diff --git a/.forgejo/workflows/portable.yml b/.forgejo/workflows/portable.yml
new file mode 100644
index 0000000..205659b
--- /dev/null
+++ b/.forgejo/workflows/portable.yml
@@ -0,0 +1,72 @@
+name: portable-unsigned
+
+# 서명 없는 휴대용 배포 채널.
+#
+# 배경: NSIS/MSIX 설치본은 public-trust Authenticode 서명이 필수라 인증서가 없는 동안
+# 게시할 수 없다(실측: 릴리스 파이프라인 2회 모두 서명 가드에서 실패). 이 워크플로는
+# 인증서 없이 동작하는 7z 분할 볼륨 + Scoop 채널을 게시한다.
+#
+# 안전 규칙:
+# - 자동 업데이트 피드(latest.yml / update-policy.json)를 절대 건드리지 않는다.
+# - 파일명에 -portable 을 두어 서명된 릴리스 자산과 혼동되지 않게 한다.
+# - Cloudflare 업로드 한도(100MiB)를 넘지 않게 95MiB 볼륨으로 나누어 게시한다.
+#
+# 필요한 시크릿: FORGEJO_TOKEN (write:package)
+
+on:
+ push:
+ tags:
+ - "v*.*.*"
+ workflow_dispatch:
+
+jobs:
+ portable-windows:
+ runs-on: windows
+ defaults: { run: { shell: pwsh } }
+ steps:
+ - name: checkout
+ env: { CI_TOKEN: "${{ github.token }}" }
+ run: |
+ $u = [Uri]$env:GITHUB_SERVER_URL
+ $url = "$($u.Scheme)://actions:$($env:CI_TOKEN)@$($u.Authority)/$($env:GITHUB_REPOSITORY).git"
+ if (-not (Test-Path .git)) { git init -q . }
+ if (git remote | Select-String -Quiet '^origin$') { git remote set-url origin $url } else { git remote add origin $url }
+ git fetch -q --depth 1 origin $env:GITHUB_REF
+ git checkout -q -f FETCH_HEAD
+ git clean -qfdx
+
+ - name: 버전 정본 대조
+ run: |
+ node scripts/ci/sync-version.mjs --check --tag "$env:GITHUB_REF_NAME"
+
+ - name: 의존성 설치
+ run: npm ci
+
+ - name: STT 사이드카 빌드
+ run: |
+ npm run sidecar:setup --workspace=@d3ro/desktop
+ npm run sidecar:build --workspace=@d3ro/desktop
+ node scripts/ci/verify-sidecar-bundle.mjs
+
+ - name: 데스크톱 번들 빌드
+ run: npm run build --workspace=@d3ro/desktop
+
+ - name: 데스크톱 렌더러 번들 검증
+ run: node scripts/ci/verify-desktop-renderer-bundles.mjs
+
+ - name: 휴대용 ZIP + Scoop 매니페스트 생성
+ run: node scripts/ci/build-portable.mjs
+
+ - name: Forgejo portable 채널 게시
+ env:
+ FORGEJO_TOKEN: "${{ secrets.FORGEJO_TOKEN }}"
+ run: node scripts/ci/publish-portable-release.mjs
+
+ - name: 아티팩트 업로드
+ uses: actions/upload-artifact@v4
+ with:
+ name: d3ro-voice-portable-${{ github.ref_name }}
+ path: |
+ apps/desktop/release/*/*-portable.7z.00*
+ apps/desktop/release/*/portable.json
+ bucket/d3ro-voice.json
\ No newline at end of file
diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index e5c3913..d42bffd 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -62,8 +62,10 @@ jobs:
throw "로컬 개발 인증서는 production 서명 identity가 아닙니다."
}
npm run build --workspace=@d3ro/desktop
+ node scripts/ci/verify-desktop-renderer-bundles.mjs
Push-Location apps/desktop
npx electron-builder --win --x64 --config electron-builder.yml --publish never
+ node scripts/ci/verify-native-abi.mjs
Pop-Location
- name: Windows 산출물 검증
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0694180..0db2b41 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -169,6 +169,10 @@ jobs:
- name: Build Target Workspace
run: ${{ matrix.cmd }}
+ - name: Verify Desktop Renderer Bundles
+ if: matrix.target == 'desktop'
+ run: node scripts/ci/verify-desktop-renderer-bundles.mjs
+
# ──────────────────────────────────────────────────────────────────
# 4. Android x86_64 artifacts and native dependency gate
# ──────────────────────────────────────────────────────────────────
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7391d26..75e3d44 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -109,6 +109,9 @@ jobs:
npm run typecheck
npm run build --workspace=@d3ro/desktop
+ - name: Verify Desktop Renderer Bundles
+ run: node scripts/ci/verify-desktop-renderer-bundles.mjs
+
- name: Build STT Sidecar (local transcription engine)
run: |
# Local transcription depends on the faster-whisper sidecar; a release
@@ -138,6 +141,7 @@ jobs:
Push-Location apps/desktop
try {
npx electron-builder --win --x64 --config electron-builder.yml
+ node scripts/ci/verify-native-abi.mjs
if ($LASTEXITCODE -ne 0) { throw "electron-builder failed with exit code $LASTEXITCODE." }
}
finally {
@@ -188,6 +192,9 @@ jobs:
npm run typecheck
npm run build --workspace=@d3ro/desktop
+ - name: Verify Desktop Renderer Bundles
+ run: node scripts/ci/verify-desktop-renderer-bundles.mjs
+
- name: Build STT Sidecar (local transcription engine)
run: |
# Local transcription depends on the faster-whisper sidecar; a release
@@ -201,6 +208,7 @@ jobs:
run: |
cd apps/desktop
npx electron-builder --mac --arm64 --config electron-builder.yml
+ node scripts/ci/verify-native-abi.mjs
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
CSC_LINK: ${{ secrets.MAC_CSC_LINK }}
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index fdcef83..793335c 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -251,6 +251,7 @@ package-windows:
- npm run build --workspace=@d3ro/desktop
- cd apps/desktop
- npx electron-builder --win --x64 --config electron-builder.yml
+ - node scripts/ci/verify-native-abi.mjs
- cd ../..
- $releaseVersion = node -p "require('./release/product-version.json').version"
- '& scripts/ci/verify-windows-release-artifact.ps1 -ExpectedVersion $releaseVersion -ExpectedSignerSubject $env:WIN_CSC_EXPECTED_SIGNER_SUBJECT -ReleaseDirectory "apps/desktop/release/$releaseVersion"'
@@ -282,6 +283,7 @@ package-macos:
- npm run build --workspace=@d3ro/desktop
- cd apps/desktop
- npx electron-builder --mac --arm64 --config electron-builder.yml
+ - node scripts/ci/verify-native-abi.mjs
artifacts:
name: "d3ro-voice-macos-$CI_COMMIT_TAG"
paths:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index afe66c4..f3aaa8c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,79 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- Cloud-optional backup (encrypted, opt-in)
- Plugin system for custom pipelines
+## [1.3.7] - 2026-09-19
+
+### Fixed
+- **Recording and live caption overlays never worked in installed builds.** Popup
+ pages loaded their scripts as classic `
+
+