105 lines
4.0 KiB
YAML
105 lines
4.0 KiB
YAML
name: Tauri Release Builds
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
tags:
|
|
- 'tauri-v*'
|
|
|
|
jobs:
|
|
bundle:
|
|
name: ${{ matrix.name }}
|
|
runs-on: ${{ matrix.os }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- name: macos-arm64
|
|
os: macos-14
|
|
args: --target aarch64-apple-darwin
|
|
- name: windows-x64
|
|
os: windows-latest
|
|
args: ''
|
|
env:
|
|
REQUIRE_SIGNING: ${{ startsWith(github.ref, 'refs/tags/tauri-v') }}
|
|
APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
|
|
APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
|
|
APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
|
|
APPLE_ID: ${{ secrets.APPLE_ID }}
|
|
APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
|
|
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
WINDOWS_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_CERTIFICATE_BASE64 }}
|
|
WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
cache: npm
|
|
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
targets: ${{ matrix.name == 'macos-arm64' && 'aarch64-apple-darwin' || '' }}
|
|
|
|
- run: npm ci
|
|
|
|
- name: Validate release signing configuration
|
|
shell: bash
|
|
run: node scripts/release-preflight.mjs ${{ runner.os == 'macOS' && 'macos' || 'windows' }}
|
|
|
|
- name: Import Windows signing certificate
|
|
if: runner.os == 'Windows' && env.WINDOWS_CERTIFICATE_BASE64 != ''
|
|
shell: pwsh
|
|
run: |
|
|
$pfxPath = Join-Path $env:RUNNER_TEMP 'opsxshell-signing.pfx'
|
|
[IO.File]::WriteAllBytes($pfxPath, [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE_BASE64))
|
|
$password = ConvertTo-SecureString $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force
|
|
$certificate = Import-PfxCertificate -FilePath $pfxPath -CertStoreLocation Cert:\CurrentUser\My -Password $password
|
|
$config = @{ bundle = @{ windows = @{
|
|
certificateThumbprint = $certificate.Thumbprint
|
|
digestAlgorithm = 'sha256'
|
|
timestampUrl = 'http://timestamp.digicert.com'
|
|
} } } | ConvertTo-Json -Depth 4
|
|
Set-Content -Path src-tauri/tauri.signing.conf.json -Value $config
|
|
|
|
- name: Import Apple Developer ID certificate
|
|
if: runner.os == 'macOS' && env.APPLE_CERTIFICATE != ''
|
|
uses: apple-actions/import-codesign-certs@v3
|
|
with:
|
|
p12-file-base64: ${{ env.APPLE_CERTIFICATE }}
|
|
p12-password: ${{ env.APPLE_CERTIFICATE_PASSWORD }}
|
|
|
|
- name: Configure Apple Developer ID signing
|
|
if: runner.os == 'macOS' && env.APPLE_CERTIFICATE != ''
|
|
shell: bash
|
|
run: |
|
|
node -e "require('fs').writeFileSync('src-tauri/tauri.signing.conf.json', JSON.stringify({ bundle: { macOS: { signingIdentity: process.env.APPLE_SIGNING_IDENTITY } } }))"
|
|
|
|
- name: Build native package
|
|
if: (runner.os != 'Windows' || env.WINDOWS_CERTIFICATE_BASE64 == '') && (runner.os != 'macOS' || env.APPLE_CERTIFICATE == '')
|
|
run: npm run build:tauri -- ${{ matrix.args }}
|
|
|
|
- name: Build signed Windows package
|
|
if: runner.os == 'Windows' && env.WINDOWS_CERTIFICATE_BASE64 != ''
|
|
run: npm run build:tauri -- --config src-tauri/tauri.signing.conf.json
|
|
|
|
- name: Build signed macOS package
|
|
if: runner.os == 'macOS' && env.APPLE_CERTIFICATE != ''
|
|
run: npm run build:tauri -- ${{ matrix.args }} --config src-tauri/tauri.signing.conf.json
|
|
|
|
- name: Verify native package
|
|
shell: bash
|
|
run: node scripts/verify-release.mjs ${{ runner.os == 'macOS' && 'macos' || 'windows' }}
|
|
|
|
- name: Upload package
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: opsxshell-${{ matrix.name }}
|
|
path: |
|
|
src-tauri/target/${{ matrix.name == 'macos-arm64' && 'aarch64-apple-darwin/release/bundle/**' || 'release/bundle/**' }}
|
|
if-no-files-found: error
|