7953706142
Desktop clients had two competing update sources: the runtime pointed at a legacy GitLab registry while the Forgejo packages were filled in by hardcoded, version-pinned scripts. Operators could not tell which feed was authoritative, and no release could be reproduced from a tag. Auto-update now reads a single canonical Forgejo registry feed, updated by a version-agnostic publisher that runs from the tag on Forgejo, GitLab, and GitHub CI alike. Channel, minimum supported version, forced install, full-versus-delta thresholds, staged rollout, and a remote kill switch come from one policy file the client fetches alongside the feed. Tag creation is gated on a clean tree, matching version surfaces, and a changelog section.
73 lines
3.1 KiB
YAML
73 lines
3.1 KiB
YAML
name: release
|
|
|
|
# Canonical tag-triggered desktop release built and published on Forgejo.
|
|
# GitLab CI (.gitlab-ci.yml) and GitHub Actions (.github/workflows/release.yml)
|
|
# remain alternate builders; all three converge on publish-forgejo-release.mjs
|
|
# so the Forgejo feed is the single update source.
|
|
#
|
|
# Required repository secrets:
|
|
# FORGEJO_TOKEN — PAT with write:package + write:repository
|
|
# WIN_CSC_LINK — base64 Authenticode PFX (public-trust)
|
|
# WIN_CSC_KEY_PASSWORD — PFX password
|
|
# WIN_CSC_EXPECTED_SIGNER_SUBJECT — exact certificate subject
|
|
# Release fails closed when signing material is absent.
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*.*.*"
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
release-windows:
|
|
runs-on: windows
|
|
defaults: { run: { shell: pwsh } }
|
|
steps:
|
|
- name: checkout
|
|
env: { CI_TOKEN: "${{ github.token }}" }
|
|
run: |
|
|
$u = [Uri]$env:GITHUB_SERVER_URL
|
|
$url = "$($u.Scheme)://actions:$($env:CI_TOKEN)@$($u.Authority)/$($env:GITHUB_REPOSITORY).git"
|
|
if (-not (Test-Path .git)) { git init -q . }
|
|
if (git remote | Select-String -Quiet '^origin$') { git remote set-url origin $url } else { git remote add origin $url }
|
|
git fetch -q --depth 1 origin $env:GITHUB_REF
|
|
git checkout -q -f FETCH_HEAD
|
|
git clean -qfdx
|
|
|
|
- name: 버전 정본 대조
|
|
run: |
|
|
node scripts/ci/sync-version.mjs --check --tag "$env:GITHUB_REF_NAME"
|
|
|
|
- name: 의존성 설치
|
|
run: npm ci
|
|
|
|
- name: 데스크톱 빌드 (서명 필수)
|
|
env:
|
|
WIN_CSC_LINK: "${{ secrets.WIN_CSC_LINK }}"
|
|
WIN_CSC_KEY_PASSWORD: "${{ secrets.WIN_CSC_KEY_PASSWORD }}"
|
|
WIN_CSC_EXPECTED_SIGNER_SUBJECT: "${{ secrets.WIN_CSC_EXPECTED_SIGNER_SUBJECT }}"
|
|
run: |
|
|
if (-not $env:WIN_CSC_LINK -or -not $env:WIN_CSC_KEY_PASSWORD) {
|
|
throw "WIN_CSC_LINK / WIN_CSC_KEY_PASSWORD 가 없으면 stable 릴리스를 게시할 수 없습니다."
|
|
}
|
|
if ($env:WIN_CSC_EXPECTED_SIGNER_SUBJECT -match '(?i)Everything2EverythingDev') {
|
|
throw "로컬 개발 인증서는 production 서명 identity가 아닙니다."
|
|
}
|
|
npm run build --workspace=@d3ro/desktop
|
|
Push-Location apps/desktop
|
|
npx electron-builder --win --x64 --config electron-builder.yml --publish never
|
|
Pop-Location
|
|
|
|
- name: Windows 산출물 검증
|
|
env:
|
|
WIN_CSC_EXPECTED_SIGNER_SUBJECT: "${{ secrets.WIN_CSC_EXPECTED_SIGNER_SUBJECT }}"
|
|
run: |
|
|
$releaseVersion = node -p "require('./release/product-version.json').version"
|
|
& scripts/ci/verify-windows-release-artifact.ps1 -ExpectedVersion $releaseVersion -ExpectedSignerSubject $env:WIN_CSC_EXPECTED_SIGNER_SUBJECT -ReleaseDirectory "apps/desktop/release/$releaseVersion"
|
|
|
|
- name: Forgejo 릴리스 + feed 게시
|
|
env:
|
|
FORGEJO_TOKEN: "${{ secrets.FORGEJO_TOKEN }}"
|
|
FORGEJO_REPO: "${{ github.server_url }}/${{ github.repository }}"
|
|
run: |
|
|
node scripts/ci/publish-forgejo-release.mjs
|