build(release): 同步 0.1.5 发版版本入口 #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: macos-release-on-tag | ||
|
Check failure on line 1 in .github/workflows/macos-release-on-tag.yml
|
||
| on: | ||
| push: | ||
| tags: | ||
| - "mac-v*" | ||
| permissions: | ||
| contents: write | ||
| jobs: | ||
| release: | ||
| runs-on: macos-14 | ||
| env: | ||
| DEEPLX_URL: http://127.0.0.1:1188/translate | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v5 | ||
| with: | ||
| fetch-depth: 0 | ||
| - name: Setup Python | ||
| uses: actions/setup-python@v6 | ||
| with: | ||
| python-version: "3.11" | ||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v6 | ||
| with: | ||
| node-version: "20" | ||
| cache: "npm" | ||
| cache-dependency-path: desktop-shell/package-lock.json | ||
| - name: Setup Rust | ||
| uses: dtolnay/rust-toolchain@stable | ||
| - name: Install Python dependencies | ||
| run: | | ||
| python3 -m pip install --upgrade pip | ||
| python3 -m pip install pyinstaller | ||
| python3 -m pip install -r requirements.txt | ||
| - name: Install desktop-shell dependencies | ||
| working-directory: desktop-shell | ||
| run: npm ci | ||
| - name: Validate macOS signing inputs | ||
| shell: bash | ||
| env: | ||
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | ||
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | ||
| APPLE_ID: ${{ secrets.APPLE_ID }} | ||
| APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }} | ||
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | ||
| APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }} | ||
| APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }} | ||
| APPLE_API_PRIVATE_KEY: ${{ secrets.APPLE_API_PRIVATE_KEY }} | ||
| run: | | ||
| set -euo pipefail | ||
| if [[ -z "${APPLE_CERTIFICATE}" || -z "${APPLE_CERTIFICATE_PASSWORD}" ]]; then | ||
| echo "Missing APPLE_CERTIFICATE / APPLE_CERTIFICATE_PASSWORD GitHub secrets for macOS code signing." >&2 | ||
| exit 1 | ||
| fi | ||
| has_apple_id_creds=false | ||
| if [[ -n "${APPLE_ID}" || -n "${APPLE_PASSWORD}" || -n "${APPLE_TEAM_ID}" ]]; then | ||
| if [[ -z "${APPLE_ID}" || -z "${APPLE_PASSWORD}" || -z "${APPLE_TEAM_ID}" ]]; then | ||
| echo "APPLE_ID / APPLE_PASSWORD / APPLE_TEAM_ID must be configured together." >&2 | ||
| exit 1 | ||
| fi | ||
| has_apple_id_creds=true | ||
| fi | ||
| has_api_key_creds=false | ||
| if [[ -n "${APPLE_API_KEY}" || -n "${APPLE_API_ISSUER}" || -n "${APPLE_API_PRIVATE_KEY}" ]]; then | ||
| if [[ -z "${APPLE_API_KEY}" || -z "${APPLE_API_ISSUER}" || -z "${APPLE_API_PRIVATE_KEY}" ]]; then | ||
| echo "APPLE_API_KEY / APPLE_API_ISSUER / APPLE_API_PRIVATE_KEY must be configured together." >&2 | ||
| exit 1 | ||
| fi | ||
| has_api_key_creds=true | ||
| fi | ||
| if [[ "${has_apple_id_creds}" != "true" && "${has_api_key_creds}" != "true" ]]; then | ||
| echo "Missing notarization credentials. Configure either Apple ID secrets or App Store Connect API key secrets." >&2 | ||
| exit 1 | ||
| fi | ||
| - name: Prepare App Store Connect API key | ||
| if: ${{ secrets.APPLE_API_KEY != '' }} | ||
| shell: bash | ||
| env: | ||
| APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }} | ||
| APPLE_API_PRIVATE_KEY: ${{ secrets.APPLE_API_PRIVATE_KEY }} | ||
| run: | | ||
| set -euo pipefail | ||
| api_key_path="$RUNNER_TEMP/AuthKey_${APPLE_API_KEY}.p8" | ||
| printf '%s' "${APPLE_API_PRIVATE_KEY}" > "$api_key_path" | ||
| chmod 600 "$api_key_path" | ||
| echo "APPLE_API_KEY_PATH=$api_key_path" >> "$GITHUB_ENV" | ||
| - name: Build desktop-shell sidecars | ||
| run: python3 scripts/build_desktop_shell_sidecars.py --python python3 | ||
| - name: Run desktop-shell frontend tests | ||
| working-directory: desktop-shell | ||
| run: npm test | ||
| - name: Build desktop-shell frontend dist | ||
| working-directory: desktop-shell | ||
| run: npm run build | ||
| - name: Run desktop-shell Rust tests | ||
| working-directory: desktop-shell | ||
| run: npm run test:rust | ||
| - name: Build desktop-shell macOS app release | ||
| working-directory: desktop-shell | ||
| env: | ||
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | ||
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | ||
| APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }} | ||
| APPLE_ID: ${{ secrets.APPLE_ID }} | ||
| APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }} | ||
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | ||
| APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }} | ||
| APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }} | ||
| APPLE_API_KEY_PATH: ${{ env.APPLE_API_KEY_PATH }} | ||
| APPLE_PROVIDER_SHORT_NAME: ${{ secrets.APPLE_PROVIDER_SHORT_NAME }} | ||
| run: npm run tauri -- build --bundles app | ||
| - name: Verify signed and notarized macOS app | ||
| shell: bash | ||
| run: | | ||
| set -euo pipefail | ||
| app_bundle="desktop-shell/src-tauri/target/release/bundle/macos/WeChat Auto Shell.app" | ||
| if [[ ! -d "$app_bundle" ]]; then | ||
| echo "missing app bundle: $app_bundle" >&2 | ||
| exit 1 | ||
| fi | ||
| codesign --verify --deep --strict --verbose=2 "$app_bundle" | ||
| spctl --assess --type exec --verbose=4 "$app_bundle" | ||
| xcrun stapler validate "$app_bundle" | ||
| - name: Run desktop-shell release smoke | ||
| run: python3 scripts/smoke_desktop_shell_release.py --skip-build | ||
| - name: Prepare release metadata | ||
| id: release_meta | ||
| shell: bash | ||
| run: | | ||
| set -euo pipefail | ||
| desktop_version="$(python3 -c "import json; package_version=json.load(open('desktop-shell/package.json', encoding='utf-8'))['version']; tauri_version=json.load(open('desktop-shell/src-tauri/tauri.conf.json', encoding='utf-8'))['version']; assert package_version == tauri_version, f'version mismatch package={package_version} tauri={tauri_version}'; print(tauri_version)")" | ||
| if [[ -z "${desktop_version}" ]]; then | ||
| echo "failed to resolve desktop release version" >&2 | ||
| exit 1 | ||
| fi | ||
| release_name="WeChat Auto Shell macOS Apple Silicon ${desktop_version}" | ||
| echo "desktop_version=${desktop_version}" >> "$GITHUB_OUTPUT" | ||
| echo "release_name=${release_name}" >> "$GITHUB_OUTPUT" | ||
| - name: Package macOS release assets | ||
| shell: bash | ||
| env: | ||
| DESKTOP_VERSION: ${{ steps.release_meta.outputs.desktop_version }} | ||
| run: | | ||
| set -euo pipefail | ||
| mkdir -p release-assets | ||
| if [[ -z "${DESKTOP_VERSION}" ]]; then | ||
| echo "missing desktop release version" >&2 | ||
| exit 1 | ||
| fi | ||
| app_bundle="desktop-shell/src-tauri/target/release/bundle/macos/WeChat Auto Shell.app" | ||
| if [[ ! -d "$app_bundle" ]]; then | ||
| echo "missing app bundle: $app_bundle" >&2 | ||
| exit 1 | ||
| fi | ||
| zip_path="release-assets/wechat-auto-shell-${DESKTOP_VERSION}-macos-apple-silicon.zip" | ||
| rm -f "$zip_path" | ||
| ditto -c -k --sequesterRsrc --keepParent "$app_bundle" "$zip_path" | ||
| checksum_path="release-assets/SHA256SUMS.txt" | ||
| hash="$(shasum -a 256 "$zip_path" | awk '{print $1}')" | ||
| printf '%s %s\n' "$hash" "$(basename "$zip_path")" > "$checksum_path" | ||
| - name: Upload workflow artifacts | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: macos-build-assets-${{ github.ref_name }} | ||
| if-no-files-found: error | ||
| path: | | ||
| release-assets/*.zip | ||
| release-assets/SHA256SUMS.txt | ||
| - name: Publish GitHub release | ||
| uses: softprops/action-gh-release@v2 | ||
| with: | ||
| name: ${{ steps.release_meta.outputs.release_name }} | ||
| generate_release_notes: true | ||
| fail_on_unmatched_files: true | ||
| prerelease: ${{ contains(github.ref_name, '-rc.') }} | ||
| files: | | ||
| release-assets/*.zip | ||
| release-assets/SHA256SUMS.txt | ||
