Release app #255
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # .github/workflows/release.yml | |
| # Need to write to repo contents to upload the app to GitHub Release | |
| # See: https://www.electronforge.io/config/publishers/github#authentication | |
| permissions: | |
| contents: write | |
| name: Release app | |
| on: | |
| workflow_dispatch: | |
| concurrency: | |
| group: release-app-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| prepare-release: | |
| name: Prepare Release Tag | |
| runs-on: ubuntu-latest | |
| outputs: | |
| tag: ${{ steps.prepare.outputs.tag }} | |
| version: ${{ steps.prepare.outputs.version }} | |
| release-state: ${{ steps.prepare.outputs.release_state }} | |
| steps: | |
| - name: Github checkout | |
| uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 | |
| - name: Use Node.js | |
| uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5 | |
| with: | |
| node-version: v24.13.1 | |
| package-manager-cache: false # Do NOT use GitHub Actions cache in release builds: https://adnanthekhan.com/2024/12/21/cacheract-the-monster-in-your-build-cache/ | |
| - name: Create or update unpublished release tag | |
| id: prepare | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: node scripts/prepare-release-tag.js prepare | |
| build: | |
| needs: prepare-release | |
| environment: release | |
| strategy: | |
| # Continue building other platforms even if one fails | |
| fail-fast: false | |
| matrix: | |
| os: | |
| - { name: "windows", image: "windows-2022" } | |
| # See https://github.com/dyad-sh/dyad/issues/96 | |
| - { name: "linux", image: "ubuntu-22.04" } | |
| - { name: "macos-intel", image: "macos-15-intel" } | |
| - { name: "macos", image: "macos-latest" } | |
| runs-on: ${{ matrix.os.image }} | |
| steps: | |
| - name: Github checkout | |
| uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 | |
| - name: Use Node.js | |
| uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5 | |
| with: | |
| node-version: v24.13.1 | |
| package-manager-cache: false # Do NOT use GitHub Actions cache in release builds: https://adnanthekhan.com/2024/12/21/cacheract-the-monster-in-your-build-cache/ | |
| - name: Install npm 11.8.0 | |
| run: npm install -g npm@11.8.0 | |
| - run: npm ci | |
| env: | |
| # Required for @vscode/ripgrep to download binaries without hitting GitHub API rate limits | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: add macos cert | |
| if: contains(matrix.os.name, 'macos') | |
| env: | |
| MACOS_CERT_P12: ${{ secrets.MACOS_CERT_P12 }} | |
| MACOS_CERT_PASSWORD: ${{ secrets.MACOS_CERT_PASSWORD }} | |
| run: chmod +x tools/add-macos-cert.sh && . ./tools/add-macos-cert.sh | |
| # Windows only | |
| - name: Install Azure Trusted Signing | |
| if: contains(matrix.os.name, 'windows') | |
| shell: powershell | |
| run: | | |
| # Install via NuGet instead of winget (winget is slow/unreliable in CI) | |
| $installDir = "$env:RUNNER_TEMP\TrustedSigning" | |
| nuget install Microsoft.Trusted.Signing.Client -Version 1.0.95 -OutputDirectory $installDir -Source https://api.nuget.org/v3/index.json | |
| $dllPath = Get-ChildItem -Path $installDir -Recurse -Filter "Azure.CodeSigning.Dlib.dll" | | |
| Where-Object { $_.FullName -match "x64" } | | |
| Select-Object -First 1 -ExpandProperty FullName | |
| if ($dllPath) { | |
| Write-Host "Found DLL at: $dllPath" | |
| "AZURE_CODE_SIGNING_DLIB=$dllPath" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8 | |
| } else { | |
| Write-Error "Could not find Azure.CodeSigning.Dlib.dll" | |
| exit 1 | |
| } | |
| - name: Find Windows 11 SDK SignTool | |
| if: contains(matrix.os.name, 'windows') | |
| shell: powershell | |
| run: | | |
| $sdkPath = "C:\Program Files (x86)\Windows Kits\10\bin" | |
| $signTool = Get-ChildItem -Path $sdkPath -Recurse -Filter "signtool.exe" | | |
| Where-Object { $_.FullName -match "\\x64\\" } | | |
| Sort-Object { [version]($_.FullName -replace '.*\\(\d+\.\d+\.\d+\.\d+)\\.*', '$1') } -Descending | | |
| Select-Object -First 1 | |
| if ($signTool) { | |
| Write-Host "Found SignTool at: $($signTool.FullName)" | |
| "SIGNTOOL_PATH=$($signTool.FullName)" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8 | |
| } else { | |
| Write-Error "Could not find x64 signtool.exe" | |
| exit 1 | |
| } | |
| - name: Create Azure signing metadata | |
| if: contains(matrix.os.name, 'windows') | |
| shell: pwsh | |
| run: | | |
| @' | |
| { | |
| "Endpoint": "https://eus.codesigning.azure.net/", | |
| "CodeSigningAccountName": "dyad", | |
| "CertificateProfileName": "dyad-tech" | |
| } | |
| '@ | Out-File -Encoding utf8 signing-metadata.json | |
| echo "AZURE_METADATA_JSON=$PWD\signing-metadata.json" >> $env:GITHUB_ENV | |
| # Build (dry-run) - does NOT publish | |
| - name: Build app (dry-run) | |
| uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2 | |
| with: | |
| timeout_minutes: 30 | |
| max_attempts: 3 | |
| command: npm run publish -- --dry-run | |
| env: | |
| DEBUG: "@electron/*,electron-forge:*,electron-osx-sign*,electron-notarize*,electron-windows-installer:main,electron-windows-sign" | |
| NODE_OPTIONS: "--max-old-space-size=4096" | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }} | |
| AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }} | |
| AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }} | |
| AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }} | |
| WINDOWS_SIGN: ${{ contains(matrix.os.name, 'windows') && 'true' || '' }} | |
| - name: Upload build artifacts | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 | |
| with: | |
| name: build-${{ matrix.os.name }} | |
| path: out/ | |
| retention-days: 1 | |
| publish: | |
| name: Publish Release | |
| needs: build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Github checkout | |
| uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 | |
| - name: Use Node.js | |
| uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5 | |
| with: | |
| node-version: v24.13.1 | |
| package-manager-cache: false # Do NOT use GitHub Actions cache in release builds: https://adnanthekhan.com/2024/12/21/cacheract-the-monster-in-your-build-cache/ | |
| - name: Install npm 11.8.0 | |
| run: npm install -g npm@11.8.0 | |
| - run: npm ci | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Download all build artifacts | |
| uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 | |
| with: | |
| path: out/ | |
| pattern: build-* | |
| merge-multiple: true | |
| - name: List artifacts | |
| run: ls -laR out/ | |
| - name: Publish from dry-run | |
| run: ./node_modules/.bin/electron-forge publish --from-dry-run | |
| env: | |
| DEBUG: "@electron/*,electron-forge:*" | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| verify-assets: | |
| name: Verify Release Assets | |
| needs: publish | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Github checkout | |
| uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 | |
| - name: Use Node.js | |
| uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5 | |
| with: | |
| node-version: v24.13.1 | |
| package-manager-cache: false # Do NOT use GitHub Actions cache in release builds: https://adnanthekhan.com/2024/12/21/cacheract-the-monster-in-your-build-cache/ | |
| - name: Verify release tag still points to this workflow commit | |
| run: node scripts/prepare-release-tag.js verify | |
| - name: Verify all release assets are uploaded | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: node scripts/verify-release-assets.js |