395 lines
16 KiB
YAML
395 lines
16 KiB
YAML
name: OneClient Release Build
|
|
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
CARGO_PACKAGER_SIGN_PRIVATE_KEY: ${{ secrets.CARGO_PACKAGER_SIGN_PRIVATE_KEY }}
|
|
CARGO_PACKAGER_SIGN_PRIVATE_KEY_PASSWORD: ${{ secrets.CARGO_PACKAGER_SIGN_PRIVATE_KEY_PASSWORD }}
|
|
|
|
jobs:
|
|
prepare:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
outputs:
|
|
version: ${{ steps.version.outputs.version }}
|
|
tag: ${{ steps.version.outputs.tag }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Resolve version from Cargo.toml
|
|
id: version
|
|
shell: bash
|
|
run: |
|
|
VERSION=$(grep -m1 '^version' Cargo.toml | sed -E 's/.*"([^"]+)".*/\1/')
|
|
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
|
|
echo "tag=oneclient-$VERSION" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Create/ensure draft release
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
TAG: ${{ steps.version.outputs.tag }}
|
|
VERSION: ${{ steps.version.outputs.version }}
|
|
run: |
|
|
if ! gh release view "$TAG" >/dev/null 2>&1; then
|
|
gh release create "$TAG" \
|
|
--draft \
|
|
--title "OneClient $VERSION" \
|
|
--notes "Automated release for OneClient $VERSION."
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
package:
|
|
needs: prepare
|
|
permissions:
|
|
contents: write
|
|
# Required so SignPath can download the uploaded build artifact.
|
|
actions: read
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- platform: macos-latest
|
|
target: aarch64-apple-darwin
|
|
os_key: darwin
|
|
arch: aarch64
|
|
formats: app,dmg
|
|
- platform: macos-latest
|
|
target: x86_64-apple-darwin
|
|
os_key: darwin
|
|
arch: x86_64
|
|
formats: app,dmg
|
|
macos_deployment_target: '10.14'
|
|
- platform: ubuntu-22.04
|
|
target: ''
|
|
os_key: linux
|
|
arch: x86_64
|
|
formats: deb,appimage
|
|
- platform: windows-latest
|
|
target: ''
|
|
os_key: windows
|
|
arch: x86_64
|
|
formats: nsis
|
|
|
|
runs-on: ${{ matrix.platform }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: (macOS) Pin deployment target
|
|
if: matrix.macos_deployment_target != ''
|
|
shell: bash
|
|
run: echo "MACOSX_DEPLOYMENT_TARGET=${{ matrix.macos_deployment_target }}" >> "$GITHUB_ENV"
|
|
|
|
- name: Setup Rust
|
|
uses: ./.github/actions/setup-rust
|
|
with:
|
|
target: ${{ matrix.target }}
|
|
save-cache: true
|
|
restore-cache: true
|
|
|
|
- name: (Linux) Install system dependencies
|
|
if: matrix.platform == 'ubuntu-22.04'
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y --no-install-recommends \
|
|
build-essential cmake pkg-config clang python3 \
|
|
libfontconfig-dev libfreetype-dev \
|
|
libgl1-mesa-dev libx11-dev libxcursor-dev libxi-dev libxrandr-dev \
|
|
libxkbcommon-dev libxkbcommon-x11-dev libwayland-dev libdbus-1-dev \
|
|
libfuse2
|
|
|
|
- name: Install cargo-packager
|
|
shell: bash
|
|
run: cargo install cargo-packager --version 0.11.8 --locked
|
|
|
|
- name: Import Apple Developer certificate
|
|
if: startsWith(matrix.platform, 'macos')
|
|
env:
|
|
APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
|
|
APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
|
|
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
|
|
run: |
|
|
echo "$APPLE_CERTIFICATE" | base64 --decode > certificate.p12
|
|
security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
|
|
security default-keychain -s build.keychain
|
|
security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
|
|
security set-keychain-settings -t 3600 -u build.keychain
|
|
security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
|
|
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
|
|
CERT_ID=$(security find-identity -v -p codesigning build.keychain | awk -F'"' '/Developer ID Application/ {print $2; exit}')
|
|
if [ -z "$CERT_ID" ]; then
|
|
echo "::error::No Developer ID Application certificate found in keychain."
|
|
exit 1
|
|
fi
|
|
echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> "$GITHUB_ENV"
|
|
# cargo-packager only codesigns when `signing-identity` is present in the
|
|
# packager config; it does NOT read APPLE_SIGNING_IDENTITY. Inject it into
|
|
# the macOS metadata so signing + notarization actually run.
|
|
CERT_ID="$CERT_ID" python3 - <<'PY'
|
|
import os, re
|
|
p = "packages/oneclient_app/Cargo.toml"
|
|
s = open(p).read()
|
|
ident = os.environ["CERT_ID"]
|
|
hdr = "[package.metadata.packager.macos]"
|
|
assert hdr in s, "macos packager section not found"
|
|
if "signing-identity" not in s:
|
|
s = s.replace(hdr, f'{hdr}\nsigning-identity = "{ident}"', 1)
|
|
open(p, "w").write(s)
|
|
print(f"signing-identity set to: {ident}")
|
|
PY
|
|
|
|
- name: Build release binary
|
|
shell: bash
|
|
run: |
|
|
if [ -n "${{ matrix.target }}" ]; then
|
|
cargo build --release --bin oneclient_app --target ${{ matrix.target }}
|
|
else
|
|
cargo build --release --bin oneclient_app
|
|
fi
|
|
|
|
- name: (macOS) Verify deployment target
|
|
if: matrix.macos_deployment_target != ''
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
bin="target/${{ matrix.target }}/release/oneclient_app"
|
|
minos="$(vtool -show-build "$bin" | awk '/minos/ {print $2; exit}')"
|
|
echo "linked minos=$minos, declared minimum=${{ matrix.macos_deployment_target }}"
|
|
if [ "$(printf '%s\n%s\n' "$minos" "${{ matrix.macos_deployment_target }}" | sort -V | tail -n1)" != "${{ matrix.macos_deployment_target }}" ]; then
|
|
echo "::error::Binary requires macOS $minos but the bundle advertises ${{ matrix.macos_deployment_target }}."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Package
|
|
shell: bash
|
|
env:
|
|
APPLE_ID: ${{ secrets.APPLE_ID }}
|
|
APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
|
|
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
CI: ${{ startsWith(matrix.platform, 'macos') && 'false' || 'true' }}
|
|
run: |
|
|
ARGS="--release --formats ${{ matrix.formats }}"
|
|
if [ -n "${{ matrix.target }}" ]; then
|
|
ARGS="$ARGS --target ${{ matrix.target }}"
|
|
fi
|
|
cargo packager $ARGS --verbose
|
|
|
|
- name: Resolve packager output dir
|
|
id: outdir
|
|
shell: bash
|
|
run: |
|
|
if [ -n "${{ matrix.target }}" ]; then
|
|
echo "dir=target/${{ matrix.target }}/release" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "dir=target/release" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: (Linux) Build RPM
|
|
if: matrix.platform == 'ubuntu-22.04'
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
cargo install cargo-generate-rpm --version 0.21.0 --locked
|
|
cargo generate-rpm -p packages/oneclient_app
|
|
cp target/generate-rpm/*.rpm "${{ steps.outdir.outputs.dir }}/"
|
|
|
|
# Upload debug info (dSYM / .dwp / .pdb produced by the release profile's
|
|
# split-debuginfo) to Sentry so crash reports get real file/function/line
|
|
# stack traces instead of raw addresses. Skips silently unless the repo has
|
|
# a SENTRY_AUTH_TOKEN secret plus SENTRY_ORG / SENTRY_PROJECT variables.
|
|
- name: Upload debug symbols to Sentry
|
|
shell: bash
|
|
env:
|
|
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
|
|
SENTRY_ORG: ${{ vars.SENTRY_ORG }}
|
|
SENTRY_PROJECT: ${{ vars.SENTRY_PROJECT }}
|
|
OUT_DIR: ${{ steps.outdir.outputs.dir }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${SENTRY_AUTH_TOKEN:-}" ] || [ -z "${SENTRY_ORG:-}" ] || [ -z "${SENTRY_PROJECT:-}" ]; then
|
|
echo "Sentry credentials not configured (need SENTRY_AUTH_TOKEN secret + SENTRY_ORG/SENTRY_PROJECT vars); skipping debug-symbol upload."
|
|
exit 0
|
|
fi
|
|
curl -sL https://sentry.io/get-cli/ | bash
|
|
export PATH="/usr/local/bin:$PATH"
|
|
SYMS="$(mktemp -d)"
|
|
shopt -s nullglob
|
|
for f in "$OUT_DIR"/oneclient_app "$OUT_DIR"/oneclient_app.exe \
|
|
"$OUT_DIR"/oneclient_app.pdb "$OUT_DIR"/*.dwp "$OUT_DIR"/*.dSYM; do
|
|
[ -e "$f" ] || continue
|
|
cp -R "$f" "$SYMS/"
|
|
done
|
|
sentry-cli debug-files upload --include-sources "$SYMS"
|
|
|
|
- name: (Windows) Locate installer
|
|
if: matrix.platform == 'windows-latest'
|
|
id: win_installer
|
|
shell: bash
|
|
run: echo "path=$(ls ${{ steps.outdir.outputs.dir }}/*-setup.exe | head -n1)" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: (Windows) Upload unsigned installer artifact
|
|
if: matrix.platform == 'windows-latest'
|
|
id: win_upload_unsigned
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: oneclient-windows-installer-unsigned
|
|
path: ${{ steps.win_installer.outputs.path }}
|
|
|
|
- name: (Windows) Submit SignPath signing request
|
|
if: matrix.platform == 'windows-latest'
|
|
uses: signpath/github-action-submit-signing-request@v1
|
|
with:
|
|
api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
|
|
organization-id: ${{ secrets.SIGNPATH_ORGANIZATION_ID }}
|
|
project-slug: onelauncher
|
|
signing-policy-slug: release-signing
|
|
artifact-configuration-slug: onelauncher-installer
|
|
github-artifact-id: ${{ steps.win_upload_unsigned.outputs.artifact-id }}
|
|
wait-for-completion: true
|
|
output-artifact-directory: signed
|
|
|
|
- name: (Windows) Replace installer with signed one + recompute updater sig
|
|
if: matrix.platform == 'windows-latest'
|
|
shell: bash
|
|
run: |
|
|
signed="$(ls signed/*-setup.exe | head -n1)"
|
|
# Overwrite the unsigned installer in the packager out dir with the signed exe.
|
|
cp "$signed" "${{ steps.win_installer.outputs.path }}"
|
|
# Recompute the updater signature over the SIGNED exe.
|
|
cargo packager signer sign \
|
|
--private-key "$CARGO_PACKAGER_SIGN_PRIVATE_KEY" \
|
|
--password "$CARGO_PACKAGER_SIGN_PRIVATE_KEY_PASSWORD" \
|
|
"${{ steps.win_installer.outputs.path }}"
|
|
|
|
- name: Upload installers and build manifest fragment
|
|
shell: bash
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
TAG: ${{ needs.prepare.outputs.tag }}
|
|
OUT_DIR: ${{ steps.outdir.outputs.dir }}
|
|
OS_KEY: ${{ matrix.os_key }}
|
|
ARCH: ${{ matrix.arch }}
|
|
VERSION: ${{ needs.prepare.outputs.version }}
|
|
run: |
|
|
set -euo pipefail
|
|
shopt -s nullglob
|
|
|
|
# Identify the single updater artifact for this platform (the file with a
|
|
# sibling .sig): -setup.exe (nsis), *.app.tar.gz (app), *.AppImage (appimage).
|
|
# NOTE: nullglob is on, so an unmatched glob expands to nothing. Use arrays
|
|
# rather than `ls <glob> | head` — the latter falls back to listing the cwd
|
|
# when nothing matches, silently picking an unrelated file.
|
|
fmt=""; ext=""; matches=()
|
|
case "$OS_KEY" in
|
|
windows) matches=("$OUT_DIR"/*-setup.exe); fmt="nsis"; ext="exe" ;;
|
|
darwin) matches=("$OUT_DIR"/*.app.tar.gz); fmt="app"; ext="app.tar.gz" ;;
|
|
linux) matches=("$OUT_DIR"/*.AppImage); fmt="appimage"; ext="AppImage" ;;
|
|
esac
|
|
updater_file="${matches[0]:-}"
|
|
if [ -z "$updater_file" ]; then
|
|
echo "::error::No updater artifact found in $OUT_DIR for $OS_KEY"
|
|
exit 1
|
|
fi
|
|
|
|
# The updater bundle isn't always arch-tagged by cargo-packager, so the two
|
|
# macOS legs would collide on the release. Rename the updater artifact + its .sig
|
|
# to an arch-unique name before upload, and point the manifest at that name.
|
|
unique="OneClient_${VERSION}_${OS_KEY}_${ARCH}.${ext}"
|
|
cp "$updater_file" "$OUT_DIR/$unique"
|
|
cp "$updater_file.sig" "$OUT_DIR/$unique.sig"
|
|
|
|
# cargo-packager names the .deb after the binary (oneclient_app_<ver>_amd64.deb).
|
|
# Rename it to the same OneClient_<ver>_<os>_<arch> scheme as the other assets so
|
|
# the AUR oneclient-bin package can point at a stable, predictable URL.
|
|
deb_unique=""
|
|
deb_matches=("$OUT_DIR"/*.deb)
|
|
if [ -e "${deb_matches[0]:-}" ]; then
|
|
deb_unique="OneClient_${VERSION}_${OS_KEY}_${ARCH}.deb"
|
|
cp "${deb_matches[0]}" "$OUT_DIR/$deb_unique"
|
|
fi
|
|
|
|
# Same treatment for the .rpm (cargo-generate-rpm names it
|
|
# oneclient_app-<ver>-1.x86_64.rpm).
|
|
rpm_unique=""
|
|
rpm_matches=("$OUT_DIR"/*.rpm)
|
|
if [ -e "${rpm_matches[0]:-}" ]; then
|
|
rpm_unique="OneClient_${VERSION}_${OS_KEY}_${ARCH}.rpm"
|
|
cp "${rpm_matches[0]}" "$OUT_DIR/$rpm_unique"
|
|
fi
|
|
|
|
# Upload human-facing installers (dmg/renamed deb/renamed rpm/AppImage/signed exe) +
|
|
# the renamed updater bundle and its .sig. Skip the un-renamed updater bundle to avoid clashes.
|
|
for f in "$OUT_DIR"/*.dmg ${deb_unique:+"$OUT_DIR/$deb_unique"} ${rpm_unique:+"$OUT_DIR/$rpm_unique"} "$OUT_DIR"/*.AppImage "$OUT_DIR"/*-setup.exe "$OUT_DIR/$unique" "$OUT_DIR/$unique.sig"; do
|
|
[ -e "$f" ] || continue
|
|
gh release upload "$TAG" "$f" --clobber
|
|
done
|
|
|
|
base="$unique"
|
|
mkdir -p fragments
|
|
case "$OS_KEY" in
|
|
darwin) KEYS="darwin-${ARCH} macos-${ARCH}" ;;
|
|
*) KEYS="${OS_KEY}-${ARCH}" ;;
|
|
esac
|
|
SIG="$(cat "$updater_file.sig")" \
|
|
URL="https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG}/${base}" \
|
|
FMT="$fmt" \
|
|
KEYS="$KEYS" \
|
|
FRAG_NAME="${OS_KEY}-${ARCH}" \
|
|
python3 - <<'PY'
|
|
import json, os
|
|
entry = {
|
|
"signature": os.environ["SIG"],
|
|
"url": os.environ["URL"],
|
|
"format": os.environ["FMT"],
|
|
}
|
|
frag = {key: entry for key in os.environ["KEYS"].split()}
|
|
with open(f"fragments/{os.environ['FRAG_NAME']}.json", "w") as f:
|
|
json.dump(frag, f)
|
|
PY
|
|
|
|
- name: Upload manifest fragment
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: manifest-${{ matrix.os_key }}-${{ matrix.arch }}
|
|
path: fragments/*.json
|
|
|
|
manifest:
|
|
needs: [prepare, package]
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- name: Download all manifest fragments
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
pattern: manifest-*
|
|
path: fragments
|
|
merge-multiple: true
|
|
|
|
- name: Assemble latest.json
|
|
env:
|
|
VERSION: ${{ needs.prepare.outputs.version }}
|
|
run: |
|
|
python3 - <<'PY'
|
|
import json, glob, os, datetime
|
|
platforms = {}
|
|
for path in glob.glob("fragments/*.json"):
|
|
with open(path) as f:
|
|
platforms.update(json.load(f))
|
|
manifest = {
|
|
"version": os.environ["VERSION"],
|
|
"pub_date": datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
|
|
"platforms": platforms,
|
|
}
|
|
with open("latest.json", "w") as f:
|
|
json.dump(manifest, f, indent=2)
|
|
print(json.dumps(manifest, indent=2))
|
|
PY
|
|
|
|
- name: Upload latest.json to release
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
TAG: ${{ needs.prepare.outputs.tag }}
|
|
run: gh release upload "$TAG" latest.json --clobber --repo "$GITHUB_REPOSITORY"
|