Release Build #13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Build | |
| on: | |
| workflow_dispatch: | |
| push: | |
| tags: | |
| - "v*" | |
| - "*.*.*" | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| jobs: | |
| build: | |
| name: Build (${{ matrix.platform }}) | |
| runs-on: ${{ matrix.os }} | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - os: macos-latest | |
| platform: macos | |
| bundles_base: app | |
| bundles_with_updater: app,updater | |
| artifact_name: Dr.SheetSplit-macos | |
| - os: windows-2022 | |
| platform: windows | |
| bundles_base: nsis | |
| bundles_with_updater: nsis,updater | |
| artifact_name: Dr.SheetSplit-windows | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Setup PNPM | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10 | |
| - name: Setup Node | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Setup Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Rust Cache | |
| uses: swatinem/rust-cache@v2 | |
| with: | |
| workspaces: src-tauri -> target | |
| - name: Setup Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| - name: Install Dependencies | |
| shell: bash | |
| run: pnpm install --frozen-lockfile | |
| - name: Prepare Bundled Python Runtime | |
| shell: bash | |
| run: python scripts/prepare_bundled_python.py --platform ${{ matrix.platform }} | |
| - name: Resolve Bundle Targets | |
| shell: bash | |
| env: | |
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| BUNDLES_BASE: ${{ matrix.bundles_base }} | |
| BUNDLES_WITH_UPDATER: ${{ matrix.bundles_with_updater }} | |
| run: | | |
| normalize_private_key() { | |
| local raw="$1" | |
| if [ -z "${raw}" ]; then | |
| return 1 | |
| fi | |
| if printf '%s' "${raw}" | grep -q '^untrusted comment:'; then | |
| printf '%s' "${raw}" | |
| return 0 | |
| fi | |
| local decoded | |
| decoded="$(printf '%s' "${raw}" | base64 --decode 2>/dev/null || true)" | |
| if printf '%s' "${decoded}" | grep -q '^untrusted comment:'; then | |
| printf '%s' "${decoded}" | |
| return 0 | |
| fi | |
| return 1 | |
| } | |
| normalized_key="$(normalize_private_key "${TAURI_SIGNING_PRIVATE_KEY}" || true)" | |
| if [[ "${GITHUB_REF:-}" == refs/tags/* ]] && { [ -z "${normalized_key}" ] || [ -z "${TAURI_SIGNING_PRIVATE_KEY_PASSWORD}" ]; }; then | |
| echo "::error::Tagged release requires updater signing secrets. Please set TAURI_SIGNING_PRIVATE_KEY and TAURI_SIGNING_PRIVATE_KEY_PASSWORD." | |
| exit 1 | |
| fi | |
| if [ -n "${normalized_key}" ] && [ -n "${TAURI_SIGNING_PRIVATE_KEY_PASSWORD}" ]; then | |
| echo "TAURI_BUNDLES=${BUNDLES_WITH_UPDATER}" >> "$GITHUB_ENV" | |
| echo "ENABLE_UPDATER=true" >> "$GITHUB_ENV" | |
| { | |
| echo "TAURI_SIGNING_PRIVATE_KEY_NORMALIZED<<EOF" | |
| printf '%s\n' "${normalized_key}" | |
| echo "EOF" | |
| } >> "$GITHUB_ENV" | |
| echo "Updater signing secrets detected. Building with updater artifacts." | |
| else | |
| echo "::warning::Updater signing secrets missing; building installers without updater artifacts." | |
| echo "TAURI_BUNDLES=${BUNDLES_BASE}" >> "$GITHUB_ENV" | |
| echo "ENABLE_UPDATER=false" >> "$GITHUB_ENV" | |
| fi | |
| - name: Build Tauri Bundles | |
| shell: bash | |
| env: | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| run: | | |
| CONFIG_PATH="src-tauri/tauri.conf.json" | |
| if [ "${ENABLE_UPDATER}" = "true" ]; then | |
| export TAURI_SIGNING_PRIVATE_KEY="${TAURI_SIGNING_PRIVATE_KEY_NORMALIZED}" | |
| else | |
| unset TAURI_SIGNING_PRIVATE_KEY | |
| unset TAURI_SIGNING_PRIVATE_KEY_PASSWORD | |
| python -c "import json, pathlib; source = pathlib.Path('src-tauri/tauri.conf.json'); target = pathlib.Path('src-tauri/tauri.conf.ci.json'); payload = json.loads(source.read_text(encoding='utf-8')); payload.setdefault('bundle', {})['createUpdaterArtifacts'] = False; target.write_text(json.dumps(payload, ensure_ascii=False, indent=2), encoding='utf-8'); print(f'generated {target} with createUpdaterArtifacts=false')" | |
| CONFIG_PATH="src-tauri/tauri.conf.ci.json" | |
| fi | |
| pnpm tauri build --config "${CONFIG_PATH}" --bundles "${TAURI_BUNDLES}" | |
| - name: Inspect Build Outputs | |
| if: always() | |
| shell: bash | |
| run: | | |
| echo "TAURI_BUNDLES=${TAURI_BUNDLES}" | |
| find src-tauri/target -maxdepth 6 -type d -name bundle -print || true | |
| find src-tauri/target -maxdepth 8 -type f \( -name "*.app" -o -name "*.dmg" -o -name "*.exe" -o -name "*.msi" -o -name "*.zip" -o -name "latest.json" \) -print || true | |
| - name: Upload Build Artifacts | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: ${{ matrix.artifact_name }} | |
| path: src-tauri/target/**/release/bundle/** | |
| if-no-files-found: error | |
| publish-release: | |
| name: Publish Release | |
| if: startsWith(github.ref, 'refs/tags/') | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Download Build Artifacts | |
| uses: actions/download-artifact@v6 | |
| with: | |
| path: artifacts | |
| - name: Collect Release Assets | |
| shell: bash | |
| run: | | |
| mkdir -p release-assets | |
| while IFS= read -r -d '' file; do | |
| cp "$file" release-assets/ | |
| done < <( | |
| find artifacts -type f \( \ | |
| -name "*.dmg" \ | |
| -o -name "*.app.tar.gz" \ | |
| -o -name "*.app.tar.gz.sig" \ | |
| -o -name "*-setup.exe" \ | |
| -o -name "*.msi" \ | |
| -o -name "*.zip" \ | |
| -o -name "*.sig" \ | |
| -o -name "latest.json" \ | |
| \) -print0 | |
| ) | |
| echo "Collected release assets:" | |
| ls -lah release-assets | |
| if [ ! -f "release-assets/latest.json" ]; then | |
| echo "::error::latest.json not found in build outputs. Updater release is incomplete." | |
| exit 1 | |
| fi | |
| - name: Create or Update GitHub Release | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| TAG_NAME="${GITHUB_REF#refs/tags/}" | |
| if gh release view "${TAG_NAME}" >/dev/null 2>&1; then | |
| gh release upload "${TAG_NAME}" release-assets/* --clobber | |
| else | |
| gh release create "${TAG_NAME}" release-assets/* \ | |
| --title "${TAG_NAME}" \ | |
| --notes "Automated release for ${TAG_NAME}" | |
| fi |