build.yml

# build.yml

name: Auto Build

on:
  workflow_dispatch:
  push:
    branches:
      - master
    tags:
      - 'v*'  # 只有正式版本标签才触发构建

env:
  # Tauri 自动更新签名密钥
  TAURI_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
  TAURI_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
  # macOS 代码签名 (保留原有的 Xcode 参数)
  XCODE_APP_TEAM_ID: ${{ secrets.XCODE_APP_TEAM_ID }}
  XCODE_APP_LOADER_EMAIL: ${{ secrets.XCODE_APP_LOADER_EMAIL }}
  XCODE_APP_LOADER_PASSWORD: ${{ secrets.XCODE_APP_LOADER_PASSWORD }}
  BUILD_CERTIFICATE_BASE64: ${{ secrets.CSC_LINK }}
  P12_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
  # Windows 代码签名
  CSC_LINK: ${{ secrets.CSC_LINK }}
  CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}

jobs:
  pre-build:
    name: pre-build go client
    runs-on: ubuntu-latest
    outputs:
      go-client-artifacts: ${{ steps.upload-go-client.outputs.artifact-name }}
    
    steps:
      - name: Check out git repository
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v4
        with:
          go-version: '1.21'

      - name: Build Go client for all platforms
        run: make build-all
        working-directory: go-client

      - name: Upload Go client artifacts
        id: upload-go-client
        uses: actions/upload-artifact@v4
        with:
          name: go-client-binaries
          path: go-client/build/
          retention-days: 1

  build:
    name: build tauri app
    runs-on: ${{ matrix.os }}
    needs: pre-build

    strategy:
      fail-fast: false
      matrix:
        os: [macos-14, windows-latest]

    steps:
      - name: Check out git repository
        uses: actions/checkout@v4

      - name: Download Go client artifacts
        uses: actions/download-artifact@v4
        with:
          name: go-client-binaries
          path: go-client/build/

      - name: Setup Go
        uses: actions/setup-go@v4
        with:
          go-version: '1.25'

      - name: Install Go client for current platform
        run: make install
        working-directory: go-client

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '23'
          cache: 'pnpm'

      - name: Install system dependencies (Ubuntu)
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libssl-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev patchelf

      - name: Install system dependencies (macOS)
        if: matrix.os == 'macos-14'
        run: |
          brew install create-dmg


      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Cache Rust dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            src-tauri/target/
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-

      - name: Install Tauri CLI
        run: cargo install tauri-cli@^2.0

      - name: Install frontend dependencies
        run: pnpm install

      - name: Build frontend
        run: pnpm generate

      - name: Build Tauri app
        run: pnpm tauri:build
        env:
          TAURI_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
          TAURI_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
          XCODE_APP_TEAM_ID: ${{ secrets.XCODE_APP_TEAM_ID }}
          XCODE_APP_LOADER_EMAIL: ${{ secrets.XCODE_APP_LOADER_EMAIL }}
          XCODE_APP_LOADER_PASSWORD: ${{ secrets.XCODE_APP_LOADER_PASSWORD }}
          BUILD_CERTIFICATE_BASE64: ${{ secrets.CSC_LINK }}
          P12_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.os }}-app
          path: |
            src-tauri/target/release/bundle/deb/*.deb
            src-tauri/target/release/bundle/rpm/*.rpm
            src-tauri/target/release/bundle/appimage/*.AppImage
            src-tauri/target/release/bundle/dmg/*.dmg
            src-tauri/target/release/bundle/macos/*.app
            src-tauri/target/release/bundle/nsis/*.exe
            src-tauri/target/release/bundle/msi/*.msi

  release:
    name: create release
    runs-on: ubuntu-latest
    needs: [pre-build, build]
    if: startsWith(github.ref, 'refs/tags/')
    
    steps:
      - name: Check out git repository
        uses: actions/checkout@v4

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Generate latest.json
        run: |
          echo '{
            "version": "${{ github.ref_name }}",
            "notes": "Release ${{ github.ref_name }}",
            "pub_date": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'",
            "platforms": {
              "darwin-x86_64": {
                "signature": "",
                "url": "https://github.com/jumpserver/clients/releases/download/${{ github.ref_name }}/JumpServerClient_${{ github.ref_name }}_x86_64.dmg"
              },
              "darwin-aarch64": {
                "signature": "",
                "url": "https://github.com/jumpserver/clients/releases/download/${{ github.ref_name }}/JumpServerClient_${{ github.ref_name }}_aarch64.dmg"
              },
              "windows-x86_64": {
                "signature": "",
                "url": "https://github.com/jumpserver/clients/releases/download/${{ github.ref_name }}/JumpServerClient_${{ github.ref_name }}_x64.msi"
              }
            }
          }' > latest.json

      - name: Create Release
        uses: softprops/action-gh-release@v1
        with:
          draft: true
          files: |
            latest.json
            artifacts/macos-14-app/*.dmg
            artifacts/macos-14-app/*.app
            artifacts/windows-latest-app/*.msi
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}