fix: add Supabase and PostHog env vars to release workflow #43
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| permissions: | |
| contents: write | |
| jobs: | |
| release: | |
| runs-on: ${{ matrix.platform }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| platform: [macos-latest, ubuntu-22.04, windows-latest] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install dependencies (ubuntu only) | |
| if: matrix.platform == 'ubuntu-22.04' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libwebkit2gtk-4.0-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf | |
| - name: Rust setup | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Rust cache | |
| uses: swatinem/rust-cache@v2 | |
| with: | |
| workspaces: './src-tauri -> target' | |
| - name: Sync node version and setup cache | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 'lts/*' | |
| - name: Clean npm cache and dependencies | |
| shell: bash | |
| run: | | |
| rm -rf node_modules package-lock.json | |
| npm cache clean --force | |
| - name: Install frontend dependencies | |
| run: npm install | |
| - name: Setup Apple API Key (macOS only) | |
| if: matrix.platform == 'macos-latest' | |
| run: | | |
| mkdir -p ~/private_keys | |
| echo "${{ secrets.APPLE_API_KEY_PATH_BASE64 }}" | base64 --decode > ~/private_keys/AuthKey_${{ secrets.APPLE_API_KEY }}.p8 | |
| - name: Install Apple Certificate (macOS only) | |
| if: matrix.platform == 'macos-latest' | |
| env: | |
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| run: | | |
| # Create variables | |
| KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db | |
| KEYCHAIN_PASSWORD=$(openssl rand -base64 32) | |
| CERTIFICATE_PATH=$RUNNER_TEMP/certificate.p12 | |
| # Decode certificate | |
| echo "$APPLE_CERTIFICATE" | base64 --decode > $CERTIFICATE_PATH | |
| # Create temporary keychain | |
| security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| security set-keychain-settings -lut 21600 $KEYCHAIN_PATH | |
| security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| # Import certificate to keychain | |
| security import $CERTIFICATE_PATH -P "$APPLE_CERTIFICATE_PASSWORD" \ | |
| -A -t cert -f pkcs12 -k $KEYCHAIN_PATH | |
| security list-keychain -d user -s $KEYCHAIN_PATH | |
| # Allow codesign to access keychain | |
| security set-key-partition-list -S apple-tool:,apple:,codesign: \ | |
| -s -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| # Verify certificate was installed | |
| security find-identity -v -p codesigning $KEYCHAIN_PATH | |
| - name: Build the app | |
| uses: tauri-apps/tauri-action@v0 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }} | |
| GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }} | |
| VITE_AUTH_BASE_URL: https://lokusmd.com | |
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }} | |
| APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }} | |
| APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }} | |
| APPLE_API_KEY_PATH: ~/private_keys/AuthKey_${{ secrets.APPLE_API_KEY }}.p8 | |
| # Crash Reporting (Sentry/GlitchTip) | |
| VITE_SENTRY_DSN: ${{ secrets.VITE_SENTRY_DSN }} | |
| VITE_ENABLE_CRASH_REPORTS: 'true' | |
| VITE_SENTRY_ENVIRONMENT: 'production' | |
| # Supabase Auth | |
| VITE_SUPABASE_URL: ${{ secrets.VITE_SUPABASE_URL }} | |
| VITE_SUPABASE_ANON_KEY: ${{ secrets.VITE_SUPABASE_ANON_KEY }} | |
| # Analytics (PostHog) | |
| VITE_POSTHOG_KEY: ${{ secrets.VITE_POSTHOG_KEY }} | |
| VITE_POSTHOG_HOST: ${{ secrets.VITE_POSTHOG_HOST }} | |
| with: | |
| includeUpdaterJson: true | |
| tagName: ${{ github.ref_name }} | |
| releaseName: 'Lokus ${{ github.ref_name }}' | |
| releaseBody: | | |
| 🚀 **Lokus ${{ github.ref_name }}** | |
| See [CHANGELOG.md](https://github.com/lokus-ai/lokus/blob/main/CHANGELOG.md) for full details. | |
| --- | |
| ## 📦 Installation | |
| **🍎 macOS** | |
| - Download `Lokus_x64.app.tar.gz` or `.dmg` | |
| - Apple Silicon: Universal binary included | |
| **🪟 Windows** | |
| - Download `.msi` for installer | |
| - Or `.exe` for portable version | |
| **🐧 Linux** | |
| - Ubuntu/Debian: `.deb` | |
| - Fedora/RHEL: `.rpm` | |
| - Universal: `.AppImage` | |
| --- | |
| **Full Changelog**: https://github.com/lokus-ai/lokus/compare/${{ github.event.before }}...${{ github.ref_name }} | |
| releaseDraft: false | |
| prerelease: ${{ contains(github.ref_name, 'beta') || contains(github.ref_name, 'alpha') || contains(github.ref_name, 'rc') }} | |
| # App Store Build - Only runs for stable releases (no beta/alpha/rc) | |
| release-appstore: | |
| runs-on: macos-latest | |
| needs: release | |
| if: ${{ !contains(github.ref_name, 'beta') && !contains(github.ref_name, 'alpha') && !contains(github.ref_name, 'rc') }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Rust setup | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Rust cache | |
| uses: swatinem/rust-cache@v2 | |
| with: | |
| workspaces: './src-tauri -> target' | |
| - name: Sync node version and setup cache | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 'lts/*' | |
| - name: Install frontend dependencies | |
| run: npm install | |
| - name: Install App Store Certificates | |
| env: | |
| APPLE_APPSTORE_CERTIFICATE: ${{ secrets.APPLE_APPSTORE_CERTIFICATE }} | |
| APPLE_INSTALLER_CERTIFICATE: ${{ secrets.APPLE_INSTALLER_CERTIFICATE }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| APPLE_PROVISIONING_PROFILE: ${{ secrets.APPLE_PROVISIONING_PROFILE }} | |
| run: | | |
| # Create keychain | |
| KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db | |
| KEYCHAIN_PASSWORD=$(openssl rand -base64 32) | |
| security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| security set-keychain-settings -lut 21600 $KEYCHAIN_PATH | |
| security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| # Import App Store Application certificate | |
| echo "$APPLE_APPSTORE_CERTIFICATE" | base64 --decode > $RUNNER_TEMP/appstore.p12 | |
| security import $RUNNER_TEMP/appstore.p12 -P "$APPLE_CERTIFICATE_PASSWORD" \ | |
| -A -t cert -f pkcs12 -k $KEYCHAIN_PATH | |
| # Import Installer certificate | |
| echo "$APPLE_INSTALLER_CERTIFICATE" | base64 --decode > $RUNNER_TEMP/installer.p12 | |
| security import $RUNNER_TEMP/installer.p12 -P "$APPLE_CERTIFICATE_PASSWORD" \ | |
| -A -t cert -f pkcs12 -k $KEYCHAIN_PATH | |
| security list-keychain -d user -s $KEYCHAIN_PATH | |
| security set-key-partition-list -S apple-tool:,apple:,codesign: \ | |
| -s -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| # Install provisioning profile | |
| mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles | |
| echo "$APPLE_PROVISIONING_PROFILE" | base64 --decode > \ | |
| ~/Library/MobileDevice/Provisioning\ Profiles/embedded.provisionprofile | |
| # Verify certificates | |
| security find-identity -v -p codesigning $KEYCHAIN_PATH | |
| - name: Build App Store Version | |
| env: | |
| GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }} | |
| GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }} | |
| VITE_AUTH_BASE_URL: https://lokusmd.com | |
| VITE_SENTRY_DSN: ${{ secrets.VITE_SENTRY_DSN }} | |
| VITE_ENABLE_CRASH_REPORTS: 'true' | |
| VITE_SENTRY_ENVIRONMENT: 'production' | |
| # Supabase Auth | |
| VITE_SUPABASE_URL: ${{ secrets.VITE_SUPABASE_URL }} | |
| VITE_SUPABASE_ANON_KEY: ${{ secrets.VITE_SUPABASE_ANON_KEY }} | |
| # Analytics (PostHog) | |
| VITE_POSTHOG_KEY: ${{ secrets.VITE_POSTHOG_KEY }} | |
| VITE_POSTHOG_HOST: ${{ secrets.VITE_POSTHOG_HOST }} | |
| # Mac App Store - disable update checker | |
| VITE_DISABLE_UPDATE_CHECKER: 'true' | |
| run: | | |
| npm run build | |
| cd src-tauri | |
| cargo tauri build --config tauri.appstore.conf.json | |
| - name: Sign and Package for App Store | |
| env: | |
| APPLE_APPSTORE_SIGNING_IDENTITY: ${{ secrets.APPLE_APPSTORE_SIGNING_IDENTITY }} | |
| APPLE_INSTALLER_SIGNING_IDENTITY: ${{ secrets.APPLE_INSTALLER_SIGNING_IDENTITY }} | |
| run: | | |
| APP_PATH="src-tauri/target/release/bundle/macos/Lokus.app" | |
| PKG_PATH="src-tauri/target/release/Lokus-${{ github.ref_name }}-appstore.pkg" | |
| # Embed provisioning profile | |
| cp ~/Library/MobileDevice/Provisioning\ Profiles/embedded.provisionprofile \ | |
| "$APP_PATH/Contents/embedded.provisionprofile" | |
| # Sign the app with App Store identity | |
| codesign --deep --force --verify --verbose \ | |
| --sign "$APPLE_APPSTORE_SIGNING_IDENTITY" \ | |
| --entitlements src-tauri/entitlements-appstore.plist \ | |
| "$APP_PATH" | |
| # Create installer package | |
| productbuild --sign "$APPLE_INSTALLER_SIGNING_IDENTITY" \ | |
| --component "$APP_PATH" /Applications \ | |
| "$PKG_PATH" | |
| # Verify the package | |
| pkgutil --check-signature "$PKG_PATH" | |
| - name: Upload App Store Package | |
| uses: softprops/action-gh-release@v1 | |
| with: | |
| files: src-tauri/target/release/Lokus-${{ github.ref_name }}-appstore.pkg | |
| tag_name: ${{ github.ref_name }} |