Prepare v0.1.15 release #21
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: | |
| - "v*" | |
| - "release/v*" | |
| tags: | |
| - "v*" | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| build: | |
| name: Build Release Artifacts | |
| runs-on: macos-14 | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Setup Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Setup Node | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Install dependencies | |
| run: | | |
| go mod download | |
| cd frontend && npm ci | |
| - name: Install Wails | |
| run: go install github.com/wailsapp/wails/v2/cmd/wails@v2.12.0 | |
| - name: Build CLI archives | |
| run: make release-cli | |
| - name: Build macOS app | |
| run: make build | |
| - name: Sign and notarize macOS app | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| env: | |
| APPLE_CERTIFICATE_P12_BASE64: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| APPLE_CODESIGN_IDENTITY: ${{ secrets.APPLE_CODESIGN_IDENTITY }} | |
| APPLE_NOTARY_KEY_P8_BASE64: ${{ secrets.APPLE_NOTARY_KEY_P8_BASE64 }} | |
| APPLE_NOTARY_KEY_ID: ${{ secrets.APPLE_NOTARY_KEY_ID }} | |
| APPLE_NOTARY_ISSUER_ID: ${{ secrets.APPLE_NOTARY_ISSUER_ID }} | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| run: scripts/sign-notarize-macos.sh | |
| - name: Package unsigned macOS app | |
| if: ${{ !startsWith(github.ref, 'refs/tags/v') }} | |
| run: make package-app | |
| - name: Write checksums | |
| run: make checksums | |
| - name: Verify checksums | |
| run: shasum -a 256 -c dist/SHA256SUMS | |
| - name: Upload build artifacts | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: spice-${{ github.ref_name }}-artifacts | |
| path: | | |
| dist/*.tar.gz | |
| dist/*.zip | |
| dist/SHA256SUMS | |
| if-no-files-found: error | |
| - name: Publish GitHub release | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| name: Spice ${{ github.ref_name }} | |
| draft: true | |
| prerelease: ${{ contains(github.ref_name, '-alpha') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-rc') }} | |
| files: | | |
| dist/*.tar.gz | |
| dist/*.zip | |
| dist/SHA256SUMS | |
| body: | | |
| Spice is a free local Shai-Hulud exposure checker for developers. | |
| This release includes signed and notarized macOS CLI archives, Linux CLI archives, a signed and notarized macOS app bundle, and SHA-256 checksums. | |
| Detection data is loaded from the public `turenlabs/spice-detections` pack at runtime. A clean scan is a useful signal, not proof that a system is safe. |