chore(release): full CI matrix for 1.4.5 #8
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #GIT_COMMITTER_DATE="$(git show master --format=%aD | head -1)" git tag -a "v1.4.5" master -m "release tag v1.4.5" && git push --tags origin master && git --no-pager tag --list --format='%(refname) %(taggerdate)' | |
| #git tag -d v1.4.5 && git push origin :refs/tags/v1.4.5 | |
| name: Publish App | |
| #on: | |
| # release: | |
| # types: [published] | |
| on: | |
| push: | |
| #branches: [master] | |
| tags: | |
| # https://github.com/daisy/ace/settings/rules | |
| - "v*" # excludes slash / | |
| # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token | |
| # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions | |
| permissions: | |
| actions: none | |
| artifact-metadata: none | |
| attestations: none | |
| checks: none | |
| contents: none # <========== | |
| deployments: none | |
| discussions: none | |
| id-token: none | |
| issues: none | |
| models: none | |
| packages: none | |
| pages: none | |
| pull-requests: none | |
| repository-projects: none | |
| security-events: none | |
| statuses: none | |
| jobs: | |
| build: | |
| timeout-minutes: 20 | |
| permissions: | |
| actions: none | |
| artifact-metadata: none | |
| attestations: none | |
| checks: none | |
| contents: write # <========== | |
| deployments: none | |
| discussions: none | |
| id-token: none | |
| issues: none | |
| models: none | |
| packages: none | |
| pages: none | |
| pull-requests: none | |
| repository-projects: none | |
| security-events: none | |
| statuses: none | |
| # if: "!contains(toJSON(github.event.commits.*.message), '[skip-ci]')" | |
| if: "github.event_name == 'pull_request' || !contains(github.event.head_commit.message, 'skip ci')" | |
| runs-on: ${{ matrix.runson }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # ------------------------------ | |
| # uncomment below to use GitHub Actions to generate all but MacOS artefacts (MacOS = KeyChain code-signing certificate + notarization, Windows = signed in a VM manually using a USB hardware token) | |
| # osarch: [windows-intel, windows-arm, linux-intel, linux-arm] | |
| # include: | |
| # - osarch: windows-intel | |
| # runson: windows-latest #windows-2022 | |
| # packname: win | |
| # - osarch: windows-arm | |
| # runson: windows-latest #windows-2022 | |
| # packname: win | |
| # - osarch: linux-intel | |
| # runson: ubuntu-22.04 #ubuntu-latest is ubuntu-24.04 | |
| # packname: linux | |
| # - osarch: linux-arm | |
| # runson: ubuntu-22.04 #ubuntu-latest is ubuntu-24.04 | |
| # packname: linux | |
| # ------------------------------ | |
| osarch: | |
| [ | |
| windows-intel, | |
| windows-arm, | |
| macos-intel, | |
| macos-arm, | |
| linux-intel, | |
| linux-arm, | |
| ] | |
| # AceApp for MacOS x64 and arm64 is built on GitHub Actions arm64 runners | |
| # AceApp for Linux x64 and arm64 is built on GitHub Actions x64 runners | |
| # AceApp for Windows x64 and arm64 is built on GitHub Actions x64 runners | |
| # To ensure arm64, the trick is: | |
| # npm ci --foreground-scripts --arch=arm64 --cpu=arm64 | |
| # Replace "x64" with "arm64" in `package.json` (and optionally the electron-builder `src/package.json`, if needed) | |
| # To ensure x64, the trick is: | |
| # npm ci --foreground-scripts --arch=x64 --cpu=x64 | |
| # `package.json` already specifies "x64" | |
| # windows-latest is currently windows-2022 | |
| # https://github.com/actions/runner-images/blob/main/images/windows/Windows2022-Readme.md | |
| # windows-2025 is beta / public preview | |
| # https://github.com/actions/runner-images/blob/main/images/windows/Windows2025-Readme.md | |
| # https://github.com/actions/runner-images/issues/11228 | |
| # windows-11-preview_aarch64 ? | |
| # https://github.com/actions/partner-runner-images/issues/19#issuecomment-2569992032 | |
| # macos-latest is currently macos-14-arm64 | |
| # https://github.com/actions/runner-images/blob/main/images/macos/macos-14-arm64-Readme.md | |
| # macos-15-arm64 is beta / public preview | |
| # https://github.com/actions/runner-images/blob/main/images/macos/macos-15-arm64-Readme.md | |
| # ubuntu-latest is ubuntu-24.04 | |
| # https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2404-Readme.md | |
| # ubuntu-20.04 is the oldest available (good for glibc compat) ... but GitHub says "The Ubuntu 20.04 runner image will be fully unsupported by April 1, 2025" | |
| # https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2004-Readme.md | |
| include: | |
| - osarch: windows-intel | |
| runson: windows-2025 | |
| packname: win | |
| - osarch: windows-arm | |
| runson: windows-2025 | |
| packname: win | |
| - osarch: macos-intel | |
| runson: macos-latest #macos-14-arm64 | |
| packname: "mac" | |
| - osarch: macos-arm | |
| runson: macos-latest #macos-14-arm64 | |
| packname: "mac" | |
| - osarch: linux-intel | |
| runson: ubuntu-22.04 #ubuntu-latest is ubuntu-24.04 | |
| packname: linux | |
| - osarch: linux-arm | |
| runson: ubuntu-22.04 #ubuntu-latest is ubuntu-24.04 | |
| packname: linux | |
| steps: | |
| - name: MacOS KeyChain init | |
| if: startsWith(matrix.osarch, 'macos-') #runner.os == 'macOS' | |
| run: | | |
| CODESIGN_KEYCHAIN_PATH=$RUNNER_TEMP/codesign.keychain-db | |
| echo KEYCHAIN_CREATE | |
| security create-keychain -p "${{ github.run_id }}" "$CODESIGN_KEYCHAIN_PATH" | |
| echo KEYCHAIN_SETTINGS | |
| security set-keychain-settings -lut 21600 "$CODESIGN_KEYCHAIN_PATH" | |
| echo KEYCHAIN_UNLOCK | |
| security unlock-keychain -p "${{ github.run_id }}" "$CODESIGN_KEYCHAIN_PATH" | |
| echo KEYCHAIN_LIST1 | |
| security list-keychain || echo OK || true | |
| echo KEYCHAIN_LIST2 | |
| security list-keychain -d user -s "$CODESIGN_KEYCHAIN_PATH" || echo OK || true | |
| echo KEYCHAIN_FIND1 | |
| security find-identity -v -p codesigning -s "$CODESIGN_KEYCHAIN_PATH" || echo OK || true | |
| echo KEYCHAIN_FIND2 | |
| security find-identity -v -p codesigning || echo OK || true | |
| CODESIGN_P12_PATH=$RUNNER_TEMP/code-sign.p12 | |
| echo KEYCHAIN_P12_B64 | |
| echo -n "$CODESIGN_P12_B64" | base64 --decode -o "$CODESIGN_P12_PATH" | |
| echo KEYCHAIN_P12_IMPORT | |
| security import "$CODESIGN_P12_PATH" -P "$CODESIGN_P12_PASS" -A -t cert -f pkcs12 -k "$CODESIGN_KEYCHAIN_PATH" | |
| echo KEYCHAIN_LIST1 | |
| security list-keychain || echo OK || true | |
| echo KEYCHAIN_LIST2 | |
| security list-keychain -d user -s "$CODESIGN_KEYCHAIN_PATH" || echo OK || true | |
| echo KEYCHAIN_FIND1 | |
| security find-identity -v -p codesigning -s "$CODESIGN_KEYCHAIN_PATH" || echo OK || true | |
| echo KEYCHAIN_FIND2 | |
| security find-identity -v -p codesigning || echo OK || true | |
| echo KEYCHAIN_NOTARY_STORE_CREDS | |
| xcrun notarytool store-credentials "$APPLEIDKEYCHAIN" --apple-id "$APPLE_ID" --team-id "$APPLE_ID_TEAM" --password "$APPLE_ID_PASS" --keychain "$CODESIGN_KEYCHAIN_PATH" | |
| echo KEYCHAIN_LIST1 | |
| security list-keychain || echo OK || true | |
| echo KEYCHAIN_LIST2 | |
| security list-keychain -d user -s "$CODESIGN_KEYCHAIN_PATH" || echo OK || true | |
| env: | |
| CODESIGN_P12_B64: ${{ secrets.CODESIGN_P12_B64 }} # base64 -i file.p12 -o env.txt | |
| CODESIGN_P12_PASS: ${{ secrets.CODESIGN_P12_PASS }} | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_ID_PASS: ${{ secrets.APPLE_ID_PASS }} | |
| APPLE_ID_TEAM: ${{ secrets.APPLE_ID_TEAM }} | |
| APPLEIDKEYCHAIN: ${{ secrets.APPLEIDKEYCHAIN }} | |
| # https://www.electron.build/code-signing.html | |
| # graceful fail? | |
| - run: |- | |
| pwdx || echo OK || true | |
| shell: cmd | |
| continue-on-error: true | |
| - name: Microsoft Windows dumpbin to PATH | |
| if: startsWith(matrix.osarch, 'windows-') | |
| run: > | |
| $VS_ROOT = "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Tools\MSVC"; Get-ChildItem -Path $VS_ROOT -Force; $VS_VERSION = (Get-ChildItem -Path $VS_ROOT | Sort-Object Name -Descending | Select-Object -First 1).Name; $VS_BIN = "$VS_ROOT\$VS_VERSION\bin\Hostx64\x64"; echo $VS_BIN >> $env:GITHUB_PATH; echo $VS_BIN | |
| shell: powershell | |
| - name: Microsoft Windows dumpbin check | |
| if: startsWith(matrix.osarch, 'windows-') | |
| run: > | |
| dir /A "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Tools\MSVC" && dumpbin /headers "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Tools\MSVC\14.44.35207\bin\Hostx64\x64\dumpbin.exe" | findstr /i machine | |
| shell: cmd | |
| # - name: Microsoft Windows msbuild to PATH | |
| # if: startsWith(matrix.osarch, 'windows-') | |
| # uses: microsoft/setup-msbuild@v2 | |
| # "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\MSBuild\Current\Bin" | |
| # "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\Tools" | |
| # "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\bin\amd64" | |
| # "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Tools\MSVC\14.29.30133\bin\Hostx64\x64" | |
| # "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Tools\MSVC\14.44.35207\bin\Hostx64\x64" | |
| #- run: exit 1 | |
| - run: 'echo "GITHUB_REF_NAME: ${{ github.ref_name }}"' | |
| - run: 'echo "GITHUB_RUN_NUMBER: ${{ github.run_number }}"' | |
| - run: 'echo "GITHUB_RUN_ID: ${{ github.run_id }}"' | |
| - run: 'echo "GITHUB_SHA: ${{ github.sha }}"' | |
| - run: echo "${{ matrix.osarch }} // ${{ runner.arch }}" | |
| - name: System arch (non Windows) | |
| #if: ${{ matrix.osarch != 'windows-intel' && matrix.osarch != 'windows-arm' }} | |
| if: ${{ !startsWith(matrix.osarch, 'windows-') }} | |
| run: uname -m && arch | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| # - name: Git config global dump (pre) | |
| # run: 'git config --global --list || echo NO_GIT_GLOBAL_CONFIG || true' | |
| # shell: bash | |
| # - name: Git config local dump (pre) | |
| # run: 'git config --list || echo NO_GIT_GLOBAL_CONFIG || true' | |
| # shell: bash | |
| # - name: git HTTP authentication instead SSH (NPM >=7) 1 | |
| # run: > | |
| # git config --global url."https://github.com/".insteadOf ssh://git@github.com/ | |
| # shell: bash | |
| # - name: git HTTP authentication instead SSH (NPM >=7) 2 | |
| # run: > | |
| # git config --global url."https://github.com".insteadOf ssh://git@github.com | |
| # shell: bash | |
| # - name: git HTTP authentication instead SSH (NPM >=7) 3 | |
| # run: > | |
| # git config --global url."http://github.com/".insteadOf git@github.com: | |
| # shell: bash | |
| # - name: git HTTP authentication instead SSH (NPM >=7) 4 | |
| # run: > | |
| # git config --global url."http://".insteadOf git:// | |
| # shell: bash | |
| - name: Git config global dump (post) | |
| run: "git config --global --list || echo NO_GIT_GLOBAL_CONFIG || true" | |
| shell: bash | |
| - name: Git config local dump (post) | |
| run: "git config --list || echo NO_GIT_GLOBAL_CONFIG || true" | |
| shell: bash | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "24" | |
| #check-latest: true | |
| - run: node --version && npm --version | |
| - run: npm --global install npm@^11 | |
| - run: npm --version | |
| - run: npm --global install yarn@^1 | |
| # - run: ((curl -o- -L https://yarnpkg.com/install.sh | bash -s -- --version 1.22.5) || echo "YARN OK") | |
| # - run: export PATH="$HOME/.yarn/bin:$PATH" | |
| - run: yarn --version | |
| - run: yarn config set network-timeout 300000 || echo ok | |
| # - run: yarn --global install asar | |
| # - name: package patch 1 | |
| # run: node build/package-ci-patch.js package.json ${{ github.run_id }} && cat package.json | grep -i VERSION && cat package.json | |
| # shell: bash | |
| # - name: package patch 2 | |
| # run: node build/package-ci-patch.js package-asar.json ${{ github.run_id }} && cat package-asar.json | grep -i VERSION && cat package-asar.json | |
| # shell: bash | |
| # - name: package patch 3 | |
| # run: node build/package-ci-patch.js package-asar-dev.json ${{ github.run_id }} && cat package-asar-dev.json | grep -i VERSION && cat package-asar-dev.json | |
| # shell: bash | |
| - run: git submodule init && git submodule update | |
| - run: git --no-pager diff package.json && git --no-pager diff package-asar.json && git --no-pager diff package-asar-dev.json | |
| - run: git --no-pager diff | |
| - run: yarn cache clean | |
| - run: npm cache clean --force | |
| - run: npm cache verify | |
| #- run: pwd && ls && cd .. && pwd && ls && git clone https://github.com/daisy/ace.git && cd ace && pwd && ls && git checkout ace-next-local-packs && yarn ace-app-prepare && pwd && ls && cd .. && pwd && ls && cd ace-gui && pwd && ls | |
| #- run: rm -f yarn.lock && rm -rf node_modules && yarn install | |
| - name: YARN install (arm64) (non Windows) | |
| #if: ${{ matrix.osarch == 'linux-arm' || matrix.osarch == 'macos-arm' }} | |
| if: ${{ !startsWith(matrix.osarch, 'windows-') && endsWith(matrix.osarch, '-arm') }} | |
| run: export npm_config_arch=arm64 && export npm_config_cpu=arm64 && yarn install --frozen-lockfile --ignore-scripts --network-timeout 1000000 && cd node_modules && cd electron && yarn --verbose --network-timeout 1000000 run postinstall && cd .. && cd .. | |
| #--arch=arm64 | |
| - name: YARN install (arm64) (Windows) | |
| #if: ${{ startsWith(matrix.osarch, 'windows-') && endsWith(matrix.osarch, '-arm') }} | |
| if: ${{ matrix.osarch == 'windows-arm' }} | |
| run: SET "npm_config_arch=arm64" && SET "npm_config_cpu=arm64" && yarn install --frozen-lockfile --ignore-scripts --network-timeout 1000000 && cd node_modules && cd electron && yarn --verbose --network-timeout 1000000 run postinstall && cd .. && cd .. | |
| shell: cmd | |
| #--arch=arm64 | |
| - name: YARN install (x64) (non Windows) | |
| #if: ${{ matrix.osarch == 'linux-intel' || matrix.osarch == 'macos-intel' }} | |
| if: ${{ !startsWith(matrix.osarch, 'windows-') && endsWith(matrix.osarch, '-intel') }} | |
| run: export npm_config_arch=x64 && export npm_config_cpu=x64 && yarn install --frozen-lockfile --ignore-scripts --network-timeout 1000000 && cd node_modules && cd electron && yarn --verbose --network-timeout 1000000 run postinstall && cd .. && cd .. | |
| #--arch=x64 | |
| - name: YARN install (x64) (Windows) | |
| #if: ${{ startsWith(matrix.osarch, 'windows-') && endsWith(matrix.osarch, '-intel') }} | |
| if: ${{ matrix.osarch == 'windows-intel' }} | |
| run: SET "npm_config_arch=x64" && SET "npm_config_cpu=x64" && yarn install --frozen-lockfile --ignore-scripts --network-timeout 1000000 && cd node_modules && cd electron && yarn --verbose --network-timeout 1000000 run postinstall && cd .. && cd .. | |
| shell: cmd | |
| #--arch=x64 | |
| - name: Electron version + arch (Windows) | |
| #if: ${{ matrix.osarch == 'windows-intel' || matrix.osarch == 'windows-arm' }} | |
| if: startsWith(matrix.osarch, 'windows-') | |
| run: > | |
| (dumpbin /headers "node_modules\electron\dist\electron.exe" | findstr /i machine) && (node_modules\\electron\\dist\\electron.exe --no-sandbox --version || echo INVALID_ARCH || true) && (node_modules\\electron\\dist\\electron.exe --no-sandbox --abi || echo INVALID_ARCH || true) | |
| shell: cmd | |
| continue-on-error: true | |
| - name: Electron version + arch (Linux) | |
| #if: ${{ matrix.osarch == 'linux-intel' || matrix.osarch == 'linux-arm' }} | |
| if: startsWith(matrix.osarch, 'linux-') | |
| run: > | |
| (file node_modules/electron/dist/electron) && (node_modules/electron/dist/electron --no-sandbox --version || echo INVALID_ARCH) && (node_modules/electron/dist/electron --no-sandbox --abi || echo INVALID_ARCH) | |
| - name: Electron version + arch (MacOS) | |
| #if: ${{ matrix.osarch == 'macos-intel' || matrix.osarch == 'macos-arm' }} | |
| if: startsWith(matrix.osarch, 'macos-') | |
| run: > | |
| (file node_modules/electron/dist/Electron.app/Contents/MacOS/Electron) && (node_modules/electron/dist/Electron.app/Contents/MacOS/Electron --no-sandbox --version || echo INVALID_ARCH) && (node_modules/electron/dist/Electron.app/Contents/MacOS/Electron --no-sandbox --abi || echo INVALID_ARCH) | |
| # - run: > | |
| # node -e 'const path = require("path"); const fs = require("fs"); const filePath = path.join(process.cwd(), "package.json"); let fileStr = fs.readFileSync(filePath, { encoding: "utf8" }); fileStr = fileStr.replace(/"sign": true,/g, `"sign": false,`); fileStr = fileStr.replace(/"hardenedRuntime": true,/g, `"hardenedRuntime": false, "identity": null,`); fs.writeFileSync(filePath, fileStr, { encoding: "utf8" });' | |
| # continue-on-error: true | |
| - name: non-PR action (build and package) ARM | |
| env: | |
| USE_HARD_LINKS: "false" # Electron Builder workaround | |
| APPLEIDKEYCHAIN: ${{ secrets.APPLEIDKEYCHAIN }} | |
| # CSC_KEYCHAIN: ${{ secrets.CSC_KEYCHAIN }} | |
| # CSC_NAME: ${{ secrets.CSC_NAME }} | |
| # CSC_LINK: ${{ secrets.CSC_LINK }} | |
| # CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }} | |
| #if: ${{ github.event_name != 'pull_request' && (matrix.osarch == 'linux-arm' || matrix.osarch == 'windows-arm' || matrix.osarch == 'macos-arm') }} | |
| if: ${{ github.event_name != 'pull_request' && endsWith(matrix.osarch, '-arm') }} | |
| #run: sed 's/x64/arm64/g' ./package.json > ./package.json.new && mv ./package.json.new ./package.json && yarn package:${{ matrix.packname }} && sed 's/arm64/x64/g' ./package.json > ./package.json.new && mv ./package.json.new ./package.json | |
| run: > | |
| node -e 'const path = require("path"); const fs = require("fs"); const filePath = path.join(process.cwd(), "package.json"); let fileStr = fs.readFileSync(filePath, { encoding: "utf8" }); fileStr = fileStr.replace(/x64/g, "arm64"); fs.writeFileSync(filePath, fileStr, { encoding: "utf8" });' && yarn package:${{ matrix.packname }} | |
| - name: non-PR action (build and package) INTEL | |
| env: | |
| USE_HARD_LINKS: "false" # Electron Builder workaround | |
| APPLEIDKEYCHAIN: ${{ secrets.APPLEIDKEYCHAIN }} | |
| # CSC_KEYCHAIN: ${{ secrets.CSC_KEYCHAIN }} | |
| # CSC_NAME: ${{ secrets.CSC_NAME }} | |
| # CSC_LINK: ${{ secrets.CSC_LINK }} | |
| # CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }} | |
| #if: ${{ github.event_name != 'pull_request' && (matrix.osarch == 'linux-intel' || matrix.osarch == 'windows-intel' || matrix.osarch == 'macos-intel') }} | |
| if: ${{ github.event_name != 'pull_request' && endsWith(matrix.osarch, '-intel') }} | |
| run: yarn package:${{ matrix.packname }} | |
| - name: MacOS KeyChain teardown | |
| if: runner.os == 'macOS' && always() | |
| run: | | |
| echo KEYCHAIN_LIST1 | |
| security list-keychain || echo OK || true | |
| echo KEYCHAIN_LIST2 | |
| security list-keychain -d user -s "$CODESIGN_KEYCHAIN_PATH" || echo OK || true | |
| echo KEYCHAIN_DELETE | |
| security delete-keychain $RUNNER_TEMP/codesign.keychain-db || echo OK || true | |
| echo KEYCHAIN_LIST1 | |
| security list-keychain || echo OK || true | |
| echo KEYCHAIN_LIST2 | |
| security list-keychain -d user -s "$CODESIGN_KEYCHAIN_PATH" || echo OK || true | |
| #- run: ls -alsR release | |
| #- run: npm install @octokit/rest | |
| # (gh release create ${{ github.ref_name }} --draft --title "Ace by DAISY App ${{ github.ref_name }}" || echo OK || true) && | |
| - name: GitHub Tagged Release (MacOS) | |
| if: startsWith(matrix.osarch, 'macos-') #runner.os == 'macOS' | |
| continue-on-error: true | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: gh release upload ${{ github.ref_name }} dist/*.dmg --clobber | |
| - name: GitHub Tagged Release (Windows) | |
| if: startsWith(matrix.osarch, 'windows-') # runner.os == 'Windows' | |
| continue-on-error: true | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: gh release upload ${{ github.ref_name }} dist/*.exe --clobber | |
| - name: GitHub Tagged Release (Linux) | |
| if: startsWith(matrix.osarch, 'linux-') # runner.os == 'Linux' | |
| continue-on-error: true | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: gh release upload ${{ github.ref_name }} dist/*.AppImage --clobber ; gh release upload ${{ github.ref_name }} dist/*.deb --clobber |