Prepare v0.1.23 release #30
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: | |
| - "v*" | |
| - "release/v*" | |
| tags: | |
| - "v*" | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| build: | |
| name: Build Release Artifacts | |
| runs-on: macos-14 | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Verify tag version | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| run: | | |
| expected="v$(tr -d '[:space:]' < VERSION)" | |
| test "$GITHUB_REF_NAME" = "$expected" || { | |
| printf 'Release tag %s does not match VERSION (%s).\n' "$GITHUB_REF_NAME" "$expected" >&2 | |
| exit 1 | |
| } | |
| - name: Setup Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Setup Node | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Install dependencies | |
| run: | | |
| go mod download | |
| cd frontend && npm ci | |
| - name: Install Wails | |
| run: go install github.com/wailsapp/wails/v2/cmd/wails@v2.12.0 | |
| - name: Build CLI archives | |
| run: make release-cli | |
| - name: Build macOS app | |
| run: make verify-app-version | |
| - name: Sign and notarize macOS app | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| env: | |
| APPLE_CERTIFICATE_P12_BASE64: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| APPLE_CODESIGN_IDENTITY: ${{ secrets.APPLE_CODESIGN_IDENTITY }} | |
| APPLE_NOTARY_KEY_P8_BASE64: ${{ secrets.APPLE_NOTARY_KEY_P8_BASE64 }} | |
| APPLE_NOTARY_KEY_ID: ${{ secrets.APPLE_NOTARY_KEY_ID }} | |
| APPLE_NOTARY_ISSUER_ID: ${{ secrets.APPLE_NOTARY_ISSUER_ID }} | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| run: scripts/sign-notarize-macos.sh | |
| - name: Package unsigned macOS app | |
| if: ${{ !startsWith(github.ref, 'refs/tags/v') }} | |
| run: make package-app | |
| - name: Write checksums | |
| run: make checksums | |
| - name: Verify checksums | |
| working-directory: dist | |
| run: shasum -a 256 -c SHA256SUMS | |
| - name: Upload build artifacts | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: spice-${{ github.ref_name }}-artifacts | |
| path: | | |
| dist/*.tar.gz | |
| dist/*.zip | |
| dist/SHA256SUMS | |
| if-no-files-found: error | |
| - name: Publish GitHub release | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| name: Spice ${{ github.ref_name }} | |
| draft: true | |
| prerelease: ${{ contains(github.ref_name, '-alpha') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-rc') }} | |
| files: | | |
| dist/*.tar.gz | |
| dist/*.zip | |
| dist/SHA256SUMS | |
| body: | | |
| Spice is a free local Shai-Hulud exposure checker for developers. | |
| This release includes signed and notarized macOS CLI archives, Linux CLI archives, a signed and notarized macOS app bundle, and SHA-256 checksums. | |
| Detection data is loaded from the public `turenlabs/spice-detections` pack at runtime. A clean scan is a useful signal, not proof that a system is safe. | |
| This release refreshes coverage for late-July npm/PyPI malware advisories, including the Joyfill 2773 compromise, the Pepesoft NuGet tool campaign, the Newtonsoftt.Json.Net NuGet typosquat, and the Alibaba-targeted npm package cluster. | |
| Refresh detection data with `spice update`. Manifest: https://api.github.com/repos/turenlabs/spice-detections/contents/manifest.json?ref=main | |
| Spice stores scan history, findings, package inventory, settings, and detection caches locally. Detection refreshes fetch public data from GitHub and do not upload scan results. |