ae7efb6acf
Popup pages loaded their scripts as classic <script src> tags, which the
renderer build never bundles, so an installed app rendered only the static
markup: the recording tip stayed at 0:00 with no wave bars and live captions
showed nothing.
- declare popup scripts as modules so the build emits them, and fail
packaging when a renderer page references an asset that was never produced
- hold popup IPC until the renderer has loaded and re-assert visibility on
every show, so a popup hidden once still appears next time
- surface popup renderer console and load failures in the main log
💘 Generated with Crush
Assisted-by: Crush:deepseek-v4.1-flash
83 lines
3.6 KiB
YAML
83 lines
3.6 KiB
YAML
name: release
|
|
|
|
# Canonical tag-triggered desktop release built and published on Forgejo.
|
|
# GitLab CI (.gitlab-ci.yml) and GitHub Actions (.github/workflows/release.yml)
|
|
# remain alternate builders; all three converge on publish-forgejo-release.mjs
|
|
# so the Forgejo feed is the single update source.
|
|
#
|
|
# Required repository secrets:
|
|
# FORGEJO_TOKEN — PAT with write:package + write:repository
|
|
# WIN_CSC_LINK — base64 Authenticode PFX (public-trust)
|
|
# WIN_CSC_KEY_PASSWORD — PFX password
|
|
# WIN_CSC_EXPECTED_SIGNER_SUBJECT — exact certificate subject
|
|
# Release fails closed when signing material is absent.
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*.*.*"
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
release-windows:
|
|
runs-on: windows
|
|
defaults: { run: { shell: pwsh } }
|
|
steps:
|
|
- name: checkout
|
|
env: { CI_TOKEN: "${{ github.token }}" }
|
|
run: |
|
|
$u = [Uri]$env:GITHUB_SERVER_URL
|
|
$url = "$($u.Scheme)://actions:$($env:CI_TOKEN)@$($u.Authority)/$($env:GITHUB_REPOSITORY).git"
|
|
if (-not (Test-Path .git)) { git init -q . }
|
|
if (git remote | Select-String -Quiet '^origin$') { git remote set-url origin $url } else { git remote add origin $url }
|
|
git fetch -q --depth 1 origin $env:GITHUB_REF
|
|
git checkout -q -f FETCH_HEAD
|
|
git clean -qfdx
|
|
|
|
- name: 버전 정본 대조
|
|
run: |
|
|
node scripts/ci/sync-version.mjs --check --tag "$env:GITHUB_REF_NAME"
|
|
|
|
- name: 의존성 설치
|
|
run: npm ci
|
|
|
|
- name: STT 사이드카 빌드 (로컬 전사 엔진)
|
|
run: |
|
|
# 로컬 전사는 faster-whisper 사이드카에 의존한다. 이 번들이 빠지면
|
|
# 설치본에서 전사가 전혀 동작하지 않으므로 패키징 전에 반드시 빌드/검증한다.
|
|
npm run sidecar:setup --workspace=@d3ro/desktop
|
|
npm run sidecar:build --workspace=@d3ro/desktop
|
|
node scripts/ci/verify-sidecar-bundle.mjs
|
|
|
|
- name: 데스크톱 빌드 (서명 필수)
|
|
env:
|
|
WIN_CSC_LINK: "${{ secrets.WIN_CSC_LINK }}"
|
|
WIN_CSC_KEY_PASSWORD: "${{ secrets.WIN_CSC_KEY_PASSWORD }}"
|
|
WIN_CSC_EXPECTED_SIGNER_SUBJECT: "${{ secrets.WIN_CSC_EXPECTED_SIGNER_SUBJECT }}"
|
|
run: |
|
|
if (-not $env:WIN_CSC_LINK -or -not $env:WIN_CSC_KEY_PASSWORD) {
|
|
throw "WIN_CSC_LINK / WIN_CSC_KEY_PASSWORD 가 없으면 stable 릴리스를 게시할 수 없습니다."
|
|
}
|
|
if ($env:WIN_CSC_EXPECTED_SIGNER_SUBJECT -match '(?i)Everything2EverythingDev') {
|
|
throw "로컬 개발 인증서는 production 서명 identity가 아닙니다."
|
|
}
|
|
npm run build --workspace=@d3ro/desktop
|
|
node scripts/ci/verify-desktop-renderer-bundles.mjs
|
|
Push-Location apps/desktop
|
|
npx electron-builder --win --x64 --config electron-builder.yml --publish never
|
|
node scripts/ci/verify-native-abi.mjs
|
|
Pop-Location
|
|
|
|
- name: Windows 산출물 검증
|
|
env:
|
|
WIN_CSC_EXPECTED_SIGNER_SUBJECT: "${{ secrets.WIN_CSC_EXPECTED_SIGNER_SUBJECT }}"
|
|
run: |
|
|
$releaseVersion = node -p "require('./release/product-version.json').version"
|
|
& scripts/ci/verify-windows-release-artifact.ps1 -ExpectedVersion $releaseVersion -ExpectedSignerSubject $env:WIN_CSC_EXPECTED_SIGNER_SUBJECT -ReleaseDirectory "apps/desktop/release/$releaseVersion"
|
|
|
|
- name: Forgejo 릴리스 + feed 게시
|
|
env:
|
|
FORGEJO_TOKEN: "${{ secrets.FORGEJO_TOKEN }}"
|
|
FORGEJO_REPO: "${{ github.server_url }}/${{ github.repository }}"
|
|
run: |
|
|
node scripts/ci/publish-forgejo-release.mjs
|