Release v0.11.3 #26
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: LicenseRef-PolyForm-Noncommercial-1.0.0 | |
| # Build installable binaries and attach them to a GitHub Release on every v* tag. | |
| # | |
| # macOS → universal .dmg (Apple Silicon + Intel). Signs + notarizes automatically | |
| # IF the APPLE_* secrets are set; otherwise the .dmg is unsigned | |
| # (users right-click → Open the first time). | |
| # Linux → .AppImage / .deb / .rpm. | |
| # Windows → .exe (NSIS) / .msi (WiX). Unsigned, so SmartScreen shows | |
| # "More info → Run anyway" on first launch. | |
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| jobs: | |
| release: | |
| permissions: | |
| contents: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - platform: macos-latest | |
| args: "--target universal-apple-darwin" | |
| rust-targets: "aarch64-apple-darwin,x86_64-apple-darwin" | |
| - platform: ubuntu-22.04 | |
| args: "" | |
| rust-targets: "" | |
| - platform: windows-latest | |
| args: "" | |
| rust-targets: "" | |
| runs-on: ${{ matrix.platform }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Extract release notes for this tag | |
| # The single source of truth for "what changed" is CHANGELOG.md. We pull | |
| # out the section whose heading matches the tag and hand it to | |
| # tauri-action as the release body — which is also what tauri-action | |
| # writes into latest.json's `notes`, i.e. what the in-app updater shows. | |
| # Runs on every matrix platform (bash is available on all three runners) | |
| # so each job produces an identical body and latest.json stays consistent. | |
| id: notes | |
| shell: bash | |
| run: | | |
| ver="${GITHUB_REF_NAME}" | |
| # Print the lines under `## <tag>` up to the next `## ` heading, with | |
| # leading and trailing blank lines trimmed but internal ones kept. | |
| # Done inside awk so it needs nothing beyond POSIX (no tac/GNU sed) — | |
| # this step also runs on the macOS and Windows runners. | |
| body="$(awk -v head="## $ver" ' | |
| $0 == head { grab=1; next } | |
| grab && /^## / { exit } | |
| grab { | |
| if ($0 ~ /[^[:space:]]/) { while (pending-- > 0) print ""; pending=0; print; started=1 } | |
| else if (started) { pending++ } | |
| } | |
| ' CHANGELOG.md)" | |
| if [ -z "$body" ]; then | |
| echo "::warning::no CHANGELOG.md section for $ver — using a fallback line" | |
| body="See the release page for what's new in ${ver}." | |
| fi | |
| { | |
| echo "body<<__NOTES_EOF__" | |
| echo "$body" | |
| echo "__NOTES_EOF__" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Install Linux system dependencies | |
| if: matrix.platform == 'ubuntu-22.04' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y \ | |
| libwebkit2gtk-4.1-dev \ | |
| build-essential curl wget file \ | |
| libxdo-dev libssl-dev \ | |
| libayatana-appindicator3-dev \ | |
| librsvg2-dev patchelf | |
| - name: Install NASM (Windows) | |
| # The vendored OpenSSL that backs SQLCipher assembles with NASM on MSVC. | |
| # Strawberry Perl is already on the runner; NASM is not. | |
| if: matrix.platform == 'windows-latest' | |
| uses: ilammy/setup-nasm@v1 | |
| - name: Set up Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| - name: Set up Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: ${{ matrix.rust-targets }} | |
| - name: Cache Rust build | |
| uses: swatinem/rust-cache@v2 | |
| with: | |
| workspaces: ./src-tauri -> target | |
| - name: Install frontend dependencies | |
| run: npm ci | |
| - name: Build and release | |
| uses: tauri-apps/tauri-action@v0 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Updater signing — required for self-update to verify downloads. | |
| # Add TAURI_SIGNING_PRIVATE_KEY as a repo secret (contents of | |
| # ~/.tauri/field-notes-updater.key). Password is empty for this key. | |
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| # macOS Developer ID signing + notarization. | |
| # Currently DISABLED — with no Apple Developer cert, passing empty | |
| # APPLE_* values makes Tauri attempt (and fail) an empty codesign, so | |
| # the build ad-hoc signs instead. To enable once you have a Developer | |
| # ID: add these as repository secrets and uncomment this block. | |
| # APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| # APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| # APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }} | |
| # APPLE_ID: ${{ secrets.APPLE_ID }} | |
| # APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }} | |
| # APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| with: | |
| tagName: ${{ github.ref_name }} | |
| releaseName: "Field Notes ${{ github.ref_name }}" | |
| # The changelog section for this tag, from the step above. This is the | |
| # release body AND `latest.json`'s `notes`, so the in-app updater prompt | |
| # now shows what actually changed. Download links and Gatekeeper / | |
| # SmartScreen help are deliberately NOT here — they'd be noise in the | |
| # app; they're added to the GitHub release page after publishing | |
| # (see RELEASING.md). | |
| releaseBody: ${{ steps.notes.outputs.body }} | |
| releaseDraft: true | |
| # The updater reads /releases/latest/download/latest.json, and GitHub's | |
| # "latest" excludes prereleases. So marking a v*-beta / v*-rc tag as a | |
| # prerelease is what keeps it out of everyone's auto-update — it must not | |
| # depend on remembering to tick a box in the publish dialog. A plain | |
| # `v0.4.0` has no `-`, stays non-prerelease, and becomes the update everyone | |
| # (including beta testers, since 0.4.0 > 0.4.0-beta.1) is offered. | |
| prerelease: ${{ contains(github.ref_name, '-') }} | |
| args: ${{ matrix.args }} |