Skip to content

Bump to electron v40 and other electron-related packages #9716

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
pierremtb wants to merge 6 commits into
base: main
Choose a base branch
from
+920 −621
Draft

Bump to electron v40 and other electron-related packages #9716

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
2d1d90f
Bump to electron v40 and other electron-related packages
pierremtb Jan 16, 2026
ccb320b
Force release build
pierremtb Jan 16, 2026
e9b9d3b
Force release build (II)
pierremtb Jan 16, 2026
de45de1
Add process.versions log
pierremtb Jan 16, 2026
da1ff52
Set version to 255.255.0 to prevent auto updates
pierremtb Jan 16, 2026
9a202d7
Revert "Set version to 255.255.0 to prevent auto updates"
pierremtb Jan 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions .github/workflows/build-apps.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
name: build-apps

Check warning on line 1 in .github/workflows/build-apps.yml

View workflow job for this annotation

GitHub Actions / zizmor

excessive-permissions 

build-apps.yml:1: overly broad permissions: default permissions used due to no permissions: block

on:
pull_request:
Expand All @@ -9,7 +9,8 @@
- 'v[0-9]+.[0-9]+.[0-9]+'

env:
IS_RELEASE: ${{ github.ref_type == 'tag' && startsWith(github.ref_name, 'v') }}
# IS_RELEASE: ${{ github.ref_type == 'tag' && startsWith(github.ref_name, 'v') }}
IS_RELEASE: true
IS_STAGING: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}

concurrency:
Expand All @@ -17,15 +18,15 @@
cancel-in-progress: true

jobs:
prepare-files:

Check warning on line 21 in .github/workflows/build-apps.yml

View workflow job for this annotation

GitHub Actions / zizmor

excessive-permissions 

build-apps.yml:21: overly broad permissions: default permissions used due to no permissions: block
runs-on: namespace-profile-ubuntu-8-cores
outputs:
version: ${{ steps.export_version.outputs.version }}
notes: ${{ steps.export_notes.outputs.notes }}
steps:
- uses: actions/checkout@v6

Check warning on line 27 in .github/workflows/build-apps.yml

View workflow job for this annotation

GitHub Actions / zizmor

artipacked 

build-apps.yml:27: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false

- uses: actions/setup-node@v6

Check failure on line 29 in .github/workflows/build-apps.yml

View workflow job for this annotation

GitHub Actions / zizmor

cache-poisoning 

build-apps.yml:29: runtime artifacts potentially vulnerable to a cache poisoning attack: this step
with:
node-version-file: '.nvmrc'
cache: 'npm'
Expand Down Expand Up @@ -58,7 +59,7 @@
set -euox pipefail
# Build wasm if this is a push to main or tag, there are Rust changes, or
# downloading from the wasm cache failed.
if [[ ${{github.event_name}} == 'push' || ${{steps.filter.outputs.rust}} == 'true' || ${{steps.download-wasm.outcome}} == 'failure' ]]; then

Check notice on line 62 in .github/workflows/build-apps.yml

View workflow job for this annotation

GitHub Actions / zizmor

template-injection 

build-apps.yml:62: code injection via template expansion: may expand into attacker-controllable code

Check notice on line 62 in .github/workflows/build-apps.yml

View workflow job for this annotation

GitHub Actions / zizmor

template-injection 

build-apps.yml:62: code injection via template expansion: may expand into attacker-controllable code
echo "should-build-wasm=true" >> $GITHUB_OUTPUT
else
echo "should-build-wasm=false" >> $GITHUB_OUTPUT
Expand All @@ -84,7 +85,7 @@

- name: Rust Cache
if: ${{ steps.wasm.outputs.should-build-wasm == 'true' }}
uses: Swatinem/rust-cache@v2

Check failure on line 88 in .github/workflows/build-apps.yml

View workflow job for this annotation

GitHub Actions / zizmor

cache-poisoning 

build-apps.yml:88: runtime artifacts potentially vulnerable to a cache poisoning attack: enables caching by default
with:
workspaces: rust

Expand All @@ -109,8 +110,8 @@
env:
WINDOWS_CERTIFICATE_THUMBPRINT: ${{ secrets.WINDOWS_CERTIFICATE_ZOO_THUMBPRINT }}
run: |
export VERSION=${GITHUB_REF_NAME#v}
npm run files:set-version
# export VERSION=${GITHUB_REF_NAME#v}
# npm run files:set-version
npm run files:set-windows-codesign-config

- uses: actions/upload-artifact@v6
Expand All @@ -131,7 +132,7 @@
run: echo "notes=`cat release-notes.md`" >> "$GITHUB_OUTPUT"


build-apps:

Check warning on line 135 in .github/workflows/build-apps.yml

View workflow job for this annotation

GitHub Actions / zizmor

excessive-permissions 

build-apps.yml:135: overly broad permissions: default permissions used due to no permissions: block
needs: [prepare-files]
strategy:
fail-fast: false
Expand All @@ -148,7 +149,7 @@
env:
VERSION_NO_V: ${{ needs.prepare-files.outputs.version }}
steps:
- uses: actions/checkout@v6

Check warning on line 152 in .github/workflows/build-apps.yml

View workflow job for this annotation

GitHub Actions / zizmor

artipacked 

build-apps.yml:152: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false

- uses: actions/download-artifact@v4
name: prepared-files
Expand All @@ -166,7 +167,7 @@
cp prepared-files/assets/icon.png assets/icon.png

- name: Sync node version and setup cache
uses: actions/setup-node@v6

Check failure on line 170 in .github/workflows/build-apps.yml

View workflow job for this annotation

GitHub Actions / zizmor

cache-poisoning 

build-apps.yml:170: runtime artifacts potentially vulnerable to a cache poisoning attack: this step
with:
node-version-file: '.nvmrc'
cache: 'npm' # Set this to npm, npm or pnpm.
Expand Down Expand Up @@ -222,6 +223,7 @@
CSC_LINK: ${{ secrets.APPLE_CERTIFICATE }}
CSC_KEY_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
CSC_KEYCHAIN: ${{ secrets.APPLE_SIGNING_IDENTITY }}
CSC_FOR_PULL_REQUEST: true
# Windows codesign config is part of electron-builder.yml and handled in prepare-files
run: npm run tronb:package:${{ env.IS_STAGING == 'true' && 'dev' || 'prod' }}

Expand Down Expand Up @@ -267,7 +269,7 @@
VERSION: ${{ format('v{0}', needs.prepare-files.outputs.version) }}
needs: [prepare-files, build-apps]
steps:
- uses: actions/checkout@v6

Check warning on line 272 in .github/workflows/build-apps.yml

View workflow job for this annotation

GitHub Actions / zizmor

artipacked 

build-apps.yml:272: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false

- uses: actions/download-artifact@v4
with:
Expand Down Expand Up @@ -326,8 +328,8 @@
--arg version "${VERSION}" \
--arg pub_date "${PUB_DATE}" \
--arg notes "${NOTES}" \
--arg mac_arm64_url "$RELEASE_DIR/${{ env.URL_CODED_NAME }}-${VERSION_NO_V}-arm64-mac.dmg" \

Check warning on line 331 in .github/workflows/build-apps.yml

View workflow job for this annotation

GitHub Actions / zizmor

template-injection 

build-apps.yml:331: code injection via template expansion: may expand into attacker-controllable code
--arg mac_x64_url "$RELEASE_DIR/${{ env.URL_CODED_NAME }}-${VERSION_NO_V}-x64-mac.dmg" \

Check warning on line 332 in .github/workflows/build-apps.yml

View workflow job for this annotation

GitHub Actions / zizmor

template-injection 

build-apps.yml:332: code injection via template expansion: may expand into attacker-controllable code
--arg windows_arm64_url "$RELEASE_DIR/${{ env.URL_CODED_NAME }}-${VERSION_NO_V}-arm64-win.exe" \
--arg windows_x64_url "$RELEASE_DIR/${{ env.URL_CODED_NAME }}-${VERSION_NO_V}-x64-win.exe" \
--arg linux_arm64_url "$RELEASE_DIR/${{ env.URL_CODED_NAME }}-${VERSION_NO_V}-arm64-linux.AppImage" \
Expand Down
Loading
Loading