7e1972a315
Packaging silently tolerates a missing resource directory: electron-builder prints "file source doesn't exist" and continues, which is how installers that could not transcribe were published. Every pipeline that packages the desktop app now builds the sidecar and fails when the engine or its VAD data is absent, so a release cannot ship without local transcription.
101 lines
3.5 KiB
YAML
101 lines
3.5 KiB
YAML
name: Release & Code Signing CA Pipeline
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build-and-sign-windows:
|
|
runs-on: windows-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Node.js 22
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: 'npm'
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Typecheck & Test
|
|
run: |
|
|
npm run typecheck
|
|
npm run test --workspace=@d3ro/api-client
|
|
|
|
# Azure Trusted Signing (Artifact Signing) for SmartScreen Reputation
|
|
- name: Setup Azure Trusted Signing
|
|
if: env.AZURE_CLIENT_ID != ''
|
|
uses: azure/trusted-signing-action@v0.4.1
|
|
with:
|
|
azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
|
|
azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
|
|
azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
|
|
endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
|
|
trusted-signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
|
|
certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE }}
|
|
|
|
- name: Build STT Sidecar (local transcription engine)
|
|
run: |
|
|
# Without this bundle the packaged app cannot transcribe at all.
|
|
npm run sidecar:setup --workspace=@d3ro/desktop
|
|
npm run sidecar:build --workspace=@d3ro/desktop
|
|
node scripts/ci/verify-sidecar-bundle.mjs
|
|
|
|
- name: Build and Package Windows (NSIS + RFC 3161 TSA)
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
RFC3161_TSA_SERVER: "http://timestamp.digicert.com"
|
|
run: |
|
|
npm run build --workspace=@d3ro/desktop
|
|
npx electron-builder --win --config apps/desktop/electron-builder.yml
|
|
|
|
- name: Upload Windows Artifacts
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: d3ro-voice-windows
|
|
path: apps/desktop/release/*/*.exe
|
|
|
|
build-and-sign-macos:
|
|
runs-on: macos-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Node.js 22
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: 'npm'
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Setup Apple Developer ID Certificate
|
|
if: env.APPLE_CERTIFICATE != ''
|
|
env:
|
|
APPLE_CERTIFICATE: ${{ secrets.MAC_CSC_LINK }}
|
|
APPLE_CERTIFICATE_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
|
|
run: |
|
|
echo "$APPLE_CERTIFICATE" | base64 --decode > certificate.p12
|
|
security create-keychain -p "" build.keychain
|
|
security default-keychain -s build.keychain
|
|
security unlock-keychain -p "" build.keychain
|
|
security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
|
|
security set-key-partition-list -S apple-tool:,apple: -s -k "" build.keychain
|
|
|
|
- name: Build, Sign, and Notarize macOS (Gatekeeper CA)
|
|
env:
|
|
APPLE_ID: ${{ secrets.APPLE_ID }}
|
|
APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
|
|
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
run: |
|
|
npm run build --workspace=@d3ro/desktop
|
|
npx electron-builder --mac --config apps/desktop/electron-builder.yml
|
|
|
|
- name: Upload macOS Artifacts
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: d3ro-voice-macos
|
|
path: apps/desktop/release/*/*.dmg
|