0.6.12 #45
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: 'Existing tag to (re-)release (e.g. v0.4.1)' | |
| required: true | |
| type: string | |
| permissions: | |
| contents: write # create/attach release assets | |
| id-token: write # OIDC for Sigstore-based provenance | |
| attestations: write # upload build attestations | |
| concurrency: | |
| # Allow concurrent releases for different refs, but never duplicate the same one. | |
| # Never cancel an in-progress release — partial publishes are worse than waiting. | |
| group: release-${{ github.event.inputs.tag || github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| release: | |
| strategy: | |
| fail-fast: false # let the other platform finish even if one fails | |
| matrix: | |
| include: | |
| - os: macos-latest | |
| platform: mac | |
| - os: ubuntu-latest | |
| platform: linux | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| submodules: recursive | |
| ref: ${{ github.event.inputs.tag || github.ref }} | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 20 | |
| cache: npm | |
| cache-dependency-path: | | |
| package-lock.json | |
| eca-webview/package-lock.json | |
| - name: Cache electron & electron-builder downloads | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| ~/.cache/electron | |
| ~/.cache/electron-builder | |
| key: ${{ runner.os }}-electron-${{ hashFiles('package-lock.json') }} | |
| restore-keys: | | |
| ${{ runner.os }}-electron- | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Lint | |
| run: npm run lint | |
| - name: Test | |
| run: npm test | |
| - name: Build | |
| run: npm run build | |
| - name: Package & Publish (macOS) | |
| if: matrix.platform == 'mac' | |
| shell: bash | |
| # Secrets are staged under *_RAW aliases via env: and only re-exported | |
| # under the real names when non-empty. This matters because an empty | |
| # CSC_LINK is NOT the same as an unset CSC_LINK — electron-builder | |
| # treats an empty CSC_LINK as a file path and fails with "not a file". | |
| # Only by leaving CSC_LINK truly unset does it skip signing cleanly. | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| CSC_LINK_RAW: ${{ secrets.CSC_LINK }} | |
| CSC_KEY_PASSWORD_RAW: ${{ secrets.CSC_KEY_PASSWORD }} | |
| APPLE_ID_RAW: ${{ secrets.APPLE_ID }} | |
| APPLE_APP_SPECIFIC_PASSWORD_RAW: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| APPLE_TEAM_ID_RAW: ${{ secrets.APPLE_TEAM_ID }} | |
| run: | | |
| if [[ -n "${CSC_LINK_RAW:-}" ]]; then | |
| echo "→ Apple signing identity present; building SIGNED (+ notarized if Apple* secrets set)" | |
| export CSC_LINK="$CSC_LINK_RAW" | |
| export CSC_KEY_PASSWORD="$CSC_KEY_PASSWORD_RAW" | |
| export APPLE_ID="$APPLE_ID_RAW" | |
| export APPLE_APP_SPECIFIC_PASSWORD="$APPLE_APP_SPECIFIC_PASSWORD_RAW" | |
| export APPLE_TEAM_ID="$APPLE_TEAM_ID_RAW" | |
| # Leave CSC_IDENTITY_AUTO_DISCOVERY unset → electron-builder default (true) | |
| else | |
| echo "→ No Apple signing identity; building UNSIGNED" | |
| export CSC_IDENTITY_AUTO_DISCOVERY=false | |
| fi | |
| npx electron-builder --mac --x64 --arm64 --publish always | |
| - name: Package & Publish (Linux) | |
| if: matrix.platform == 'linux' | |
| run: npx electron-builder --linux --x64 --arm64 --publish always | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: List produced artifacts | |
| shell: bash | |
| run: ls -la release/ | |
| - name: Attest build provenance | |
| uses: actions/attest-build-provenance@v4 | |
| with: | |
| subject-path: | | |
| release/*.dmg | |
| release/*.zip | |
| release/*.AppImage | |
| release/*.deb | |
| publish-release: | |
| needs: release | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Publish draft release | |
| run: gh release edit "${TAG}" --draft=false | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| TAG: ${{ github.event.inputs.tag || github.ref_name }} |