Merge branch 'develop' into renovate/apple-actions-import-codesign-certs-5.x

Author: eliandoran

.dockerignore

@@ -34,6 +34,7 @@ npm-debug.log
 
 # exceptions
 !/bin/copy-dist.ts
+!/bin/electron-forge/sign-windows.cjs
 
 # temporary exception to make copy-dist inside Docker build not fail
 # TriliumNextTODO: make copy-dist *not* requiring to copy this file for builds other than electron-forge

.github/actions/build-electron/action.yml

@@ -8,8 +8,11 @@ inputs:
   arch:
     description: "The architecture to build for: x64, arm64"
     required: true
-  extension:
-    description: "Platform specific extensions to copy in the output: dmg, deb, rpm, exe, zip"
+  shell:
+    description: "Which shell to use"
+    required: true
+  forge_platform:
+    description: "The --platform to pass to Electron Forge"
     required: true
 
 runs:
@@ -38,21 +41,21 @@ runs:
 
     - name: Verify certificates
       if: inputs.os == 'macos'
-      shell: bash
+      shell: ${{ inputs.shell }}
       run: |
         echo "Available signing identities:"
         security find-identity -v -p codesigning build.keychain
 
     - name: Set up Python and other macOS dependencies
       if: ${{ inputs.os == 'macos' }}
-      shell: bash
+      shell: ${{ inputs.shell }}
       run: |
         brew install python-setuptools
         brew install create-dmg
 
     - name: Install dependencies for RPM and Flatpak package building
       if: ${{ inputs.os == 'linux' }}
-      shell: bash
+      shell: ${{ inputs.shell }}
       run: |
         sudo apt-get update && sudo apt-get install rpm flatpak-builder elfutils
         flatpak remote-add --user --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
@@ -62,39 +65,32 @@ runs:
 
     # Build setup
     - name: Install dependencies
-      shell: bash
+      shell: ${{ inputs.shell }}
       run: npm ci
 
     - name: Update build info
-      shell: bash
+      shell: ${{ inputs.shell }}
       run: npm run chore:update-build-info
 
     # Critical debugging configuration
     - name: Run electron-forge build with enhanced logging
-      shell: bash
+      shell: ${{ inputs.shell }}
       env:
         # Pass through required environment variables for signing and notarization
         APPLE_TEAM_ID: ${{ env.APPLE_TEAM_ID }}
         APPLE_ID: ${{ env.APPLE_ID }}
         APPLE_ID_PASSWORD: ${{ env.APPLE_ID_PASSWORD }}
+        WINDOWS_SIGN_EXECUTABLE: ${{ env.WINDOWS_SIGN_EXECUTABLE }}
+        TRILIUM_ARTIFACT_NAME_HINT: TriliumNextNotes ${{ inputs.os }} ${{ inputs.arch }}
       run: |
-        # Map OS names to Electron Forge platform names
-        if [ "${{ inputs.os }}" = "macos" ]; then
-          PLATFORM="darwin"
-        elif [ "${{ inputs.os }}" = "windows" ]; then
-          PLATFORM="win32"
-        else
-          PLATFORM="${{ inputs.os }}"
-        fi
-
         npm run electron-forge:make -- \
           --arch=${{ inputs.arch }} \
-          --platform=$PLATFORM
+          --platform=${{ inputs.forge_platform }}
 
     # Add DMG signing step
     - name: Sign DMG
       if: inputs.os == 'macos'
-      shell: bash
+      shell: ${{ inputs.shell }}
       run: |
         echo "Signing DMG file..."
         dmg_file=$(find ./dist -name "*.dmg" -print -quit)
@@ -119,7 +115,7 @@ runs:
 
     - name: Verify code signing
       if: inputs.os == 'macos'
-      shell: bash
+      shell: ${{ inputs.shell }}
       run: |
         echo "Verifying code signing for all artifacts..."
 
@@ -165,49 +161,3 @@ runs:
           echo "Found ZIP: $zip_file"
           echo "Note: ZIP files are not code signed, but their contents should be"
         fi
-
-    - name: Prepare artifacts
-      shell: bash
-      run: |
-        mkdir -p upload
-
-        if [ "${{ inputs.os }}" = "macos" ]; then
-          # For macOS, we need to look in specific directories based on the maker
-          echo "Collecting macOS artifacts..."
-
-          # Look for DMG files recursively
-          echo "Looking for DMG files..."
-          dmg_file=$(find ./dist -name "*.dmg" -print -quit)
-          if [ -n "$dmg_file" ]; then
-            echo "Found DMG: $dmg_file"
-            cp "$dmg_file" "upload/TriliumNextNotes-${{ github.ref_name }}-macos-${{ inputs.arch }}.dmg"
-          else
-            echo "Warning: No DMG file found"
-          fi
-
-          # Look for ZIP files recursively
-          echo "Looking for ZIP files..."
-          zip_file=$(find ./dist -name "*.zip" -print -quit)
-          if [ -n "$zip_file" ]; then
-            echo "Found ZIP: $zip_file"
-            cp "$zip_file" "upload/TriliumNextNotes-${{ github.ref_name }}-macos-${{ inputs.arch }}.zip"
-          else
-            echo "Warning: No ZIP file found"
-          fi
-        else
-          # For other platforms, use the existing logic but with better error handling
-          echo "Collecting artifacts for ${{ inputs.os }}..."
-          for ext in ${{ inputs.extension }}; do
-            echo "Looking for .$ext files..."
-            file=$(find ./dist -name "*.$ext" -print -quit)
-            if [ -n "$file" ]; then
-              echo "Found $file for extension $ext"
-              cp "$file" "upload/TriliumNextNotes-${{ github.ref_name }}-${{ inputs.os }}-${{ inputs.arch }}.$ext"
-            else
-              echo "Warning: No file found with extension .$ext"
-            fi
-          done
-        fi
-
-        echo "Final contents of upload directory:"
-        ls -la upload/

.github/actions/build-server/action.yml

@@ -11,7 +11,7 @@ runs:
     - name: Set up node & dependencies
       uses: actions/setup-node@v4
       with:
-        node-version: 20
+        node-version: 22
         cache: "npm"
     - name: Install dependencies
       shell: bash

.github/workflows/dev.yml

@@ -26,7 +26,7 @@ jobs:
       - name: Set up node & dependencies
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
           cache: "npm"
 
       - run: npm ci

.github/workflows/main-docker.yml

@@ -45,7 +45,7 @@ jobs:
       - name: Set up node & dependencies
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
           cache: "npm"
 
       - name: Install npm dependencies

.github/workflows/main.yml

@@ -5,6 +5,9 @@ on:
     - cron: "0 2 * * *" # run at 2 AM UTC
   # This can be used to allow manually triggering nightlies from the web interface
   workflow_dispatch:
+  push:
+    branches:
+      - renovate/electron-forge*
   pull_request:
     paths:
       - .github/actions/build-electron/*
@@ -23,22 +26,24 @@ jobs:
         os:
           - name: macos
             image: macos-latest
-            extension: [dmg, zip]
+            shell: bash
+            forge_platform: darwin
           - name: linux
             image: ubuntu-latest
-            extension: [deb, rpm, zip, flatpak]
+            shell: bash
+            forge_platform: linux
           - name: windows
-            image: windows-latest
-            extension: [exe, zip]
+            image: win-signing
+            shell: cmd
+            forge_platform: win32
     runs-on: ${{ matrix.os.image }}
     steps:
       - uses: actions/checkout@v4
       - name: Set up node & dependencies
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
       - name: Install dependencies
-        shell: bash
         run: npm ci
       - name: Update nightly version
         run: npm run chore:ci-update-nightly-version
@@ -47,7 +52,8 @@ jobs:
         with:
           os: ${{ matrix.os.name }}
           arch: ${{ matrix.arch }}
-          extension: ${{ join(matrix.os.extension, ' ') }}
+          shell: ${{ matrix.os.shell }}
+          forge_platform: ${{ matrix.os.forge_platform }}
         env:
           APPLE_APP_CERTIFICATE_BASE64: ${{ secrets.APPLE_APP_CERTIFICATE_BASE64 }}
           APPLE_APP_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_APP_CERTIFICATE_PASSWORD }}
@@ -56,6 +62,7 @@ jobs:
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
+          WINDOWS_SIGN_EXECUTABLE: ${{ vars.WINDOWS_SIGN_EXECUTABLE }}
 
       - name: Publish release
         uses: softprops/action-gh-release@v2
@@ -69,35 +76,9 @@ jobs:
           tag_name: nightly
           name: Nightly Build
 
-  nightly-server:
-    name: Deploy server nightly
-    strategy:
-      fail-fast: false
-      matrix:
-        arch: [x64, arm64]
-        include:
-          - arch: x64
-            runs-on: ubuntu-latest
-          - arch: arm64
-            runs-on: ubuntu-24.04-arm
-    runs-on: ${{ matrix.runs-on }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Run the build
-        uses: ./.github/actions/build-server
+      - name: Publish artifacts
+        uses: actions/upload-artifact@v4
+        if: ${{ github.event_name == 'pull_request' }}
         with:
-          os: linux
-          arch: ${{ matrix.arch }}
-
-      - name: Publish release
-        uses: softprops/action-gh-release@v2
-        if: ${{ github.event_name != 'pull_request' }}
-        with:
-          make_latest: false
-          prerelease: true
-          draft: false
-          fail_on_unmatched_files: true
-          files: upload/*.*
-          tag_name: nightly
-          name: Nightly Build
+          name: TriliumNextNotes ${{ matrix.os.name }} ${{ matrix.arch }}
+          path: upload