dc43884e3e
The repository has Forgejo and GitLab remotes but no GitHub remote, so nothing under .github/workflows ever ran - including the daily Payple renewal job, which means Payple subscriptions were not being renewed. - Port payple-renew (daily cron + manual dispatch) to Forgejo. Requires the Forgejo secrets SUPABASE_URL and CRON_SECRET. - Port the CI checks (quality incl. version:check and contract:check, build, mobile quality, edge functions, API tests) to .forgejo/workflows/ci.yml. macOS and Android emulator jobs are dropped: no macOS runner here, and the signed Android release stays on GitLab mobile-production-release. - Keep one site deploy workflow (Linux, Cloudflare Pages); remove the manual Windows duplicate. The mobile release boundary self-test runs there. - Release verifiers read the Forgejo/GitLab workflows, fail if .github workflows come back, and check the rewritten site offers no mobile package. Policy: docs/REFACTOR_POLICY.md Wave 3, W3-7 and W3-8.
82 lines
3.6 KiB
YAML
82 lines
3.6 KiB
YAML
name: release
|
|
|
|
# Canonical tag-triggered desktop release built and published on Forgejo.
|
|
# GitLab CI (.gitlab-ci.yml) is the legacy mirror builder; both converge on
|
|
# publish-forgejo-release.mjs so the Forgejo feed is the single update source.
|
|
#
|
|
# Required repository secrets:
|
|
# FORGEJO_TOKEN — PAT with write:package + write:repository
|
|
# WIN_CSC_LINK — base64 Authenticode PFX (public-trust)
|
|
# WIN_CSC_KEY_PASSWORD — PFX password
|
|
# WIN_CSC_EXPECTED_SIGNER_SUBJECT — exact certificate subject
|
|
# Release fails closed when signing material is absent.
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*.*.*"
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
release-windows:
|
|
runs-on: windows
|
|
defaults: { run: { shell: pwsh } }
|
|
steps:
|
|
- name: checkout
|
|
env: { CI_TOKEN: "${{ github.token }}" }
|
|
run: |
|
|
$u = [Uri]$env:GITHUB_SERVER_URL
|
|
$url = "$($u.Scheme)://actions:$($env:CI_TOKEN)@$($u.Authority)/$($env:GITHUB_REPOSITORY).git"
|
|
if (-not (Test-Path .git)) { git init -q . }
|
|
if (git remote | Select-String -Quiet '^origin$') { git remote set-url origin $url } else { git remote add origin $url }
|
|
git fetch -q --depth 1 origin $env:GITHUB_REF
|
|
git checkout -q -f FETCH_HEAD
|
|
git clean -qfdx
|
|
|
|
- name: 버전 정본 대조
|
|
run: |
|
|
node scripts/ci/sync-version.mjs --check --tag "$env:GITHUB_REF_NAME"
|
|
|
|
- name: 의존성 설치
|
|
run: npm ci
|
|
|
|
- name: STT 사이드카 빌드 (로컬 전사 엔진)
|
|
run: |
|
|
# 로컬 전사는 faster-whisper 사이드카에 의존한다. 이 번들이 빠지면
|
|
# 설치본에서 전사가 전혀 동작하지 않으므로 패키징 전에 반드시 빌드/검증한다.
|
|
npm run sidecar:setup --workspace=@d3ro/desktop
|
|
npm run sidecar:build --workspace=@d3ro/desktop
|
|
node scripts/ci/verify-sidecar-bundle.mjs
|
|
|
|
- name: 데스크톱 빌드 (서명 필수)
|
|
env:
|
|
WIN_CSC_LINK: "${{ secrets.WIN_CSC_LINK }}"
|
|
WIN_CSC_KEY_PASSWORD: "${{ secrets.WIN_CSC_KEY_PASSWORD }}"
|
|
WIN_CSC_EXPECTED_SIGNER_SUBJECT: "${{ secrets.WIN_CSC_EXPECTED_SIGNER_SUBJECT }}"
|
|
run: |
|
|
if (-not $env:WIN_CSC_LINK -or -not $env:WIN_CSC_KEY_PASSWORD) {
|
|
throw "WIN_CSC_LINK / WIN_CSC_KEY_PASSWORD 가 없으면 stable 릴리스를 게시할 수 없습니다."
|
|
}
|
|
if ($env:WIN_CSC_EXPECTED_SIGNER_SUBJECT -match '(?i)Everything2EverythingDev') {
|
|
throw "로컬 개발 인증서는 production 서명 identity가 아닙니다."
|
|
}
|
|
npm run build --workspace=@d3ro/desktop
|
|
node scripts/ci/verify-desktop-renderer-bundles.mjs
|
|
Push-Location apps/desktop
|
|
npx electron-builder --win --x64 --config electron-builder.yml --publish never
|
|
node scripts/ci/verify-native-abi.mjs
|
|
Pop-Location
|
|
|
|
- name: Windows 산출물 검증
|
|
env:
|
|
WIN_CSC_EXPECTED_SIGNER_SUBJECT: "${{ secrets.WIN_CSC_EXPECTED_SIGNER_SUBJECT }}"
|
|
run: |
|
|
$releaseVersion = node -p "require('./release/product-version.json').version"
|
|
& scripts/ci/verify-windows-release-artifact.ps1 -ExpectedVersion $releaseVersion -ExpectedSignerSubject $env:WIN_CSC_EXPECTED_SIGNER_SUBJECT -ReleaseDirectory "apps/desktop/release/$releaseVersion"
|
|
|
|
- name: Forgejo 릴리스 + feed 게시
|
|
env:
|
|
FORGEJO_TOKEN: "${{ secrets.FORGEJO_TOKEN }}"
|
|
FORGEJO_REPO: "${{ github.server_url }}/${{ github.repository }}"
|
|
run: |
|
|
node scripts/ci/publish-forgejo-release.mjs
|