1af3cf75c7
Some checks failed
deploy-site / deploy (push) Failing after 14m16s
The released installer could not start: it carried a better-sqlite3 build for the host Node runtime instead of Electron, so the app died immediately with a module version mismatch when it opened its database. Packaging now proves the Electron build of every runtime-sensitive native module before an installer or archive exists, and installers are produced only from that verified tree, so the mistake cannot pass silently. The release pipelines run the same check. The default local model also pointed at a retired model: a *.gguf name that Ollama cannot serve, while the settings, onboarding, and guide screens recommended an older model. All of them now use the model the service code already preferred.
82 lines
3.6 KiB
YAML
82 lines
3.6 KiB
YAML
name: release
|
|
|
|
# Canonical tag-triggered desktop release built and published on Forgejo.
|
|
# GitLab CI (.gitlab-ci.yml) and GitHub Actions (.github/workflows/release.yml)
|
|
# remain alternate builders; all three converge on publish-forgejo-release.mjs
|
|
# so the Forgejo feed is the single update source.
|
|
#
|
|
# Required repository secrets:
|
|
# FORGEJO_TOKEN — PAT with write:package + write:repository
|
|
# WIN_CSC_LINK — base64 Authenticode PFX (public-trust)
|
|
# WIN_CSC_KEY_PASSWORD — PFX password
|
|
# WIN_CSC_EXPECTED_SIGNER_SUBJECT — exact certificate subject
|
|
# Release fails closed when signing material is absent.
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*.*.*"
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
release-windows:
|
|
runs-on: windows
|
|
defaults: { run: { shell: pwsh } }
|
|
steps:
|
|
- name: checkout
|
|
env: { CI_TOKEN: "${{ github.token }}" }
|
|
run: |
|
|
$u = [Uri]$env:GITHUB_SERVER_URL
|
|
$url = "$($u.Scheme)://actions:$($env:CI_TOKEN)@$($u.Authority)/$($env:GITHUB_REPOSITORY).git"
|
|
if (-not (Test-Path .git)) { git init -q . }
|
|
if (git remote | Select-String -Quiet '^origin$') { git remote set-url origin $url } else { git remote add origin $url }
|
|
git fetch -q --depth 1 origin $env:GITHUB_REF
|
|
git checkout -q -f FETCH_HEAD
|
|
git clean -qfdx
|
|
|
|
- name: 버전 정본 대조
|
|
run: |
|
|
node scripts/ci/sync-version.mjs --check --tag "$env:GITHUB_REF_NAME"
|
|
|
|
- name: 의존성 설치
|
|
run: npm ci
|
|
|
|
- name: STT 사이드카 빌드 (로컬 전사 엔진)
|
|
run: |
|
|
# 로컬 전사는 faster-whisper 사이드카에 의존한다. 이 번들이 빠지면
|
|
# 설치본에서 전사가 전혀 동작하지 않으므로 패키징 전에 반드시 빌드/검증한다.
|
|
npm run sidecar:setup --workspace=@d3ro/desktop
|
|
npm run sidecar:build --workspace=@d3ro/desktop
|
|
node scripts/ci/verify-sidecar-bundle.mjs
|
|
|
|
- name: 데스크톱 빌드 (서명 필수)
|
|
env:
|
|
WIN_CSC_LINK: "${{ secrets.WIN_CSC_LINK }}"
|
|
WIN_CSC_KEY_PASSWORD: "${{ secrets.WIN_CSC_KEY_PASSWORD }}"
|
|
WIN_CSC_EXPECTED_SIGNER_SUBJECT: "${{ secrets.WIN_CSC_EXPECTED_SIGNER_SUBJECT }}"
|
|
run: |
|
|
if (-not $env:WIN_CSC_LINK -or -not $env:WIN_CSC_KEY_PASSWORD) {
|
|
throw "WIN_CSC_LINK / WIN_CSC_KEY_PASSWORD 가 없으면 stable 릴리스를 게시할 수 없습니다."
|
|
}
|
|
if ($env:WIN_CSC_EXPECTED_SIGNER_SUBJECT -match '(?i)Everything2EverythingDev') {
|
|
throw "로컬 개발 인증서는 production 서명 identity가 아닙니다."
|
|
}
|
|
npm run build --workspace=@d3ro/desktop
|
|
Push-Location apps/desktop
|
|
npx electron-builder --win --x64 --config electron-builder.yml --publish never
|
|
node scripts/ci/verify-native-abi.mjs
|
|
Pop-Location
|
|
|
|
- name: Windows 산출물 검증
|
|
env:
|
|
WIN_CSC_EXPECTED_SIGNER_SUBJECT: "${{ secrets.WIN_CSC_EXPECTED_SIGNER_SUBJECT }}"
|
|
run: |
|
|
$releaseVersion = node -p "require('./release/product-version.json').version"
|
|
& scripts/ci/verify-windows-release-artifact.ps1 -ExpectedVersion $releaseVersion -ExpectedSignerSubject $env:WIN_CSC_EXPECTED_SIGNER_SUBJECT -ReleaseDirectory "apps/desktop/release/$releaseVersion"
|
|
|
|
- name: Forgejo 릴리스 + feed 게시
|
|
env:
|
|
FORGEJO_TOKEN: "${{ secrets.FORGEJO_TOKEN }}"
|
|
FORGEJO_REPO: "${{ github.server_url }}/${{ github.repository }}"
|
|
run: |
|
|
node scripts/ci/publish-forgejo-release.mjs
|