chore: release v1.4.7 #98
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| pull_request: | |
| workflow_dispatch: | |
| inputs: | |
| windows_release_tag: | |
| description: "Tag to attach an UNSIGNED Windows installer to (e.g. v1.1.0). Blank = skip." | |
| required: false | |
| default: "" | |
| jobs: | |
| test: | |
| name: Test (${{ matrix.name }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: Linux | |
| os: ubuntu-latest | |
| - name: macOS Apple Silicon | |
| os: macos-15 | |
| - name: macOS Intel | |
| os: macos-15-intel | |
| - name: Windows | |
| os: windows-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - run: npm run ci | |
| notarized-macos-release: | |
| name: Notarized macOS Release | |
| runs-on: macos-15 | |
| if: startsWith(github.ref, 'refs/tags/v') && vars.ENABLE_MACOS_NOTARIZED_RELEASE == 'true' | |
| env: | |
| CSC_LINK: ${{ secrets.MACOS_CSC_LINK }} | |
| CSC_KEY_PASSWORD: ${{ secrets.MACOS_CSC_KEY_PASSWORD }} | |
| CSC_NAME: ${{ secrets.MACOS_CSC_NAME }} | |
| APPLE_KEYCHAIN_PROFILE: ${{ secrets.APPLE_KEYCHAIN_PROFILE }} | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - run: npm run security:deps | |
| - run: npm run build:mac:notarized | |
| - name: Verify notarized macOS artifacts | |
| run: | | |
| set -euo pipefail | |
| test -d "dist/mac-universal/TaskWraith.app" | |
| codesign --verify --deep --strict --verbose=2 "dist/mac-universal/TaskWraith.app" | |
| spctl --assess --type execute --verbose=4 "dist/mac-universal/TaskWraith.app" | |
| xcrun stapler validate "dist/mac-universal/TaskWraith.app" | |
| for artifact in dist/*.dmg; do | |
| test -f "$artifact" | |
| xcrun stapler validate "$artifact" | |
| done | |
| signed-windows-release: | |
| name: Signed Windows Release | |
| runs-on: windows-latest | |
| if: startsWith(github.ref, 'refs/tags/v') && vars.ENABLE_WINDOWS_SIGNED_RELEASE == 'true' | |
| env: | |
| CSC_LINK: ${{ secrets.WINDOWS_CSC_LINK }} | |
| CSC_KEY_PASSWORD: ${{ secrets.WINDOWS_CSC_KEY_PASSWORD }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - run: npm run security:deps | |
| - run: npm run build:win:signed | |
| - name: Verify signed Windows artifacts | |
| shell: pwsh | |
| run: | | |
| $ErrorActionPreference = "Stop" | |
| $installers = Get-ChildItem -Path dist -Filter "TaskWraith-*-win-*-setup.exe" | |
| if ($installers.Count -lt 2) { | |
| throw "Expected signed x64 and arm64 Windows installers in dist/." | |
| } | |
| foreach ($installer in $installers) { | |
| $signature = Get-AuthenticodeSignature -FilePath $installer.FullName | |
| if ($signature.Status -ne "Valid") { | |
| throw "Invalid Authenticode signature for $($installer.Name): $($signature.Status)" | |
| } | |
| } | |
| $version = (Get-Content package.json | ConvertFrom-Json).version | |
| $feedPrefix = if ($version -match "-") { "beta" } else { "latest" } | |
| foreach ($arch in @("x64", "arm64")) { | |
| $feed = "dist/$feedPrefix-win-$arch.yml" | |
| if (!(Test-Path $feed)) { | |
| throw "Missing $feed" | |
| } | |
| } | |
| unsigned-windows-build: | |
| name: Unsigned Windows Build (testing) | |
| runs-on: windows-latest | |
| if: github.event_name == 'workflow_dispatch' && inputs.windows_release_tag != '' | |
| permissions: | |
| contents: write | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| # `build:win:nopublish` shares build:win's recipe (compile + electron-builder | |
| # + packaged-app smoke + update-feed write/validate) but forces | |
| # `--publish never`: electron-builder's implicit CI publish would otherwise | |
| # try to attach to the `windows_release_tag` release and refuse any release | |
| # created >2h ago. The packaged-app launch smoke now skips the arm64 binary | |
| # on this x64 runner (it can't be executed natively) instead of crashing | |
| # with "spawn UNKNOWN", so it is safe to run here. Assets are attached by the | |
| # gh step below (gh release upload --clobber works on an existing release). | |
| - run: npm run build:win:nopublish | |
| - name: Upload unsigned Windows installers to the release | |
| shell: pwsh | |
| run: | | |
| $ErrorActionPreference = "Stop" | |
| $tag = "${{ inputs.windows_release_tag }}" | |
| $assets = @( | |
| Get-ChildItem -Path dist -Filter "TaskWraith-*-win-*-setup.exe" | |
| Get-ChildItem -Path dist -Filter "TaskWraith-*-win-*-setup.exe.blockmap" | |
| Get-ChildItem -Path dist -Filter "latest-win-*.yml" | |
| ) | ForEach-Object { $_.FullName } | |
| if ($assets.Count -lt 2) { | |
| throw "Expected Windows installers in dist/, found $($assets.Count)." | |
| } | |
| Write-Host "Uploading $($assets.Count) asset(s) to release $tag" | |
| gh release upload $tag @assets --clobber |