-
Notifications
You must be signed in to change notification settings - Fork 6
2311 lines (2100 loc) · 101 KB
/
release.yml
File metadata and controls
2311 lines (2100 loc) · 101 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
name: Release Build eCan
# ============================================================================
# Workflow Overview
# ============================================================================
# This workflow builds and releases eCan application for multiple platforms.
#
# Architecture:
# - validate-tag: Validates git ref and computes version
# - build-windows: Builds Windows amd64 installer
# - build-macos: Matrix build for macOS (amd64 + aarch64)
# - upload-to-s3: Uploads artifacts to S3 and generates OTA feeds
#
# ============================================================================
# Configuration Parameters
# ============================================================================
# Build platform, CPU architecture and reference can be selected via workflow_dispatch:
# - platform: windows, macos, all
# - arch: amd64, aarch64, all
# - ref: Branch name or tag (e.g., gui-v2, master, v0.0.4)
# - upload_artifacts: Upload to GitHub Artifacts (default: false to save costs)
#
# Platform Support:
# - Windows: amd64 only (GitHub Actions has no ARM64 runner)
# - macOS: amd64 (Intel) + aarch64 (Apple Silicon)
#
# ============================================================================
# Artifact Storage Strategy (Cost Optimization)
# ============================================================================
# - S3 Upload: ALWAYS happens when build succeeds (primary storage)
# - GitHub Artifacts: OPTIONAL (default: disabled) - only for debugging
# - Cost Saving: GitHub Artifacts ~$0.008/GB/day, S3 is much cheaper
#
# AUTOMATIC CLEANUP (Cost Optimization):
# - S3 transfer artifacts: retention-days: 1 (auto-delete after 1 day)
# - User download artifacts: retention-days: 7 (only if enabled)
# - Compression: level 6 (balance between size and speed)
# - Estimated cost: ~$0.14/month (10 builds, S3 transfer only)
#
# See: docs/GITHUB_ARTIFACTS_COST_OPTIMIZATION.md for details
#
# ============================================================================
# Tag and Release Format Guide
# ============================================================================
#
# VERSION TAG FORMAT:
# Production Release: v1.0.0, v1.2.3, v2.0.0
# Release Candidate: v1.0.0-rc.1, v1.0.0-rc.2
# Beta Release: v1.0.0-beta.1, v1.0.0-beta.2
# Alpha Release: v1.0.0-alpha.1
#
# ============================================================================
# ENVIRONMENT & CHANNEL MAPPING (Standard Industry Practice)
# ============================================================================
#
# Git Ref → Environment → Channel → S3 Path
# ─────────────────────────────────────────────────────────────────────────
# v1.0.0 → production → stable → production/channels/stable/
# v1.0.0-rc.1 → production → beta → production/channels/beta/
# v1.0.0-beta.1 → staging → beta → staging/channels/beta/
# v1.0.0-alpha.1 → test → dev → test/channels/dev/
# main/master branch → production → nightly → production/channels/nightly/
# staging branch → staging → stable → staging/channels/stable/
# develop/dev branch → development → dev → development/channels/dev/
# feature/* branches → development → dev → development/channels/dev/
#
# ============================================================================
# KEY CONCEPTS
# ============================================================================
#
# ENVIRONMENT (部署环境级别):
# - production: 生产环境 - 最高质量标准,面向所有用户
# - staging: 预发布环境 - 生产前最后验证
# - test: 测试环境 - 内部测试
# - development: 开发环境 - 开发和调试
#
# CHANNEL (更新渠道):
# - stable: 稳定版本 - 经过充分测试,推荐所有用户使用
# - beta: 测试版本 - 功能完整,可能有 bug,适合尝鲜用户
# - nightly: 每日构建 - 最新功能,来自 main 分支,适合开发者
# - dev: 开发版本 - 不稳定,仅供开发测试
#
# ============================================================================
# PRODUCTION ENVIRONMENT RULES
# ============================================================================
#
# Production 环境包含两个渠道:
# 1. stable channel (production/channels/stable/)
# - 来源:正式版本 tag (v1.0.0)
# - 用户:所有用户(默认更新渠道)
# - 特点:经过完整测试,最稳定
#
# 2. nightly channel (production/channels/nightly/)
# - 来源:main/master 分支的每日构建
# - 用户:尝鲜用户、开发者
# - 特点:最新功能,质量达到生产级别但未经长期验证
#
# 3. beta channel (production/channels/beta/)
# - 来源:RC tag (v1.0.0-rc.1)
# - 用户:测试用户
# - 特点:候选版本,即将成为 stable
#
# 为什么 main/master 是 production environment?
# ✅ main 分支应该始终保持生产级别的代码质量
# ✅ 符合 CI/CD 最佳实践:main = production-ready
# ✅ 与主流软件一致(Chrome/VS Code/Firefox 等)
# ✅ 通过 channel 区分稳定性,而不是通过 environment
#
# ============================================================================
# PROTECTION RULES
# ============================================================================
#
# 1. production/stable channel 保护:
# ⚠️ ONLY 正式版本 tag (v1.0.0) 可以部署
# ⚠️ 任何分支(包括 main/master)都不能部署到 stable channel
# ⚠️ 防止意外覆盖稳定版本
#
# 2. production/nightly channel:
# ✅ 只接受 main/master 分支
# ✅ 每次提交自动构建
# ✅ 不会影响 stable channel
#
# 3. 其他环境:
# - staging: 接受 staging 分支和 beta/rc tags
# - test: 接受 alpha tags 和测试分支
# - development: 接受所有开发分支
#
# HOW TO CREATE A RELEASE:
#
# Method 1: Create Git Tag (Recommended for production)
# git tag -a v1.0.0 -m "Release version 1.0.0"
# git push origin v1.0.0
#
# Method 2: Create GitHub Release
# 1. Go to: https://github.com/your-org/eCan.ai/releases/new
# 2. Tag version: v1.0.0
# 3. Release title: eCan.ai v1.0.0
# 4. Description: Copy from CHANGELOG.md
# 5. Click "Publish release"
#
# Method 3: Manual Trigger (for testing or branch builds)
# 1. Go to: Actions → Release Build eCan → Run workflow
# 2. Use workflow from: Select branch
# 3. Enter ref: branch/tag (leave EMPTY to auto-sync with workflow branch)
# 4. Select platform and architecture
# 5. Click "Run workflow"
#
# IMPORTANT: "Use workflow from" vs "ref"
# - Use workflow from: Which branch's workflow file to use
# - ref: Which branch/tag's code to build (EMPTY = auto-sync)
#
# AUTO-SYNC FEATURE:
# - If ref is empty, it automatically uses the workflow branch
# - Example: Use workflow from=main, ref=(empty) → builds main
# - Example: Use workflow from=gui-v2, ref=(empty) → builds gui-v2
#
# MANUAL OVERRIDE:
# - Example: Use workflow from=main, ref=v1.0.0 → builds v1.0.0 tag
# - Example: Use workflow from=feature/fix, ref=main → test new workflow
#
# ============================================================================
# USAGE EXAMPLES (使用示例)
# ============================================================================
#
# 场景 1: 发布正式版本 (Stable Release)
# 操作:git tag v1.0.0 && git push origin v1.0.0
# 结果:production/stable/appcast-*.xml
# 用户:所有用户(默认更新渠道)
#
# 场景 2: 发布候选版本 (Release Candidate)
# 操作:git tag v1.0.0-rc.1 && git push origin v1.0.0-rc.1
# 结果:production/beta/appcast-*.xml
# 用户:测试用户
#
# 场景 3: main/master 分支每日构建 (Nightly Build)
# 操作:git push origin main
# 结果:production/nightly/appcast-*.xml
# 用户:开发者、尝鲜用户
# 说明:自动触发,无需手动操作
#
# 场景 4: 测试新功能 (Feature Branch)
# 操作:Manual trigger with ref=feature/new-ui
# 结果:development/dev/appcast-*.xml
# 用户:内部开发测试
#
# 场景 5: 预发布验证 (Staging)
# 操作:git push origin staging
# 结果:staging/stable/appcast-*.xml
# 用户:预发布测试团队
#
# ============================================================================
# MANUAL TRIGGER GUIDE (手动触发指南)
# ============================================================================
#
# 在 GitHub Actions 界面选择参数时:
#
# 1. 构建 main 分支的 nightly 版本(推荐 - 自动检测):
# - ref: (留空或填 main)
# - environment: (留空 - 自动检测为 production)
# - channel: (留空 - 自动检测为 nightly)
# ✅ 结果:production/nightly/
#
# 2. 构建正式版本(推荐 - 自动检测):
# - ref: v1.0.0
# - environment: (留空 - 自动检测为 production)
# - channel: (留空 - 自动检测为 stable)
# ✅ 结果:production/stable/
#
# 3. 测试功能分支(推荐 - 自动检测):
# - ref: feature/my-feature
# - environment: (留空 - 自动检测为 development)
# - channel: (留空 - 自动检测为 dev)
# ✅ 结果:development/dev/
#
# 4. 强制指定环境和渠道(高级用户 - 手动覆盖):
# - ref: main
# - environment: production
# - channel: nightly
# ✅ 结果:production/nightly/
#
# ⚠️ 注意:
# - 如果手动选择 production + stable,必须使用 tag (v1.0.0)
# - main/master 分支不能使用 stable channel
# - 推荐留空让系统自动检测(更安全、更准确)
#
# VERSION CALCULATION:
# - Tag (v1.0.0): → 1.0.0
# - Branch (gui-v2): → 1.0.1-gui-v2-abc1234 (from VERSION file + branch + commit)
# - Branch (main): → 1.0.1-main-abc1234
#
# ============================================================================
# Trigger Examples
# ============================================================================
# - Manual: Enter branch/tag name in workflow_dispatch
# - Auto: Push tag or publish release (default: all platforms + amd64)
on:
# Trigger conditions: create tag or release
# push:
# tags:
# - 'v*' # Match formats like v1.0.0, v2.1.3
# release:
# types: [published, edited, created]
# Manual trigger
workflow_dispatch:
inputs:
platform:
description: 'Build platform (windows, macos, all)'
required: true
default: 'all'
type: choice
options:
- all
- windows
- macos
arch:
description: 'CPU architecture (all: build all supported, amd64: x86_64 only, aarch64: ARM64 only)'
required: true
default: 'all'
type: choice
options:
- all
- amd64
- aarch64
ref:
description: 'Git ref to build (leave empty to use same as workflow branch)'
required: false
default: ''
type: string
environment:
description: |
Target environment (目标环境):
📋 自动检测规则:
• v1.0.0 → production/stable
• v1.0.0-rc.1 → production/beta
• main/master → production/nightly
• staging branch → staging/stable
• develop/dev → development/dev
⚠️ 环境说明:
- production: 生产环境 (仅限 tags + main/master)
- staging: 预发布环境
- test: 测试环境
- development: 开发环境
- (留空): 自动检测
required: false
default: 'production'
type: choice
options:
- production
- ''
- staging
- test
- development
channel:
description: |
Release channel (更新渠道):
📋 自动检测规则:
• v1.0.0 → stable
• v1.0.0-rc.1 → beta
• main/master → nightly
• develop/dev → dev
⚠️ 渠道说明:
- stable: 稳定版本 (仅限正式 tag)
- beta: 测试版本
- nightly: 每日构建
- dev: 开发版本
- (留空): 自动检测
required: false
default: 'stable'
type: choice
options:
- stable
- ''
- beta
- nightly
- dev
upload_artifacts:
description: 'Upload build artifacts to GitHub Artifacts (for debugging only, costs extra storage). S3 upload always happens regardless of this setting.'
required: false
default: 'false'
type: choice
options:
- 'true'
- 'false'
concurrency:
group: ecan-release-${{ github.ref }}-${{ github.event.inputs.platform }}-${{ github.event.inputs.arch }}
cancel-in-progress: true
jobs:
# ============================================================================
# Validation Layer: Validate ref and compute version
# Tags produce semantic version; branches get fallback version
# ============================================================================
validate-tag:
runs-on: ubuntu-latest
outputs:
tag-valid: ${{ steps.validate.outputs.valid }}
version: ${{ steps.validate.outputs.version }}
is-branch: ${{ steps.validate.outputs.is_branch }}
ref-name: ${{ steps.validate.outputs.ref_name }}
environment: ${{ steps.detect-env.outputs.environment }}
channel: ${{ steps.detect-env.outputs.channel }}
steps:
- name: Checkout code
uses: actions/checkout@v4
with:
ref: ${{ github.event.inputs.ref || github.ref }}
fetch-depth: 0 # Fetch all history for tags and branches
- name: Validate and extract version
id: validate
shell: bash
run: |
set -euo pipefail
INPUT_REF="${{ github.event.inputs.ref }}"
REF_FULL="${GITHUB_REF}"
# Determine the actual ref to use
# If ref is empty, use the workflow branch (auto-sync)
if [ -n "$INPUT_REF" ]; then
REF_NAME="$INPUT_REF"
echo "✅ Using manual ref: $REF_NAME"
else
REF_NAME="${REF_FULL#refs/*/}"
echo "✅ Auto-sync: Using workflow branch as ref: $REF_NAME"
fi
echo "ref_name=$REF_NAME" >> $GITHUB_OUTPUT
echo "Selected ref: $REF_NAME"
# Simple validation with helpful error message
if ! (git show-ref --verify --quiet "refs/heads/$REF_NAME" 2>/dev/null || \
git show-ref --verify --quiet "refs/tags/$REF_NAME" 2>/dev/null || \
git show-ref --verify --quiet "refs/remotes/origin/$REF_NAME" 2>/dev/null); then
echo "[ERROR] Ref '$REF_NAME' does not exist!"
echo "Available branches: $(git branch -r --format='%(refname:short)' | sed 's/origin\///' | grep -v '^HEAD' | sort | tr '\n' ' ')"
echo "Available tags: $(git tag --sort=-version:refname | head -5 | tr '\n' ' ')"
exit 1
fi
if [[ "$REF_NAME" =~ ^v[0-9]+(\.[0-9]+)+(-[A-Za-z0-9.-]+)?(\+[A-Za-z0-9.-]+)?$ ]]; then
echo "valid=true" >> $GITHUB_OUTPUT
echo "is_branch=false" >> $GITHUB_OUTPUT
echo "version=${REF_NAME#v}" >> $GITHUB_OUTPUT
echo "Tag detected: $REF_NAME"
else
# Treat as branch; read VERSION file as base version
if [ -f "VERSION" ]; then
BASE_VERSION=$(cat VERSION | tr -d '[:space:]')
echo "Read base version from VERSION file: $BASE_VERSION"
else
BASE_VERSION="0.0.0"
echo "VERSION file not found, using default: $BASE_VERSION"
fi
SHORT_SHA=$(git rev-parse --short HEAD)
SAFE_BRANCH=$(echo "$REF_NAME" | tr '/' '-')
FALLBACK="${BASE_VERSION}-${SAFE_BRANCH}-${SHORT_SHA}"
echo "valid=true" >> $GITHUB_OUTPUT
echo "is_branch=true" >> $GITHUB_OUTPUT
echo "version=$FALLBACK" >> $GITHUB_OUTPUT
echo "Branch detected: $REF_NAME -> version=$FALLBACK"
fi
- name: Detect environment and channel
id: detect-env
shell: bash
run: |
REF_NAME="${{ steps.validate.outputs.ref_name }}"
VERSION="${{ steps.validate.outputs.version }}"
INPUT_ENV="${{ github.event.inputs.environment }}"
INPUT_CHANNEL="${{ github.event.inputs.channel }}"
echo "=== Detecting Environment ==="
echo "Ref: $REF_NAME"
echo "Version: $VERSION"
echo "Input Environment: $INPUT_ENV"
echo "Input Channel: $INPUT_CHANNEL"
# Determine if this is a tag (version tag)
IS_TAG=false
if [[ "$REF_NAME" =~ ^v[0-9]+(\.[0-9]+)+.*$ ]]; then
IS_TAG=true
fi
# Determine if this is a production-eligible ref (for staging checks)
IS_STAGING_ELIGIBLE=false
if [[ "$IS_TAG" == "true" ]] || \
[[ "$REF_NAME" == "main" ]] || [[ "$REF_NAME" == "master" ]]; then
IS_STAGING_ELIGIBLE=true
fi
# Use manual selection if provided (skip if empty)
if [[ -n "$INPUT_ENV" ]]; then
ENV="$INPUT_ENV"
# CRITICAL SAFETY CHECK: Production environment with specific channel restrictions
if [[ "$ENV" == "production" ]]; then
# Production environment is allowed for both tags and main/master branches
# But they use DIFFERENT channels to prevent conflicts
if [[ "$IS_TAG" == "false" ]]; then
# Branches in production: only main/master allowed
if [[ "$REF_NAME" != "main" && "$REF_NAME" != "master" ]]; then
echo "======================================================"
echo "❌ ERROR: Only main/master branches can use production environment"
echo "======================================================"
echo "Current ref: $REF_NAME"
echo "Requested environment: production"
echo ""
echo "Production environment accepts:"
echo " ✅ Version tags (v1.0.0, v1.0.0-rc.1) → stable/beta channels"
echo " ✅ main/master branches → nightly channel"
echo " ❌ Other branches → use development/test/staging"
echo ""
echo "Allowed environments for branch '$REF_NAME':"
echo " - development"
echo " - test"
echo " - staging (if eligible)"
echo "======================================================"
exit 1
fi
fi
fi
# Safety check: Prevent feature branches from using staging
if [[ "$IS_STAGING_ELIGIBLE" == "false" ]] && [[ "$ENV" == "staging" ]]; then
echo "======================================================"
echo "❌ ERROR: Branch '$REF_NAME' cannot use staging environment"
echo "======================================================"
echo "Only the following refs can use staging:"
echo " - Version tags: v1.0.0, v1.0.0-rc.1, v1.0.0-beta.1"
echo " - Main branches: main, master"
echo " - Staging branch: staging"
echo ""
echo "Current ref: $REF_NAME (feature branch)"
echo "Requested environment: $ENV"
echo ""
echo "Allowed environments for this branch:"
echo " - development"
echo " - test"
echo ""
echo "💡 Tip: Create a version tag to enable staging deployment"
echo "======================================================"
exit 1
fi
echo "Using manual environment: $ENV"
else
# Auto-detect environment based on ref and version
if [[ "$REF_NAME" =~ ^v[0-9]+(\.[0-9]+)+$ ]]; then
# Production: Clean version tag (e.g., v1.0.0, v0.8.9.2)
ENV="production"
elif [[ "$REF_NAME" =~ ^v[0-9]+(\.[0-9]+)+-rc\. ]]; then
# Production: Release candidate (e.g., v1.0.0-rc.1)
ENV="production"
elif [[ "$REF_NAME" =~ ^v[0-9]+(\.[0-9]+)+-beta ]]; then
# Staging: Beta version (e.g., v1.0.0-beta.1)
ENV="staging"
elif [[ "$REF_NAME" =~ ^v[0-9]+(\.[0-9]+)+-alpha ]]; then
# Test: Alpha version (e.g., v1.0.0-alpha.1)
ENV="test"
elif [[ "$REF_NAME" == "main" || "$REF_NAME" == "master" ]]; then
# Production: main/master branch (nightly builds)
ENV="production"
elif [[ "$REF_NAME" == "staging" ]]; then
# Staging: staging branch
ENV="staging"
elif [[ "$REF_NAME" == "develop" || "$REF_NAME" == "dev" ]]; then
# Development: develop branch
ENV="development"
else
# Other branches: default to development
ENV="development"
fi
echo "Auto-detected environment: $ENV"
fi
# Use manual channel if provided (skip if empty)
if [[ -n "$INPUT_CHANNEL" ]]; then
CHANNEL="$INPUT_CHANNEL"
echo "Using manual channel: $CHANNEL"
else
# Auto-detect channel based on ref type and environment
if [[ "$REF_NAME" =~ ^v[0-9]+(\.[0-9]+)+$ ]]; then
# Clean version tag → stable channel
CHANNEL="stable"
elif [[ "$REF_NAME" =~ ^v[0-9]+(\.[0-9]+)+-rc\. ]]; then
# RC tag → beta channel
CHANNEL="beta"
elif [[ "$REF_NAME" =~ ^v[0-9]+(\.[0-9]+)+-beta ]]; then
# Beta tag → beta channel
CHANNEL="beta"
elif [[ "$REF_NAME" =~ ^v[0-9]+(\.[0-9]+)+-alpha ]]; then
# Alpha tag → dev channel
CHANNEL="dev"
elif [[ "$REF_NAME" == "main" || "$REF_NAME" == "master" ]]; then
# main/master branch → nightly channel
CHANNEL="nightly"
elif [[ "$REF_NAME" == "staging" ]]; then
# staging branch → stable channel
CHANNEL="stable"
elif [[ "$REF_NAME" == "develop" || "$REF_NAME" == "dev" ]]; then
# develop branch → dev channel
CHANNEL="dev"
else
# Other branches → dev channel
CHANNEL="dev"
fi
echo "Auto-detected channel: $CHANNEL"
fi
# FINAL SAFETY CHECK: Enforce channel restrictions for production/stable
IS_BRANCH="${{ steps.validate.outputs.is_branch }}"
# Production/stable channel protection: ONLY version tags allowed
if [[ "$ENV" == "production" ]] && [[ "$CHANNEL" == "stable" ]] && [[ "$IS_TAG" == "false" ]]; then
echo "======================================================"
echo "❌ CRITICAL ERROR: production/stable requires version tags"
echo "======================================================"
echo "Current ref: $REF_NAME (branch)"
echo "Target: production/stable"
echo ""
echo "⚠️ PROTECTION: To prevent overwriting stable releases,"
echo " ONLY version tags (v1.0.0) can use production/stable."
echo ""
echo "Options for branch '$REF_NAME':"
if [[ "$REF_NAME" == "main" || "$REF_NAME" == "master" ]]; then
echo " ✅ production/nightly (auto-detected for main/master)"
echo " ✅ Change channel to 'nightly' or 'auto'"
else
echo " ✅ development/dev"
echo " ✅ test/dev"
fi
echo ""
echo "To deploy to production/stable:"
echo " 1. Create a version tag: git tag v1.0.1"
echo " 2. Push the tag: git push origin v1.0.1"
echo " 3. Trigger build with tag v1.0.1"
echo "======================================================"
exit 1
fi
# Staging environment requires tags or main/master/staging branches
if [[ "$ENV" == "staging" ]] && [[ "$IS_STAGING_ELIGIBLE" == "false" ]]; then
echo "======================================================"
echo "❌ ERROR: Staging requires tags or main/master/staging branches"
echo "======================================================"
echo "Current ref: $REF_NAME (feature branch)"
echo "Target environment: staging"
echo ""
echo "Allowed refs for staging:"
echo " - Version tags: v1.0.0, v1.0.0-rc.1, v1.0.0-beta.1"
echo " - Main branches: main, master"
echo " - Staging branch: staging"
echo ""
echo "To deploy to staging:"
echo " 1. Create a version tag, OR"
echo " 2. Merge to main/master/staging branch"
echo ""
echo "Or change environment to 'development' or 'test' for feature branches."
echo "======================================================"
exit 1
fi
echo "environment=$ENV" >> $GITHUB_OUTPUT
echo "channel=$CHANNEL" >> $GITHUB_OUTPUT
echo "Final environment: $ENV"
echo "Final channel: $CHANNEL"
# ============================================================================
# BUILD LAYER: Windows amd64
# ============================================================================
# Builds Windows installer with the following steps:
# 1. Environment Setup: Python, Node.js, Playwright, Inno Setup
# 2. Build Process: Frontend + Backend compilation
# 3. Code Signing: Optional Windows Authenticode signing
# 4. Artifact Upload: Short-term (S3 transfer) + Optional long-term
# ============================================================================
build-windows:
name: Build Windows amd64
needs: validate-tag
if: |
needs.validate-tag.outputs.tag-valid == 'true' &&
(github.event.inputs.platform == 'windows' || github.event.inputs.platform == 'all') &&
(github.event.inputs.arch == 'amd64' || github.event.inputs.arch == 'all')
runs-on: windows-latest
env:
# ── Azure Trusted Signing (cloud HSM, preferred) ──────────────────────
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID || 'NOT_SET' }}
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID || 'NOT_SET' }}
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET || 'NOT_SET' }}
AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT || 'NOT_SET' }}
AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT || 'NOT_SET' }}
AZURE_SIGNING_PROFILE: ${{ secrets.AZURE_SIGNING_PROFILE || 'NOT_SET' }}
# ── PFX fallback (traditional certificate file) ───────────────────────
WIN_CERT_PFX: ${{ secrets.WIN_CERT_PFX || 'NOT_SET' }}
WIN_CERT_PASSWORD: ${{ secrets.WIN_CERT_PASSWORD || 'NOT_SET' }}
# Set build architecture for the build process (Windows only supports amd64)
BUILD_ARCH: amd64
timeout-minutes: 60
steps:
# ------------------------------------------------------------------------
# Step Group 1: Repository Setup
# ------------------------------------------------------------------------
- name: Checkout code
uses: actions/checkout@v4
with:
ref: ${{ github.event.inputs.ref || github.ref }}
fetch-depth: 1 # Shallow clone: build only needs current code
# ------------------------------------------------------------------------
# Step Group 2: Environment Setup
# ------------------------------------------------------------------------
# Note: pip caching is handled by setup-python-env action
# Frontend is always built (ECAN_SKIP_FRONTEND_BUILD=0)
- name: Setup Python Environment
uses: ./.github/actions/setup-python-env
with:
platform: windows
requirements-file: requirements-windows.txt
extra-packages: pywin32-ctypes
architecture: x64
- name: Setup Playwright Browsers
uses: ./.github/actions/setup-playwright
with:
platform: windows
browsers: chromium
- name: Cache Node.js dependencies
uses: actions/cache@v4
with:
path: gui_v2/node_modules
# Include architecture in cache key to avoid cross-arch contamination (rollup has native binaries)
key: ${{ runner.os }}-${{ env.BUILD_ARCH }}-node-${{ hashFiles('gui_v2/package-lock.json') }}
restore-keys: |
${{ runner.os }}-${{ env.BUILD_ARCH }}-node-
- name: Setup Node.js Environment
uses: ./.github/actions/setup-node-env
# ------------------------------------------------------------------------
# Step Group 3: Windows-Specific Dependencies
# ------------------------------------------------------------------------
- name: Install Windows-specific packages
run: |
# Ensure pywin32 is present in the same interpreter
python -m pip install -U pywin32
# Rarely needed but safe; registers COM bits
python -m pywin32_postinstall -install
echo "=== Verifying pywin32 installation ==="
python -c "import win32api; print('pywin32 installed successfully')"
# ------------------------------------------------------------------------
# Step Group 4: Inno Setup Installation (Windows Installer Builder)
# ------------------------------------------------------------------------
- name: Install Inno Setup
run: |
echo "=== Installing Inno Setup ==="
$DownloadUrl = "https://files.jrsoftware.org/is/6/innosetup-6.6.0.exe"
$DownloadPath = "$env:TEMP\innosetup-6.6.0.exe"
Write-Host "Downloading Inno Setup..."
Invoke-WebRequest -Uri $DownloadUrl -OutFile $DownloadPath -UseBasicParsing
Write-Host "Installing Inno Setup..."
Start-Process -FilePath $DownloadPath -ArgumentList "/SILENT", "/SUPPRESSMSGBOXES", "/NORESTART" -Wait
Write-Host "Inno Setup installation completed"
# Verify installation
$innoPath = "${env:ProgramFiles(x86)}\Inno Setup 6\ISCC.exe"
if (Test-Path $innoPath) {
Write-Host "Inno Setup verified at: $innoPath"
} else {
Write-Host "ERROR: Inno Setup not found at expected location"
exit 1
}
- name: Verify Inno Setup (Unicode) version
shell: pwsh
run: |
$ErrorActionPreference = 'Continue'
$innoPath = "${env:ProgramFiles(x86)}\Inno Setup 6\ISCC.exe"
if (-not (Test-Path $innoPath)) { $innoPath = "${env:ProgramFiles}\Inno Setup 6\ISCC.exe" }
if (-not (Test-Path $innoPath)) {
Write-Host "ERROR: ISCC.exe not found" -ForegroundColor Red
exit 1
}
Write-Host "=== ISCC Version Output ===" -ForegroundColor Cyan
$help = & $innoPath '/?'
# Note: ISCC /? may return non-zero exit code even on success, so we don't check $LASTEXITCODE
$help | ForEach-Object { " $_" }
# Join lines for reliable regex matching; avoids array -notmatch pitfalls
$helpText = $help -join "`n"
if (-not ($helpText -match 'Inno Setup\s+\d')) {
Write-Host "ERROR: Failed to get ISCC version" -ForegroundColor Red
exit 1
}
# Inno Setup 6 compiler is Unicode-only; log as info if not explicitly present
$unicodeHint = ($helpText -match 'Unicode') -or ((Get-Item $innoPath).VersionInfo.FileDescription -match 'Unicode')
if (-not $unicodeHint) {
Write-Host "INFO: Proceeding - Inno Setup 6 is Unicode-only; explicit 'Unicode' string not found in help." -ForegroundColor Yellow
} else {
Write-Host "OK: ISCC Unicode build detected" -ForegroundColor Green
}
Write-Host "OK: ISCC check passed" -ForegroundColor Green
exit 0
- name: Install Inno Setup Language Packs
run: |
Write-Host "=== Installing Inno Setup Language Packs ===" -ForegroundColor Cyan
# Detect Inno Setup installation path
$innoPath = "${env:ProgramFiles(x86)}\Inno Setup 6\ISCC.exe"
if (-not (Test-Path $innoPath)) { $innoPath = "${env:ProgramFiles}\Inno Setup 6\ISCC.exe" }
if (-not (Test-Path $innoPath)) {
Write-Host "ERROR: ISCC.exe not found; cannot determine Languages directory" -ForegroundColor Red
exit 1
}
# Target Languages directory
$installDir = Split-Path -Parent $innoPath
$targetLangDir = Join-Path $installDir 'Languages'
$sourceLangDir = "${{ github.workspace }}\build_system\inno_setup_languages"
Write-Host "Source: $sourceLangDir" -ForegroundColor Gray
Write-Host "Target: $targetLangDir" -ForegroundColor Gray
Write-Host ""
# Ensure target directory exists
if (-not (Test-Path $targetLangDir)) {
New-Item -ItemType Directory -Path $targetLangDir -Force | Out-Null
}
# AUTO-DOWNLOAD: Download required language packs from official repository if not present
Write-Host "=== Checking and downloading required language packs ===" -ForegroundColor Cyan
# Define required language packs (can be extended)
$requiredLanguages = @{
"ChineseSimplified" = "https://raw.githubusercontent.com/jrsoftware/issrc/main/Files/Languages/Unofficial/ChineseSimplified.isl"
}
$downloadedCount = 0
$skippedCount = 0
foreach ($langName in $requiredLanguages.Keys) {
$langUrl = $requiredLanguages[$langName]
$targetFile = Join-Path $targetLangDir "$langName.isl"
# Check if language pack already exists
if (Test-Path $targetFile) {
Write-Host " ✓ $langName.isl already exists (skipped)" -ForegroundColor Gray
$skippedCount++
continue
}
# Download from official repository
Write-Host " Downloading $langName.isl from official repository..." -ForegroundColor Yellow
try {
Invoke-WebRequest -Uri $langUrl -OutFile $targetFile -UseBasicParsing -ErrorAction Stop
# Verify download
if (Test-Path $targetFile) {
$size = [math]::Round((Get-Item $targetFile).Length / 1KB, 2)
Write-Host " ✓ Downloaded: $langName.isl ($size KB)" -ForegroundColor Green
$downloadedCount++
} else {
Write-Host " ✗ Failed to download: $langName.isl" -ForegroundColor Red
}
} catch {
Write-Host " ✗ Error downloading $langName.isl: $_" -ForegroundColor Red
Write-Host " Installer will use English for this language" -ForegroundColor Yellow
}
}
Write-Host ""
Write-Host "=== Download Summary ===" -ForegroundColor Cyan
Write-Host " Downloaded: $downloadedCount" -ForegroundColor Green
Write-Host " Already present: $skippedCount" -ForegroundColor Gray
Write-Host "✓ Language pack preparation completed" -ForegroundColor Green
Write-Host ""
# Verify final language files
Write-Host "=== Final Language Files Verification ===" -ForegroundColor Cyan
$finalLangFiles = Get-ChildItem -Path $targetLangDir -Include "*.isl","*.islu" -ErrorAction SilentlyContinue
$langCount = 0
foreach ($file in $finalLangFiles) {
$size = [math]::Round($file.Length / 1KB, 2)
$status = if ($file.Name -eq "Default.isl") { "[System]" } else { "[Available]" }
Write-Host " $status $($file.Name) ($size KB)" -ForegroundColor $(if ($file.Name -eq "Default.isl") { "Cyan" } else { "Green" })
$langCount++
}
Write-Host ""
Write-Host "✓ Total $langCount language packs available" -ForegroundColor Green
# ------------------------------------------------------------------------
# Step Group 5: Build Environment Preparation
# ------------------------------------------------------------------------
- name: Setup Build Directories
uses: ./.github/actions/setup-build-dirs
with:
platform: windows
- name: Check Build Environment
uses: ./.github/actions/check-build-env
with:
platform: windows
- name: Setup Windows signtool Environment
uses: ./.github/actions/setup-signtool-env
with:
skip-if-available: true
sdk-version: '2004'
timeout: '600'
- name: Check Windows Architecture Selection
run: |
echo "=== Checking Windows Architecture Selection ==="
echo "Selected architecture: ${{ github.event.inputs.arch || 'all (default)' }}"
echo "Platform: ${{ github.event.inputs.platform || 'all (default)' }}"
echo "Note: Windows only supports amd64 architecture"
# Architecture selection logic for Windows
$INPUT_ARCH = "${{ github.event.inputs.arch }}"
if ($INPUT_ARCH -eq "aarch64") {
Write-Host "ERROR: Windows does not support aarch64 architecture" -ForegroundColor Red
Write-Host "INFO: Windows only supports amd64 (x86_64) architecture" -ForegroundColor Yellow
Write-Host "INFO: Please select 'amd64' or 'all' for Windows builds" -ForegroundColor Yellow
exit 1
} elseif ($INPUT_ARCH -eq "all" -or $INPUT_ARCH -eq "amd64" -or [string]::IsNullOrEmpty($INPUT_ARCH)) {
Write-Host "INFO: Building Windows amd64 version" -ForegroundColor Green
} else {
Write-Host "ERROR: Unsupported architecture '$INPUT_ARCH' for Windows" -ForegroundColor Red
Write-Host "INFO: Windows only supports amd64 architecture" -ForegroundColor Yellow
exit 1
}
# ------------------------------------------------------------------------
# Step Group 6: Build Process
# ------------------------------------------------------------------------
- name: Clean build artifacts
uses: ./.github/actions/clean-build-artifacts
with:
platform: windows
- name: Inject Build Info
run: |
echo "=== Injecting Build Info ==="
python build_system/scripts/inject_build_info.py --version ${{ needs.validate-tag.outputs.version }} --environment ${{ needs.validate-tag.outputs.environment }}
# ------------------------------------------------------------------------
# Step: Setup OTA Signing Key from GitHub Secrets
# ------------------------------------------------------------------------
- name: Setup OTA signing key
if: |
needs.validate-tag.outputs.environment == 'production' ||
needs.validate-tag.outputs.environment == 'staging' ||
needs.validate-tag.outputs.environment == 'test'
env:
OTA_PRIVATE_KEY: ${{ secrets.OTA_ED25519_PRIVATE_KEY }}
shell: pwsh
run: |
Write-Host "=== Setting up OTA signing key ===" -ForegroundColor Cyan
Write-Host "Environment: ${{ needs.validate-tag.outputs.environment }}" -ForegroundColor Gray
Write-Host ""
# Create certificates directory
$certDir = "build_system\certificates"
if (-not (Test-Path $certDir)) {
New-Item -ItemType Directory -Force -Path $certDir | Out-Null
Write-Host "[OK] Created directory: $certDir" -ForegroundColor Green
}
# Check if secret is available
if ([string]::IsNullOrEmpty($env:OTA_PRIVATE_KEY)) {
Write-Host "[ERROR] ========================================" -ForegroundColor Red
Write-Host "[ERROR] OTA_ED25519_PRIVATE_KEY secret is NOT configured" -ForegroundColor Red
Write-Host "[ERROR] ========================================" -ForegroundColor Red
Write-Host ""
Write-Host "To fix this issue:" -ForegroundColor Yellow
Write-Host "1. Run: .\prepare_github_secret.ps1" -ForegroundColor Gray
Write-Host "2. Go to: GitHub repository -> Settings -> Secrets -> Actions" -ForegroundColor Gray
Write-Host "3. Add secret:" -ForegroundColor Gray
Write-Host " Name: OTA_ED25519_PRIVATE_KEY" -ForegroundColor Gray
Write-Host " Value: [paste from clipboard]" -ForegroundColor Gray
Write-Host ""
Write-Host "See: OTA_SIGNING_COMPLETE_GUIDE.md for detailed instructions" -ForegroundColor Gray
Write-Host ""
exit 1
}
# Decode base64 and write private key
$keyPath = "$certDir\ed25519_private_key.pem"
Write-Host "[1/3] Decoding base64 private key..." -ForegroundColor Yellow
try {
$keyBytes = [Convert]::FromBase64String($env:OTA_PRIVATE_KEY)
$keyContent = [System.Text.Encoding]::UTF8.GetString($keyBytes)
Set-Content -Path $keyPath -Value $keyContent -NoNewline
Write-Host " ✓ Base64 decoded successfully" -ForegroundColor Green
} catch {
Write-Host " ✗ Failed to decode base64: $_" -ForegroundColor Red
exit 1
}
# Verify key format
Write-Host "[2/3] Verifying key format..." -ForegroundColor Yellow
$keyCheck = Get-Content $keyPath -Raw
if ($keyCheck -match "BEGIN PRIVATE KEY") {
Write-Host " ✓ Key format verified (PEM)" -ForegroundColor Green
} else {
Write-Host " ✗ Invalid key format (expected PEM)" -ForegroundColor Red
Write-Host " Key should start with: -----BEGIN PRIVATE KEY-----" -ForegroundColor Gray
exit 1
}
# Set file permissions
Write-Host "[3/3] Setting file permissions..." -ForegroundColor Yellow
try {
$acl = Get-Acl $keyPath
$acl.SetAccessRuleProtection($true, $false)
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
[System.Security.Principal.WindowsIdentity]::GetCurrent().Name,
"Read",
"Allow"
)
$acl.SetAccessRule($rule)
Set-Acl $keyPath $acl
Write-Host " ✓ File permissions set (read-only)" -ForegroundColor Green
} catch {
Write-Host " ⚠ Warning: Could not set file permissions: $_" -ForegroundColor Yellow
}
Write-Host ""
Write-Host "============================================" -ForegroundColor Green
Write-Host " ✓ OTA signing key configured successfully" -ForegroundColor Green
Write-Host "============================================" -ForegroundColor Green
Write-Host "Key path: $keyPath" -ForegroundColor Gray
Write-Host ""
# ------------------------------------------------------------------------
# Step Group 6: Build Application
# ------------------------------------------------------------------------
- name: Build Windows EXE
shell: pwsh
env:
ECAN_SKIP_FRONTEND_BUILD: '0' # Always build frontend
run: |
Write-Host "=== Starting Windows Build ===" -ForegroundColor Cyan
Write-Host "Command: python build.py prod" -ForegroundColor Gray