Feat/app release setup (#164)

2026-08-18 06:50:31 +02:00 · 2026-03-24 13:33:45 -07:00
parent bf6de08906
commit 52bd65a759
16 changed files with 1284 additions and 7 deletions
@@ -0,0 +1,141 @@
+name: Desktop Release
+
+on:
+  push:
+    tags:
+      - 'desktop/v*'
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  release:
+    name: Desktop Release
+    runs-on: macos-latest
+    permissions:
+      id-token: write
+      contents: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
+
+      - run: corepack enable pnpm
+
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          workspaces: desktop/src-tauri
+          key: desktop-release-aarch64-apple-darwin
+
+      - name: Validate tag matches desktop versions
+        run: |
+          TAG_VERSION="${GITHUB_REF#refs/tags/desktop/v}"
+          PACKAGE_VERSION="$(node -p "require('./desktop/package.json').version")"
+          TAURI_VERSION="$(node -p "require('./desktop/src-tauri/tauri.conf.json').version")"
+          CARGO_VERSION="$(grep '^version' desktop/src-tauri/Cargo.toml | head -1 | sed 's/version = "//;s/"//')"
+          if [ "$TAG_VERSION" != "$PACKAGE_VERSION" ] || [ "$TAG_VERSION" != "$TAURI_VERSION" ] || [ "$TAG_VERSION" != "$CARGO_VERSION" ]; then
+            echo "::error::Tag version ($TAG_VERSION) must match package.json ($PACKAGE_VERSION), tauri.conf.json ($TAURI_VERSION), and Cargo.toml ($CARGO_VERSION)"
+            exit 1
+          fi
+
+      - name: Validate release secrets
+        env:
+          SPROUT_UPDATER_PUBLIC_KEY: ${{ secrets.SPROUT_UPDATER_PUBLIC_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          OSX_CODESIGN_ROLE: ${{ secrets.OSX_CODESIGN_ROLE }}
+          CODESIGN_S3_BUCKET: ${{ secrets.CODESIGN_S3_BUCKET }}
+        run: |
+          missing=()
+          for name in \
+            SPROUT_UPDATER_PUBLIC_KEY \
+            TAURI_SIGNING_PRIVATE_KEY \
+            TAURI_SIGNING_PRIVATE_KEY_PASSWORD \
+            OSX_CODESIGN_ROLE \
+            CODESIGN_S3_BUCKET; do
+            if [ -z "${!name}" ]; then
+              missing+=("$name")
+            fi
+          done
+          if [ "${#missing[@]}" -gt 0 ]; then
+            echo "::error::Missing required desktop release secrets: ${missing[*]}"
+            exit 1
+          fi
+
+      - name: Install dependencies
+        run: |
+          cd desktop && pnpm install --frozen-lockfile
+          cd src-tauri && cargo fetch
+
+      - name: Build release config
+        working-directory: desktop
+        env:
+          SPROUT_UPDATER_PUBLIC_KEY: ${{ secrets.SPROUT_UPDATER_PUBLIC_KEY }}
+          SPROUT_UPDATER_ENDPOINT: https://github.com/${{ github.repository }}/releases/download/sprout-desktop-latest/latest.json
+        run: pnpm run tauri:release:config
+
+      - name: Build Tauri app
+        working-directory: desktop
+        run: pnpm tauri build --config src-tauri/tauri.release.conf.json
+
+      - name: Codesign and Notarize
+        id: codesign
+        uses: block/apple-codesign-action@679535d1ab7c5a7c18e6f9afcba3464512cc3dde # v1.1.0
+        with:
+          osx-codesign-role: ${{ secrets.OSX_CODESIGN_ROLE }}
+          codesign-s3-bucket: ${{ secrets.CODESIGN_S3_BUCKET }}
+          unsigned-artifact-path: desktop/src-tauri/target/release/bundle/macos/Sprout.app
+          artifact-name: sprout-${{ github.sha }}-${{ github.run_id }}-arm64
+
+      - name: Replace with signed app
+        env:
+          SIGNED_PATH: ${{ steps.codesign.outputs.signed-artifact-path }}
+        run: |
+          BUNDLE_DIR="desktop/src-tauri/target/release/bundle/macos"
+          rm -rf "${BUNDLE_DIR}/Sprout.app"
+          unzip -o "$SIGNED_PATH" -d "${BUNDLE_DIR}"
+
+      - name: Create DMG from signed app
+        run: |
+          VERSION="$(node -p "require('./desktop/package.json').version")"
+          DMG_DIR="desktop/src-tauri/target/release/bundle/dmg"
+          mkdir -p "${DMG_DIR}"
+          rm -f "${DMG_DIR}"/*.dmg
+          hdiutil create -volname "Sprout" \
+            -srcfolder desktop/src-tauri/target/release/bundle/macos/Sprout.app \
+            -ov -format UDZO \
+            "${DMG_DIR}/Sprout_${VERSION}_aarch64.dmg"
+
+      - name: Create updater archive from signed app
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        run: |
+          BUNDLE_DIR="desktop/src-tauri/target/release/bundle/macos"
+          rm -f "${BUNDLE_DIR}/Sprout.app.tar.gz" "${BUNDLE_DIR}/Sprout.app.tar.gz.sig"
+          tar czf "${BUNDLE_DIR}/Sprout.app.tar.gz" -C "${BUNDLE_DIR}" Sprout.app
+          cd desktop && pnpm tauri signer sign -k "$TAURI_SIGNING_PRIVATE_KEY" -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "src-tauri/target/release/bundle/macos/Sprout.app.tar.gz"
+
+      - name: Create versioned release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          VERSION="${GITHUB_REF#refs/tags/desktop/v}"
+          gh release create "$GITHUB_REF_NAME" \
+            --repo "$GITHUB_REPOSITORY" \
+            --title "Sprout Desktop v${VERSION}" \
+            --notes "See the assets to download and install this version."
+
+      - name: Publish updater alias
+        working-directory: desktop
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+        run: pnpm run release:updater:publish
+
+      - name: Publish DMG alias
+        working-directory: desktop
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+        run: pnpm run release:dmg:publish