fix(desktop): locate prepackaged app for release builds #23
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Desktop Release | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: "Desktop app version to publish, for example 0.0.2" | |
| required: true | |
| type: string | |
| push: | |
| tags: | |
| - "v*" | |
| - "desktop-v*" | |
| permissions: | |
| contents: write | |
| jobs: | |
| publish: | |
| name: Publish desktop app | |
| runs-on: macos-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| submodules: recursive | |
| - name: Enable Corepack | |
| run: corepack enable | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache Rust builds | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Set workflow version | |
| if: github.event_name == 'workflow_dispatch' | |
| run: pnpm --dir desktop version "${{ inputs.version }}" --no-git-tag-version | |
| - name: Set tag version | |
| if: github.event_name == 'push' | |
| run: | | |
| version="${GITHUB_REF_NAME#desktop-v}" | |
| version="${version#v}" | |
| current="$(node -p "require('./desktop/package.json').version")" | |
| if [[ "${current}" == "${version}" ]]; then | |
| echo "desktop/package.json already has version ${version}." | |
| else | |
| pnpm --dir desktop version "${version}" --no-git-tag-version | |
| fi | |
| - name: Import macOS signing certificate | |
| env: | |
| MACOS_CERTIFICATE_BASE64: ${{ secrets.MACOS_CERTIFICATE_BASE64 }} | |
| MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }} | |
| KEYCHAIN_PASSWORD: ${{ secrets.MACOS_KEYCHAIN_PASSWORD }} | |
| run: | | |
| if [[ -z "${MACOS_CERTIFICATE_BASE64}" ]]; then | |
| echo "No macOS signing certificate configured; using ad-hoc signing." | |
| exit 0 | |
| fi | |
| CERTIFICATE_PATH="${RUNNER_TEMP}/macos-certificate.p12" | |
| KEYCHAIN_PATH="${RUNNER_TEMP}/build.keychain-db" | |
| echo "${MACOS_CERTIFICATE_BASE64}" | base64 --decode > "${CERTIFICATE_PATH}" | |
| security create-keychain -p "${KEYCHAIN_PASSWORD}" "${KEYCHAIN_PATH}" | |
| security set-keychain-settings -lut 21600 "${KEYCHAIN_PATH}" | |
| security unlock-keychain -p "${KEYCHAIN_PASSWORD}" "${KEYCHAIN_PATH}" | |
| security list-keychains -d user -s "${KEYCHAIN_PATH}" | |
| security default-keychain -s "${KEYCHAIN_PATH}" | |
| security import "${CERTIFICATE_PATH}" \ | |
| -P "${MACOS_CERTIFICATE_PASSWORD}" \ | |
| -A \ | |
| -t cert \ | |
| -f pkcs12 \ | |
| -k "${KEYCHAIN_PATH}" | |
| security set-key-partition-list \ | |
| -S apple-tool:,apple:,codesign: \ | |
| -s \ | |
| -k "${KEYCHAIN_PASSWORD}" \ | |
| "${KEYCHAIN_PATH}" | |
| security find-identity -v -p codesigning "${KEYCHAIN_PATH}" | |
| - name: Prepare Apple notarization key | |
| env: | |
| APPLE_API_KEY_BASE64: ${{ secrets.APPLE_API_KEY_BASE64 }} | |
| run: | | |
| if [[ -z "${APPLE_API_KEY_BASE64}" ]]; then | |
| echo "No Apple notarization API key configured; notarization will be skipped." | |
| exit 0 | |
| fi | |
| APPLE_API_KEY_PATH="${RUNNER_TEMP}/AuthKey.p8" | |
| echo "${APPLE_API_KEY_BASE64}" | base64 --decode > "${APPLE_API_KEY_PATH}" | |
| chmod 600 "${APPLE_API_KEY_PATH}" | |
| echo "APPLE_API_KEY=${APPLE_API_KEY_PATH}" >> "${GITHUB_ENV}" | |
| - name: Publish release | |
| env: | |
| ANGEL_ENGINE_MAC_SIGN_KEYCHAIN: ${{ secrets.MACOS_CERTIFICATE_BASE64 != '' && format('{0}/build.keychain-db', runner.temp) || '' }} | |
| APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} | |
| APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: pnpm --filter desktop run publish |