fix(installer): stop UAC auto-elevation + never hang on install error #8
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # On a version tag (v*), build the digstore CLI in release mode and produce ONE | |
| # run-once installer artifact per OS. The digstore binary is embedded directly | |
| # into the installer (build.rs), so each download is a single self-contained | |
| # file that, when run, installs digstore — no installer-installs-the-installer: | |
| # | |
| # * Windows → DigStore-Setup-<ver>-windows-x64.exe (raw Tauri exe, no NSIS/MSI) | |
| # * macOS → DigStore-Setup-<ver>-macos.dmg (one mountable run-once .app) | |
| # * Linux → DigStore-Setup-<ver>-linux-x86_64.AppImage (single executable) | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| # Only the write scope needed to publish the release + upload the asset. | |
| permissions: | |
| contents: write | |
| env: | |
| CARGO_TERM_COLOR: always | |
| CARGO_INCREMENTAL: "0" | |
| jobs: | |
| installer: | |
| name: Installer (${{ matrix.os }}) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - os: windows-latest | |
| bin: digstore.exe | |
| # Windows ships the raw, self-contained exe (no NSIS/MSI wrapper). | |
| build_args: "--no-bundle" | |
| artifact_glob: "src-tauri/target/release/*.exe" | |
| out_name: "windows-x64.exe" | |
| - os: macos-latest | |
| bin: digstore | |
| build_args: "--bundles dmg" | |
| artifact_glob: "src-tauri/target/release/bundle/dmg/*.dmg" | |
| out_name: "macos.dmg" | |
| - os: ubuntu-22.04 | |
| bin: digstore | |
| build_args: "--bundles appimage" | |
| artifact_glob: "src-tauri/target/release/bundle/appimage/*.AppImage" | |
| out_name: "linux-x86_64.AppImage" | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Install pinned Rust toolchain | |
| run: | | |
| rustup show # installs the toolchain pinned in rust-toolchain.toml (incl. wasm32 target) | |
| rustc --version | |
| # Linux needs the webkit2gtk stack for Tauri. | |
| - name: Install Linux Tauri deps | |
| if: runner.os == 'Linux' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20" | |
| - name: Cache cargo + targets | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry/index | |
| ~/.cargo/registry/cache | |
| ~/.cargo/git/db | |
| target | |
| installer/app/src-tauri/target | |
| key: ${{ runner.os }}-tauri-release-${{ hashFiles('**/Cargo.lock', 'installer/app/src-tauri/Cargo.toml', 'installer/app/package-lock.json') }} | |
| restore-keys: ${{ runner.os }}-tauri-release- | |
| # digstore-cli's build.rs embeds the real guest wasm (BINDING contract D6). | |
| - name: Build guest wasm | |
| run: cargo build -p digstore-guest --target wasm32-unknown-unknown --release --locked | |
| - name: Build digstore CLI (release) | |
| run: cargo build -p digstore-cli --release --locked | |
| - name: Derive version from tag | |
| shell: bash | |
| run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV" | |
| - name: Install frontend deps | |
| working-directory: installer/app | |
| run: npm ci || npm install | |
| # Stage the just-built digstore binary so the installer's build.rs embeds | |
| # it (single-file install) + records its SHA-256 for the verify gate. | |
| - name: Stage bundled digstore binary | |
| working-directory: installer/app | |
| run: node scripts/stage-binary.mjs --src ../../target/release/${{ matrix.bin }} | |
| - name: Build the installer | |
| working-directory: installer/app | |
| run: npx tauri build ${{ matrix.build_args }} | |
| - name: Collect single installer artifact | |
| id: collect | |
| shell: bash | |
| working-directory: installer/app | |
| run: | | |
| mkdir -p ../../dist-installers | |
| artifact="$(ls -1 ${{ matrix.artifact_glob }} | head -n1)" | |
| if [ -z "$artifact" ]; then | |
| echo "no artifact matched ${{ matrix.artifact_glob }}"; exit 1 | |
| fi | |
| dest="../../dist-installers/DigStore-Setup-${VERSION}-${{ matrix.out_name }}" | |
| cp "$artifact" "$dest" | |
| echo "staged $dest" | |
| ls -la ../../dist-installers | |
| - name: Upload installer as workflow artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: digstore-installer-${{ matrix.os }} | |
| path: dist-installers/* | |
| if-no-files-found: error | |
| # --------------------------------------------------------------------------- | |
| # Single publish job — runs after ALL matrix builds so there is no race to | |
| # create the GitHub Release (the previous per-matrix publish raced: the first | |
| # job created the release, the others 401'd / "release not found"). | |
| # --------------------------------------------------------------------------- | |
| publish: | |
| name: Publish release | |
| needs: installer | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Download all installer artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: dist | |
| - name: Publish to GitHub Release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| mkdir -p dist-all | |
| find dist -type f -exec cp {} dist-all/ \; | |
| ls -la dist-all | |
| gh release create "${GITHUB_REF_NAME}" --title "digstore ${GITHUB_REF_NAME}" --generate-notes || echo "release already exists" | |
| gh release upload "${GITHUB_REF_NAME}" dist-all/* --clobber |