src-tauri/tauri.signing.conf.json
+
+      - name: Build signed macOS package
+        if: runner.os == 'macOS' && env.APPLE_CERTIFICATE != ''
+        run: npm run build:tauri -- ${{ matrix.args }} --config src-tauri/tauri.signing.conf.json
+
+      - name: Verify native package
+        shell: bash
+        run: node scripts/verify-release.mjs ${{ runner.os == 'macOS' && 'macos' || 'windows' }}
+
+      - name: Upload package
+        uses: actions/upload-artifact@v4
+        with:
+          name: opsxshell-${{ matrix.name }}
+          path: |
+            src-tauri/target/${{ matrix.name == 'macos-arm64' && 'aarch64-apple-darwin/release/bundle/**' || 'release/bundle/**' }}
+          if-no-files-found: error