-
Notifications
You must be signed in to change notification settings - Fork 0
77 lines (67 loc) · 2.72 KB
/
Copy pathrelease.yml
File metadata and controls
77 lines (67 loc) · 2.72 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
name: Build Windows installer
# Builds the NSIS installer in CI on a clean runner. This is the prerequisite
# for SignPath Foundation signing: SignPath signs artifacts produced by a
# trusted CI, so the release build must run here (not on a dev machine).
#
# Triggers:
# - workflow_dispatch: build on demand (Actions tab → Run workflow)
# - push tag v*: build for a release (e.g. git tag v0.1.0 && git push --tags)
#
# Today this produces an UNSIGNED installer + auto-update metadata as a workflow
# artifact. Signing + release publishing are added once SignPath approves the
# project — see docs/signing-signpath.md.
on:
workflow_dispatch:
push:
tags: ['v*']
permissions:
contents: read
jobs:
build:
runs-on: windows-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
- name: Install dependencies
run: npm ci
- name: Build renderer/main (electron-vite)
run: npx electron-vite build
- name: Package installer (electron-builder, unsigned, no publish)
run: npx electron-builder --win --x64 --publish never
- name: Upload installer + update metadata
uses: actions/upload-artifact@v4
with:
name: vitreous-windows-installer
path: |
release/*.exe
release/latest.yml
release/*.blockmap
if-no-files-found: error
# ---------------------------------------------------------------------------
# SIGNING (added after SignPath Foundation approval — see docs/signing-signpath.md)
#
# SignPath signs the artifact produced above, then we regenerate latest.yml +
# .blockmap so electron-updater's hash matches the SIGNED installer (otherwise
# auto-update breaks). Sketch of the additional job:
#
# sign:
# needs: build
# runs-on: ubuntu-latest
# if: ${{ vars.SIGNPATH_ENABLED == 'true' }} # repo Variable, flip on when ready
# steps:
# - uses: actions/checkout@v4
# - uses: signpath/github-action-submit-signing-request@v1
# with:
# api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
# organization-id: ${{ vars.SIGNPATH_ORG_ID }}
# project-slug: vitreous
# signing-policy-slug: release-signing
# github-artifact-id: ${{ needs.build.outputs.artifact-id }}
# wait-for-completion: true
# output-artifact-directory: signed/
# - run: node scripts/update-release-metadata.mjs signed/ # patch latest.yml + blockmap
# - # then attach signed exe + latest.yml + blockmap to the GitHub Release
# ---------------------------------------------------------------------------