chore: bump version to 0.1.7 (#647) #22
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build Electron App | |
| on: | |
| # Trigger on version tags (e.g., v0.1.0, v1.2.3) | |
| push: | |
| tags: | |
| - 'v*.*.*' | |
| jobs: | |
| build: | |
| name: Build Windows | |
| runs-on: windows-latest | |
| env: | |
| AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }} | |
| AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }} | |
| AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }} | |
| AZURE_ENDPOINT: ${{ secrets.AZURE_ENDPOINT }} | |
| AZURE_TRUSTED_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }} | |
| AZURE_CERTIFICATE_PROFILE_NAME: ${{ secrets.AZURE_CERTIFICATE_PROFILE_NAME }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # Required for electron-builder to generate proper version info | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '22.19.0' | |
| cache: 'npm' | |
| cache-dependency-path: | | |
| app/package-lock.json | |
| frontend/package-lock.json | |
| - name: Install frontend dependencies | |
| working-directory: ./frontend | |
| run: npm ci | |
| - name: Security audit - Frontend | |
| working-directory: ./frontend | |
| run: npm audit --audit-level=moderate | |
| continue-on-error: true # Don't fail build on audit issues, but report them | |
| - name: Build frontend | |
| working-directory: ./frontend | |
| run: npm run build | |
| - name: Install app dependencies | |
| working-directory: ./app | |
| run: npm ci | |
| - name: Security audit - Electron App | |
| working-directory: ./app | |
| run: npm audit --audit-level=moderate | |
| continue-on-error: true # Don't fail build on audit issues, but report them | |
| - name: Build application | |
| working-directory: ./app | |
| run: npm run compile | |
| - name: Build Electron app (Windows) | |
| working-directory: ./app | |
| run: npm run dist:win | |
| env: | |
| GH_TOKEN: ${{ secrets.GH_TOKEN }} | |
| - name: Sign files with Azure Trusted Signing | |
| if: env.AZURE_CLIENT_ID != '' | |
| uses: azure/trusted-signing-action@v0 | |
| with: | |
| azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
| azure-client-id: ${{ secrets.AZURE_CLIENT_ID }} | |
| azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }} | |
| endpoint: ${{ secrets.AZURE_ENDPOINT }} | |
| trusted-signing-account-name: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }} | |
| certificate-profile-name: ${{ secrets.AZURE_CERTIFICATE_PROFILE_NAME }} | |
| files-folder: ${{ github.workspace }}\app\dist | |
| files-folder-filter: exe | |
| file-digest: SHA256 | |
| timestamp-rfc3161: http://timestamp.acs.microsoft.com | |
| timestamp-digest: SHA256 | |
| - name: Update latest.yml with signed exe checksum | |
| if: env.AZURE_CLIENT_ID != '' | |
| working-directory: ./app | |
| run: node build/update-latest-yml.js | |
| - name: Upload to GitHub Release | |
| if: startsWith(github.ref, 'refs/tags/v') && env.AZURE_CLIENT_ID != '' | |
| uses: softprops/action-gh-release@v1 | |
| with: | |
| files: | | |
| app/dist/*.exe | |
| app/dist/latest.yml | |
| prerelease: ${{ contains(github.ref, '-alpha') || contains(github.ref, '-beta') || contains(github.ref, '-rc') }} | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GH_TOKEN }} | |
| - name: Upload artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: windows-artifacts | |
| path: | | |
| app/dist/**/* | |
| retention-days: 30 | |
| if-no-files-found: error | |
| build-macos: | |
| name: Build macOS | |
| runs-on: macos-latest | |
| env: | |
| # Map CI_MACOS_* secrets to env vars used by certificate import and electron-builder | |
| MACOS_SIGNING_IDENTITY: ${{ secrets.CI_MACOS_CERTIFICATE_ID }} | |
| MACOS_SIGNING_CERT: ${{ secrets.CI_MACOS_CERTIFICATE_BASE64 }} | |
| MACOS_SIGNING_CERT_PASSWORD: ${{ secrets.CI_MACOS_CERTIFICATE_PASSWORD }} | |
| MACOS_NOTARIZATION_USERNAME: ${{ secrets.CI_MACOS_NOTARIZATION_USER }} | |
| MACOS_NOTARIZATION_PASSWORD: ${{ secrets.CI_MACOS_NOTARIZATION_PASSWORD }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '22.19.0' | |
| cache: 'npm' | |
| cache-dependency-path: | | |
| app/package-lock.json | |
| frontend/package-lock.json | |
| - name: Install frontend dependencies | |
| working-directory: ./frontend | |
| run: npm ci | |
| - name: Security audit - Frontend | |
| working-directory: ./frontend | |
| run: npm audit --audit-level=moderate | |
| continue-on-error: true | |
| - name: Build frontend | |
| working-directory: ./frontend | |
| run: npm run build | |
| - name: Install app dependencies | |
| working-directory: ./app | |
| run: npm ci | |
| - name: Security audit - Electron App | |
| working-directory: ./app | |
| run: npm audit --audit-level=moderate | |
| continue-on-error: true | |
| - name: Build application | |
| working-directory: ./app | |
| run: npm run compile | |
| - name: Import Apple Developer ID certificate | |
| if: env.MACOS_SIGNING_CERT != '' | |
| run: | | |
| # Create a temporary keychain | |
| KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db | |
| KEYCHAIN_PASSWORD=$(openssl rand -base64 32) | |
| security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" | |
| security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH" | |
| security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" | |
| # Import certificate | |
| CERT_PATH=$RUNNER_TEMP/certificate.p12 | |
| echo "$MACOS_SIGNING_CERT" | base64 --decode > "$CERT_PATH" | |
| security import "$CERT_PATH" \ | |
| -P "$MACOS_SIGNING_CERT_PASSWORD" \ | |
| -A \ | |
| -t cert \ | |
| -f pkcs12 \ | |
| -k "$KEYCHAIN_PATH" | |
| rm "$CERT_PATH" | |
| # Set keychain to be searched first | |
| security list-keychain -d user -s "$KEYCHAIN_PATH" login.keychain-db | |
| security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" | |
| - name: Build Electron app (macOS) | |
| working-directory: ./app | |
| run: npm run dist:mac | |
| env: | |
| GH_TOKEN: ${{ secrets.GH_TOKEN }} | |
| # Skip code signing when no certificate is available | |
| CSC_IDENTITY_AUTO_DISCOVERY: ${{ env.MACOS_SIGNING_CERT != '' }} | |
| - name: Generate latest-mac.yml | |
| working-directory: ./app | |
| run: node build/update-latest-yml.js --platform mac | |
| - name: Upload to GitHub Release | |
| if: startsWith(github.ref, 'refs/tags/v') && env.MACOS_SIGNING_CERT != '' | |
| uses: softprops/action-gh-release@v1 | |
| with: | |
| files: | | |
| app/dist/DaydreamScope-arm64.dmg | |
| app/dist/*.zip | |
| app/dist/latest-mac.yml | |
| prerelease: ${{ contains(github.ref, '-alpha') || contains(github.ref, '-beta') || contains(github.ref, '-rc') }} | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GH_TOKEN }} | |
| - name: Clean up keychain | |
| if: always() | |
| run: | | |
| KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db | |
| if [ -f "$KEYCHAIN_PATH" ]; then | |
| security delete-keychain "$KEYCHAIN_PATH" | |
| fi | |
| - name: Upload artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: macos-artifacts | |
| path: | | |
| app/dist/**/* | |
| retention-days: 30 | |
| if-no-files-found: error |