feat: add bounded web crawl tools #74
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Desktop Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*.*.*' | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: Tag to build (e.g. v1.5.36) | |
| required: true | |
| permissions: | |
| contents: write | |
| jobs: | |
| build: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - os: macos-latest | |
| name: macOS | |
| script: electron:build:mac | |
| - os: windows-latest | |
| name: Windows | |
| script: electron:build:win | |
| - os: ubuntu-latest | |
| name: Linux | |
| script: electron:build:linux | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 60 | |
| name: ${{ matrix.name }} | |
| steps: | |
| - name: Resolve tag | |
| id: resolve_tag | |
| shell: bash | |
| env: | |
| INPUT_TAG: ${{ github.event.inputs.tag }} | |
| REF_NAME: ${{ github.ref_name }} | |
| run: | | |
| TAG_NAME="${INPUT_TAG:-$REF_NAME}" | |
| case "$TAG_NAME" in | |
| v[0-9]*.[0-9]*.[0-9]*|v[0-9]*.[0-9]*.[0-9]*-*) | |
| ;; | |
| *) | |
| echo "Refusing to build non-version tag: $TAG_NAME" >&2 | |
| exit 1 | |
| ;; | |
| esac | |
| echo "tag=$TAG_NAME" >> "$GITHUB_OUTPUT" | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ steps.resolve_tag.outputs.tag }} | |
| fetch-depth: 0 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: npm | |
| - name: Setup Python (for node-gyp) | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Sync package version with tag | |
| shell: bash | |
| env: | |
| TAG: ${{ steps.resolve_tag.outputs.tag }} | |
| run: | | |
| TAG_VERSION="${TAG#v}" | |
| CURRENT_VERSION="$(node -p "require('./package.json').version")" | |
| if [ "$CURRENT_VERSION" != "$TAG_VERSION" ]; then | |
| npm pkg set version="$TAG_VERSION" | |
| fi | |
| - name: Install dependencies | |
| run: npm ci | |
| env: | |
| CI: 'true' | |
| - name: Install Linux system deps | |
| if: matrix.os == 'ubuntu-latest' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libopenjp2-tools rpm fakeroot dpkg | |
| - name: Install macOS system deps | |
| if: matrix.os == 'macos-latest' | |
| run: | | |
| brew install pkg-config xz | |
| - name: Prepare safe Windows HOME | |
| if: matrix.os == 'windows-latest' | |
| shell: pwsh | |
| run: | | |
| New-Item -ItemType Directory -Force -Path "D:\\swarmclaw-home" | Out-Null | |
| "USERPROFILE=D:\\swarmclaw-home" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8 | |
| "HOMEDRIVE=D:" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8 | |
| "HOMEPATH=\\swarmclaw-home" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8 | |
| - name: Check macOS signing inputs | |
| if: matrix.os == 'macos-latest' | |
| shell: bash | |
| env: | |
| CSC_LINK_SECRET: ${{ secrets.CSC_LINK }} | |
| CSC_KEY_PASSWORD_SECRET: ${{ secrets.CSC_KEY_PASSWORD }} | |
| APPLE_ID_SECRET: ${{ secrets.APPLE_ID }} | |
| APPLE_APP_SPECIFIC_PASSWORD_SECRET: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| APPLE_TEAM_ID_SECRET: ${{ secrets.APPLE_TEAM_ID }} | |
| APPLE_API_KEY_SECRET: ${{ secrets.APPLE_API_KEY }} | |
| APPLE_API_KEY_ID_SECRET: ${{ secrets.APPLE_API_KEY_ID }} | |
| APPLE_API_ISSUER_SECRET: ${{ secrets.APPLE_API_ISSUER }} | |
| run: | | |
| set -euo pipefail | |
| has_certificate=false | |
| has_apple_id_notary=false | |
| has_api_key_notary=false | |
| if [ -n "${CSC_LINK_SECRET:-}" ] && [ -n "${CSC_KEY_PASSWORD_SECRET:-}" ]; then | |
| has_certificate=true | |
| fi | |
| if [ -n "${APPLE_ID_SECRET:-}" ] && [ -n "${APPLE_APP_SPECIFIC_PASSWORD_SECRET:-}" ] && [ -n "${APPLE_TEAM_ID_SECRET:-}" ]; then | |
| has_apple_id_notary=true | |
| fi | |
| if [ -n "${APPLE_API_KEY_SECRET:-}" ] && [ -n "${APPLE_API_KEY_ID_SECRET:-}" ] && [ -n "${APPLE_API_ISSUER_SECRET:-}" ]; then | |
| has_api_key_notary=true | |
| fi | |
| if [ "$has_certificate" = true ] && { [ "$has_apple_id_notary" = true ] || [ "$has_api_key_notary" = true ]; }; then | |
| echo "Developer ID signing and notarization inputs are configured." | |
| else | |
| echo "Developer ID signing and notarization inputs are incomplete; macOS artifacts will remain ad-hoc signed." | |
| fi | |
| - name: Export macOS signing environment | |
| if: matrix.os == 'macos-latest' | |
| shell: bash | |
| env: | |
| CSC_LINK_SECRET: ${{ secrets.CSC_LINK }} | |
| CSC_KEY_PASSWORD_SECRET: ${{ secrets.CSC_KEY_PASSWORD }} | |
| APPLE_ID_SECRET: ${{ secrets.APPLE_ID }} | |
| APPLE_APP_SPECIFIC_PASSWORD_SECRET: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| APPLE_TEAM_ID_SECRET: ${{ secrets.APPLE_TEAM_ID }} | |
| APPLE_API_KEY_SECRET: ${{ secrets.APPLE_API_KEY }} | |
| APPLE_API_KEY_ID_SECRET: ${{ secrets.APPLE_API_KEY_ID }} | |
| APPLE_API_ISSUER_SECRET: ${{ secrets.APPLE_API_ISSUER }} | |
| run: | | |
| set -euo pipefail | |
| append_env() { | |
| local name="$1" | |
| local value="$2" | |
| local delimiter="SWARMCLAW_${name}_$(uuidgen | tr -d '-')" | |
| { | |
| echo "${name}<<${delimiter}" | |
| printf '%s\n' "$value" | |
| echo "${delimiter}" | |
| } >> "$GITHUB_ENV" | |
| } | |
| if [ -n "${CSC_LINK_SECRET:-}" ] && [ -n "${CSC_KEY_PASSWORD_SECRET:-}" ]; then | |
| append_env CSC_LINK "$CSC_LINK_SECRET" | |
| append_env CSC_KEY_PASSWORD "$CSC_KEY_PASSWORD_SECRET" | |
| fi | |
| if [ -n "${APPLE_ID_SECRET:-}" ] && [ -n "${APPLE_APP_SPECIFIC_PASSWORD_SECRET:-}" ] && [ -n "${APPLE_TEAM_ID_SECRET:-}" ]; then | |
| append_env APPLE_ID "$APPLE_ID_SECRET" | |
| append_env APPLE_APP_SPECIFIC_PASSWORD "$APPLE_APP_SPECIFIC_PASSWORD_SECRET" | |
| append_env APPLE_TEAM_ID "$APPLE_TEAM_ID_SECRET" | |
| fi | |
| if [ -n "${APPLE_API_KEY_SECRET:-}" ] && [ -n "${APPLE_API_KEY_ID_SECRET:-}" ] && [ -n "${APPLE_API_ISSUER_SECRET:-}" ]; then | |
| append_env APPLE_API_KEY "$APPLE_API_KEY_SECRET" | |
| append_env APPLE_API_KEY_ID "$APPLE_API_KEY_ID_SECRET" | |
| append_env APPLE_API_ISSUER "$APPLE_API_ISSUER_SECRET" | |
| fi | |
| - name: Build desktop app | |
| run: npm run ${{ matrix.script }} -- --publish | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| NEXT_TELEMETRY_DISABLED: '1' | |
| - name: Upload build logs on failure | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: build-logs-${{ matrix.name }} | |
| path: | | |
| release/**/*.log | |
| release/builder-debug.yml | |
| if-no-files-found: ignore |