@@ -19,14 +19,17 @@ jobs:
1919 # which prevents the race.
2020 # max-parallel: 1
2121 matrix :
22+ # See https://github.com/SFARPak/dyad/issues/96
2223 os : [
2324 { name: "windows", image: "windows-latest" },
24- # See https://github.com/SFARPak/dyad/issues/96
2525 { name: "linux", image: "ubuntu-22.04" },
2626 { name: "macos-intel", image: "macos-13" },
2727 { name: "macos", image: "macos-latest" },
2828 ]
2929 runs-on : ${{ matrix.os.image }}
30+ # env:
31+ # CSC_LINK: ${{ secrets.CSC_LINK }}
32+ # CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
3033 steps :
3134 - name : Github checkout
3235 uses : actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -36,43 +39,48 @@ jobs:
3639 node-version : 20
3740 - name : Clean up
3841 run : |
39- if [ "$RUNNER_OS" == "Windows" ]; then
40- Remove-Item -Recurse -Force node_modules -ErrorAction SilentlyContinue
41- else
42- rm -rf node_modules || true
43- fi
44- npm cache clean --force || true
42+ rm -rf node_modules
43+ rm -f package-lock.json
44+ npm cache clean --force
4545 shell : bash
46- - run : npm ci
47- - name : add macos cert
46+ - run : npm install --include=optional
47+ - run : npm rebuild @rollup/rollup-linux-x64-gnu || true
48+ if : contains(matrix.os.name, 'linux')
49+ - run : npm rebuild @rollup/rollup-darwin-x64 || true
50+ if : contains(matrix.os.name, 'macos-intel')
51+ - run : npm rebuild @rollup/rollup-darwin-arm64 || true
4852 if : contains(matrix.os.name, 'macos')
49- env :
50- MACOS_CERT_P12 : ${{ secrets.MACOS_CERT_P12 }}
51- MACOS_CERT_PASSWORD : ${{ secrets.MACOS_CERT_PASSWORD }}
52- run : chmod +x tools/add-macos-cert.sh && . ./tools/add-macos-cert.sh
53- # Windows only
54- - name : Set up certificate
55- if : contains(matrix.os.name, 'windows')
56- run : |
57- echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12
58- shell : bash
59- - name : Set variables
60- if : contains(matrix.os.name, 'windows')
61- id : variables
62- run : |
63- echo "SM_HOST=${{ secrets.SM_HOST }}" >> "$GITHUB_ENV"
64- echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV"
65- echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
66- echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV"
67- shell : bash
68- - name : Code signing with Software Trust Manager
69- if : contains(matrix.os.name, 'windows')
70- 71- - name : Sync certificate (Windows)
53+ - run : npm rebuild @rollup/rollup-win32-x64-msvc || true
7254 if : contains(matrix.os.name, 'windows')
73- run : |
74- smctl windows certsync --keypair-alias=${{ secrets.DIGICERT_KEYPAIR_ALIAS }}
75- shell : bash
55+ # - name: add macos cert
56+ # if: contains(matrix.os.name, 'macos') && secrets.MACOS_CERT_P12
57+ # env:
58+ # MACOS_CERT_P12: ${{ secrets.MACOS_CERT_P12 }}
59+ # MACOS_CERT_PASSWORD: ${{ secrets.MACOS_CERT_PASSWORD }}
60+ # run: chmod +x tools/add-macos-cert.sh && . ./tools/add-macos-cert.sh
61+ # Windows only
62+ # - name: Set up certificate
63+ # if: contains(matrix.os.name, 'windows')
64+ # run: |
65+ # echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12
66+ # shell: bash
67+ # - name: Set variables
68+ # if: contains(matrix.os.name, 'windows')
69+ # id: variables
70+ # run: |
71+ # echo "SM_HOST=${{ secrets.SM_HOST }}" >> "$GITHUB_ENV"
72+ # echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV"
73+ # echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
74+ # echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV"
75+ # shell: bash
76+ # - name: Code signing with Software Trust Manager
77+ # if: contains(matrix.os.name, 'windows')
78+ # uses: digicert/[email protected] 79+ # - name: Sync certificate (Windows)
80+ # if: contains(matrix.os.name, 'windows')
81+ # run: |
82+ # smctl windows certsync --keypair-alias=${{ secrets.DIGICERT_KEYPAIR_ALIAS }}
83+ # shell: bash
7684 # Publish (all platforms)
7785 - name : Publish app
7886 env :
@@ -82,13 +90,59 @@ jobs:
8290 APPLE_TEAM_ID : ${{ secrets.APPLE_TEAM_ID }}
8391 APPLE_ID : ${{ secrets.APPLE_ID }}
8492 APPLE_PASSWORD : ${{ secrets.APPLE_PASSWORD }}
93+ # CSC_LINK: ${{ secrets.CSC_LINK }}
94+ # CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
8595 run : npm run publish
8696
8797 verify-assets :
8898 name : Verify Release Assets
8999 needs : build
90100 runs-on : ubuntu-latest
101+ permissions :
102+ contents : read
103+ packages : read
104+ actions : read
91105 steps :
106+ - name : Check token permissions
107+ run : |
108+ echo "🔐 Checking GITHUB_TOKEN permissions..."
109+ echo "📡 Making API call to: https://api.github.com/user"
110+
111+ # Capture full response for detailed logging
112+ RESPONSE=$(curl -s -w "\nHTTP_STATUS:%{http_code}\n" \
113+ -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
114+ -H "Accept: application/vnd.github.v3+json" \
115+ -H "User-Agent: dyad-release-workflow" \
116+ https://api.github.com/user)
117+
118+ # Extract status code
119+ HTTP_STATUS=$(echo "$RESPONSE" | grep "HTTP_STATUS:" | cut -d: -f2)
120+ JSON_RESPONSE=$(echo "$RESPONSE" | sed '/HTTP_STATUS:/d')
121+
122+ echo "📡 API Response Status: $HTTP_STATUS"
123+
124+ # Log token scopes and permissions from headers (if available)
125+ echo "🔑 Token scopes: $(curl -s -I \
126+ -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
127+ -H "Accept: application/vnd.github.v3+json" \
128+ https://api.github.com/user | grep -i "x-oauth-scopes:" | sed 's/.*: //' || echo "Not available")"
129+
130+ echo "📋 Accepted permissions: $(curl -s -I \
131+ -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
132+ -H "Accept: application/vnd.github.v3+json" \
133+ https://api.github.com/user | grep -i "x-accepted-github-permissions:" | sed 's/.*: //' || echo "Not available")"
134+
135+ if [ "$HTTP_STATUS" -eq 200 ]; then
136+ echo "✅ Token authentication successful"
137+ echo "👤 User data:"
138+ echo "$JSON_RESPONSE" | jq '.login // "Not available"'
139+ echo "📋 Permissions:"
140+ echo "$JSON_RESPONSE" | jq '.permissions // empty'
141+ else
142+ echo "❌ Token authentication failed with status: $HTTP_STATUS"
143+ echo "🔍 Response body: $JSON_RESPONSE"
144+ exit 1
145+ fi
92146 - name : Github checkout
93147 uses : actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
94148 - name : Use Node.js
0 commit comments