docs(REV-007): unsigned per-arch distribution + install guide; defer … #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Signed, published release build for all three platforms, triggered by a | |
| # version tag (e.g. `v0.1.0`). Artifacts are published to GitHub Releases as a | |
| # DRAFT (see `releaseType: draft` in packages/noodl-editor/package.json), so a | |
| # human confirms and publishes before anything reaches users or the auto-update | |
| # feed. See dev-docs/guidelines/RELEASE-PROCESS.md. | |
| # | |
| # Signing/notarisation are gated on repository secrets. If a secret is absent the | |
| # build still succeeds but that platform's artifact is UNSIGNED (macOS: not | |
| # notarised → Gatekeeper warns; Windows: SmartScreen blocks). The draft gate | |
| # means an unsigned artifact can never be shipped by accident — a human sees it | |
| # first. Required secrets are documented in RELEASE-PROCESS.md. | |
| on: | |
| push: | |
| tags: | |
| - 'v*.*.*' | |
| # Manual dispatch for dry-runs. Publishes a draft from whatever ref is chosen; | |
| # the release is named from package.json's version, not the ref. | |
| workflow_dispatch: | |
| concurrency: | |
| # One release run at a time; do NOT cancel in progress — a half-published | |
| # release is worse than a slow one. | |
| group: release | |
| cancel-in-progress: false | |
| permissions: | |
| contents: write # electron-builder needs this to create/update the GitHub Release. | |
| jobs: | |
| release: | |
| name: ${{ matrix.platform }} | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 90 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - os: ubuntu-latest | |
| platform: linux-x64 | |
| - os: windows-latest | |
| platform: win32-x64 | |
| - os: macos-latest | |
| platform: darwin-arm64 | |
| - os: macos-13 | |
| platform: darwin-x64 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # electron-builder shells out to python on some paths. | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - uses: ./.github/actions/setup | |
| - name: Build viewer bundles | |
| run: npm run build:editor:_viewer | |
| env: | |
| WORKSPACE_PATH: . | |
| - name: Build, sign, and publish the editor | |
| run: npm run build:editor:_editor | |
| env: | |
| WORKSPACE_PATH: . | |
| TARGET_PLATFORM: ${{ matrix.platform }} | |
| # Turn signing ON and publishing ON for the release path. | |
| DISABLE_SIGNING: false | |
| PUBLISH_RELEASE: true | |
| # Token electron-builder uses to create/update the draft GitHub Release. | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # --- macOS signing (Developer ID) + notarisation --- | |
| # CSC_LINK: base64-encoded .p12, CSC_KEY_PASSWORD: its password. | |
| CSC_LINK: ${{ secrets.CSC_LINK }} | |
| CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }} | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| # --- Windows signing --- | |
| WIN_CSC_LINK: ${{ secrets.WIN_CSC_LINK }} | |
| WIN_CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }} |