External/open-design
1
0
Fork 0
mirror of https://github.com/nexu-io/open-design.git synced 2026-10-27 09:51:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

release: harden packaged launcher validation (#3995)

Browse Source 
* Unify release metadata publishing

* Allow empty release asset suffix

* Harden beta-s release publishing

* Clean beta Windows release namespace

* Clean Windows launcher namespace

* Retry transient mac notarization uploads

* Control mac notarization upload mode

* Notarize release mac DMGs after build

* Harden release mac DMG notarization retries

* Make beta-s mac updates payload-first

* Bake mac updater metadata URL

* Add unsafe DMG install helper

* Fix beta-s feed and About version

* Improve release validation observability

* Build launcher proto before packaging

* Notarize release-stable mac artifacts

* Enable mac notarization in tools-pack

* test: update packaged release workflow assertions
This commit is contained in:
PerishFire
2026-06-09 11:50:01 +00:00
committed by GitHub
parent 041c09c494
commit f9433a7a07
45 changed files with 2293 additions and 612 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release-beta-s.yml
+41 -12
View File
@@ -50,8 +50,16 @@ on:
required: false
type: string
default: ""
mac_arm64_delivery_mode:
description: "macOS arm64 delivery policy. Internal updater signs payloads without notarization; public notarized validates first-install DMGs."
required: true
type: choice
options:
- "internal-updater"
- "public-notarized"
default: "internal-updater"
mac_arm64_sign_mode:
description: "macOS arm64 signing mode."
description: "macOS arm64 signing mode used when delivery mode is public-notarized."
required: true
type: choice
options:
@@ -196,6 +204,10 @@ on:
required: false
type: string
default: ""
mac_arm64_delivery_mode:
required: false
type: string
default: internal-updater
mac_arm64_sign_mode:
required: false
type: string
@@ -418,6 +430,17 @@ jobs:
echo "release-beta-s publish requires win_x64_target=nsis or all so the installer and updater feed are produced" >&2
exit 1
fi
case "${{ inputs.mac_arm64_delivery_mode }}" in
internal-updater | public-notarized) ;;
*)
echo "unsupported mac_arm64_delivery_mode: ${{ inputs.mac_arm64_delivery_mode }}" >&2
exit 1
;;
esac
if [ "${{ inputs.mac_arm64_delivery_mode }}" = "public-notarized" ] && [ "${{ inputs.mac_arm64_sign_mode }}" != "notarize" ]; then
echo "public-notarized mac_arm64_delivery_mode requires mac_arm64_sign_mode=notarize" >&2
exit 1
fi
- name: Capture previous beta commit
id: prev
@@ -454,6 +477,7 @@ jobs:
env:
BASE_VERSION: ${{ steps.beta.outputs.base_version }}
RELEASE_CHANNEL: beta
RELEASE_COMMIT: ${{ steps.checkout.outputs.commit }}
RELEASE_LANE: release-beta-s
RELEASE_METADATA_DIR: ${{ runner.temp }}/release-version-reservation
RELEASE_PUBLIC_ORIGIN: ${{ inputs.release_public_origin }}
@@ -534,13 +558,15 @@ jobs:
BUILD_JSON_PATH: ${{ runner.temp }}/release-build/mac_arm64/build.json
BUILD_LOG_PATH: ${{ runner.temp }}/release-build/mac_arm64/build.log
CSC_KEYCHAIN: /Library/Keychains/open-design-release-signing.keychain
OD_UPDATE_METADATA_URL: ${{ inputs.release_public_origin }}/beta/latest/metadata.json
OD_PACKAGED_E2E_MAC_UPDATE_METADATA_URL: ${{ inputs.mac_arm64_update_metadata_url }}
OD_PACKAGED_E2E_MAC_UPDATE_VERSION: ${{ inputs.mac_arm64_update_target_version }}
RELEASE_BUILD_TARGET: ${{ inputs.mac_arm64_target }}
RELEASE_DELIVERY_MODE: ${{ inputs.mac_arm64_delivery_mode }}
RELEASE_NAMESPACE: release-beta
RELEASE_OUTPUTS_PATH: ${{ runner.temp }}/release-build/mac_arm64/outputs.json
RELEASE_REPORT_DIR: ${{ runner.temp }}/release-report/mac_arm64
RELEASE_SIGN_MODE: ${{ inputs.mac_arm64_sign_mode }}
RELEASE_SIGN_MODE: ${{ inputs.mac_arm64_delivery_mode == 'internal-updater' && 'sign-only' || inputs.mac_arm64_sign_mode }}
RELEASE_SMOKE_MODE: ${{ inputs.mac_arm64_smoke_mode }}
RELEASE_TARGET: mac_arm64
RELEASE_VERSION: ${{ needs.metadata.outputs.beta_version }}
@@ -556,7 +582,7 @@ jobs:
# shellcheck disable=SC1090
source "$OPEN_DESIGN_RELEASE_PROFILE"
export PATH="/usr/local/libexec/open-design/wrappers:$PATH"
if [ "${{ inputs.mac_arm64_sign_mode }}" != "no" ] && [ -n "${OPEN_DESIGN_MAC_SIGNING_HELPER:-}" ]; then
if [ "${{ inputs.mac_arm64_delivery_mode == 'internal-updater' && 'sign-only' || inputs.mac_arm64_sign_mode }}" != "no" ] && [ -n "${OPEN_DESIGN_MAC_SIGNING_HELPER:-}" ]; then
cert_path="${{ runner.temp }}/open-design-signing.p12"
password_path="${{ runner.temp }}/open-design-signing.p12.password"
if ! printf '%s' "$APPLE_SIGNING_CERTIFICATE_BASE64" | base64 --decode > "$cert_path" 2>/dev/null; then
@@ -579,6 +605,7 @@ jobs:
BUILD_LOG_PATH: ${{ runner.temp }}/release-build/mac_arm64/build.log
RELEASE_BUILD_TARGET: ${{ inputs.mac_arm64_target }}
RELEASE_CHANNEL: beta
RELEASE_DELIVERY_MODE: ${{ inputs.mac_arm64_delivery_mode }}
RELEASE_NAMESPACE: release-beta
RELEASE_REPORT_DIR: ${{ runner.temp }}/release-report/mac_arm64
RELEASE_REPORT_JSON_PATH: ${{ runner.temp }}/release-report/mac_arm64/report.json
@@ -605,11 +632,11 @@ jobs:
working-directory: _release-build
env:
RELEASE_ARTIFACT_MODE: dmg-and-payload
RELEASE_ASSET_SUFFIX: ${{ inputs.mac_arm64_sign_mode != 'no' && '.signed' || '.unsigned' }}
RELEASE_ASSET_SUFFIX: ${{ (inputs.mac_arm64_delivery_mode == 'internal-updater' || inputs.mac_arm64_sign_mode != 'no') && '.signed' || '.unsigned' }}
RELEASE_ASSETS_DIR: ${{ runner.temp }}/release-assets/mac_arm64
RELEASE_CHANNEL: beta
RELEASE_NAMESPACE: release-beta
RELEASE_NOTES: Open Design beta ${{ needs.metadata.outputs.beta_version }}${{ inputs.mac_arm64_sign_mode != 'no' && '.signed' || '.unsigned' }}
RELEASE_NOTES: Open Design beta ${{ needs.metadata.outputs.beta_version }}${{ (inputs.mac_arm64_delivery_mode == 'internal-updater' || inputs.mac_arm64_sign_mode != 'no') && '.signed' || '.unsigned' }} ${{ inputs.mac_arm64_delivery_mode }}
RELEASE_PUBLIC_ORIGIN: ${{ inputs.release_public_origin }}
RELEASE_TARGET: mac_arm64
RELEASE_VERSION: ${{ needs.metadata.outputs.beta_version }}
@@ -620,7 +647,7 @@ jobs:
if: ${{ inputs.publish }}
working-directory: _release-build
env:
RELEASE_ASSET_SUFFIX: ${{ inputs.mac_arm64_sign_mode != 'no' && '.signed' || '.unsigned' }}
RELEASE_ASSET_SUFFIX: ${{ (inputs.mac_arm64_delivery_mode == 'internal-updater' || inputs.mac_arm64_sign_mode != 'no') && '.signed' || '.unsigned' }}
RELEASE_ASSETS_DIR: ${{ runner.temp }}/release-assets/mac_arm64
RELEASE_ARTIFACT_MODE: dmg-and-payload
RELEASE_CHANNEL: beta
@@ -629,7 +656,7 @@ jobs:
RELEASE_PUBLIC_ORIGIN: ${{ inputs.release_public_origin }}
RELEASE_REPORT_DIR: ${{ runner.temp }}/release-report/mac_arm64
RELEASE_REPORT_ZIP_PATH: ${{ runner.temp }}/release-report/mac_arm64-report.zip
RELEASE_SIGNED: ${{ inputs.mac_arm64_sign_mode != 'no' && 'true' || 'false' }}
RELEASE_SIGNED: ${{ (inputs.mac_arm64_delivery_mode == 'internal-updater' || inputs.mac_arm64_sign_mode != 'no') && 'true' || 'false' }}
RELEASE_STORAGE_ACCESS_KEY_ID: ${{ secrets.NEXU_S3_ACCESS_KEY_ID }}
RELEASE_STORAGE_BUCKET: ${{ secrets.NEXU_S3_BUCKET }}
RELEASE_STORAGE_ENDPOINT: ${{ secrets.NEXU_S3_ENDPOINT }}
@@ -814,7 +841,7 @@ jobs:
- name: Download mac_arm64 platform manifest
if: ${{ inputs.enable_mac_arm64 && needs.build_mac_arm64.result == 'success' }}
env:
RELEASE_ASSET_SUFFIX: ${{ inputs.mac_arm64_sign_mode != 'no' && '.signed' || '.unsigned' }}
RELEASE_ASSET_SUFFIX: ${{ (inputs.mac_arm64_delivery_mode == 'internal-updater' || inputs.mac_arm64_sign_mode != 'no') && '.signed' || '.unsigned' }}
RELEASE_MANIFEST_DIR: ${{ runner.temp }}/release-platform-manifests
RELEASE_PUBLIC_ORIGIN: ${{ inputs.release_public_origin }}
RELEASE_TARGET: mac_arm64
@@ -884,7 +911,7 @@ jobs:
RELEASE_METADATA_DIR: ${{ runner.temp }}/release-metadata
RELEASE_OUTPUTS_PATH: ${{ runner.temp }}/release-metadata/outputs.json
RELEASE_PUBLIC_ORIGIN: ${{ inputs.release_public_origin }}
RELEASE_SIGNED: "false"
RELEASE_SIGNED: ${{ inputs.enable_mac_arm64 && (inputs.mac_arm64_delivery_mode == 'internal-updater' || inputs.mac_arm64_sign_mode != 'no') && 'true' || 'false' }}
RELEASE_STORAGE_ACCESS_KEY_ID: ${{ secrets.NEXU_S3_ACCESS_KEY_ID }}
RELEASE_STORAGE_BUCKET: ${{ secrets.NEXU_S3_BUCKET }}
RELEASE_STORAGE_ENDPOINT: ${{ secrets.NEXU_S3_ENDPOINT }}
@@ -903,7 +930,7 @@ jobs:
fi
# shellcheck disable=SC1090
source "$OPEN_DESIGN_RELEASE_PROFILE"
fnm exec --using=24 -- node --experimental-strip-types .github/workflow/scripts/release/storage/publish-beta-metadata.ts
fnm exec --using=24 -- node --experimental-strip-types .github/workflow/scripts/release/storage/publish-metadata.ts
- name: Read metadata outputs
id: outputs
@@ -921,6 +948,7 @@ jobs:
ENABLE_MAC_X64: "false"
ENABLE_WIN_X64: ${{ inputs.enable_win_x64 }}
MAC_ARM64_RESULT: ${{ needs.build_mac_arm64.result }}
RELEASE_CHANNEL: beta
RELEASE_METADATA_URL: ${{ steps.outputs.outputs.version_metadata_url }}
RELEASE_VERSION: ${{ needs.metadata.outputs.beta_version }}
WIN_X64_RESULT: ${{ needs.build_win_x64.result }}
@@ -932,10 +960,11 @@ jobs:
fi
# shellcheck disable=SC1090
source "$OPEN_DESIGN_RELEASE_PROFILE"
fnm exec --using=24 -- node --experimental-strip-types .github/workflow/scripts/release/storage/verify-beta-metadata.ts
fnm exec --using=24 -- node --experimental-strip-types .github/workflow/scripts/release/storage/verify-metadata.ts
- name: Write beta metadata summary
env:
RELEASE_CHANNEL: beta
RELEASE_METADATA_URL: ${{ steps.outputs.outputs.version_metadata_url }}
RELEASE_SUMMARY_PATH: ${{ runner.temp }}/release-metadata/summary.md
working-directory: _release-scripts
@@ -946,7 +975,7 @@ jobs:
fi
# shellcheck disable=SC1090
source "$OPEN_DESIGN_RELEASE_PROFILE"
fnm exec --using=24 -- node --experimental-strip-types .github/workflow/scripts/release/storage/summary-beta.ts
fnm exec --using=24 -- node --experimental-strip-types .github/workflow/scripts/release/storage/summary-metadata.ts
- name: Publish summary
run: cat "${{ runner.temp }}/release-metadata/summary.md" >> "$GITHUB_STEP_SUMMARY"
.github/workflows/release-beta.yml
+5 -3
View File
@@ -956,7 +956,7 @@ jobs:
RELEASE_VERSION: ${{ needs.metadata.outputs.beta_version }}
STATE_SOURCE: ${{ needs.metadata.outputs.state_source }}
WIN_X64_RESULT: ${{ needs.build_win_x64.result }}
run: node --experimental-strip-types .github/workflow/scripts/release/storage/publish-beta-metadata.ts
run: node --experimental-strip-types .github/workflow/scripts/release/storage/publish-metadata.ts
- name: Read metadata outputs
id: outputs
@@ -976,16 +976,18 @@ jobs:
LINUX_X64_RESULT: ${{ needs.build_linux_x64.result }}
MAC_ARM64_RESULT: ${{ needs.build_mac_arm64.result }}
MAC_X64_RESULT: ${{ needs.build_mac_x64.result }}
RELEASE_CHANNEL: beta
RELEASE_METADATA_URL: ${{ steps.outputs.outputs.version_metadata_url }}
RELEASE_VERSION: ${{ needs.metadata.outputs.beta_version }}
WIN_X64_RESULT: ${{ needs.build_win_x64.result }}
run: node --experimental-strip-types .github/workflow/scripts/release/storage/verify-beta-metadata.ts
run: node --experimental-strip-types .github/workflow/scripts/release/storage/verify-metadata.ts
- name: Write beta metadata summary
env:
RELEASE_CHANNEL: beta
RELEASE_METADATA_URL: ${{ steps.outputs.outputs.version_metadata_url }}
RELEASE_SUMMARY_PATH: ${{ runner.temp }}/release-metadata/summary.md
run: node --experimental-strip-types .github/workflow/scripts/release/storage/summary-beta.ts
run: node --experimental-strip-types .github/workflow/scripts/release/storage/summary-metadata.ts
- name: Publish summary
run: cat "${{ runner.temp }}/release-metadata/summary.md" >> "$GITHUB_STEP_SUMMARY"
.github/workflows/release-preview.yml
+199 -82
View File
@@ -301,18 +301,45 @@ jobs:
- name: Prepare mac preview assets
env:
CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
RELEASE_ARTIFACT_MODE: all
RELEASE_ASSET_SUFFIX: ""
RELEASE_ASSETS_DIR: ${{ runner.temp }}/release-assets/mac_arm64
RELEASE_CHANNEL: preview
RELEASE_NAMESPACE: release-preview
RELEASE_NOTES: Open Design Preview ${{ needs.metadata.outputs.release_version }}
RELEASE_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
RELEASE_TARGET: mac_arm64
RELEASE_VERSION: ${{ needs.metadata.outputs.release_version }}
TOOLS_PACK_NAMESPACE: release-preview
run: bash .github/scripts/release/assets/mac.sh
TOOLS_PACK_DIR: ${{ runner.temp }}/tools-pack
run: bash .github/workflow/scripts/release/prepare-platform-assets.sh
- name: Upload mac preview bundle
- name: Publish mac preview platform
env:
RELEASE_ARTIFACT_MODE: all
RELEASE_ASSET_SUFFIX: ""
RELEASE_ASSETS_DIR: ${{ runner.temp }}/release-assets/mac_arm64
RELEASE_CHANNEL: preview
RELEASE_MANIFEST_DIR: ${{ runner.temp }}/release-platform-manifests
RELEASE_OUTPUTS_PATH: ${{ runner.temp }}/release-platform-outputs/mac_arm64.json
RELEASE_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
RELEASE_REPORT_DIR: ${{ runner.temp }}/release-report/mac
RELEASE_REPORT_ZIP_PATH: ${{ runner.temp }}/release-report/mac-report.zip
RELEASE_SIGNED: "true"
RELEASE_STORAGE_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_RELEASES_AK }}
RELEASE_STORAGE_BUCKET: ${{ secrets.CLOUDFLARE_R2_RELEASES_BUCKET }}
RELEASE_STORAGE_ENDPOINT: ${{ secrets.CLOUDFLARE_R2_RELEASES_URL }}
RELEASE_STORAGE_REGION: auto
RELEASE_STORAGE_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_RELEASES_SK }}
RELEASE_TARGET: mac_arm64
RELEASE_VERSION: ${{ needs.metadata.outputs.release_version }}
run: node --experimental-strip-types .github/workflow/scripts/release/storage/publish-platform.ts
- name: Upload mac preview publish manifest
uses: actions/upload-artifact@v7
with:
name: open-design-preview-mac-release-assets
path: ${{ runner.temp }}/release-assets
name: open-design-preview-mac-arm64-publish-manifest
path: ${{ runner.temp }}/release-platform-manifests/mac_arm64.json
if-no-files-found: error
retention-days: 1
build_mac_intel:
@@ -374,16 +401,42 @@ jobs:
- name: Prepare mac intel preview assets
env:
RELEASE_ARTIFACT_MODE: all
RELEASE_ASSET_SUFFIX: ""
RELEASE_ASSETS_DIR: ${{ runner.temp }}/release-assets/mac_x64
RELEASE_CHANNEL: preview
RELEASE_NAMESPACE: release-preview-intel
RELEASE_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
RELEASE_TARGET: mac_x64
RELEASE_VERSION: ${{ needs.metadata.outputs.release_version }}
TOOLS_PACK_NAMESPACE: release-preview-intel
run: bash .github/scripts/release/assets/mac-intel.sh
TOOLS_PACK_DIR: ${{ runner.temp }}/tools-pack
run: bash .github/workflow/scripts/release/prepare-platform-assets.sh
- name: Upload mac intel preview bundle
- name: Publish mac intel preview platform
env:
RELEASE_ARTIFACT_MODE: all
RELEASE_ASSET_SUFFIX: ""
RELEASE_ASSETS_DIR: ${{ runner.temp }}/release-assets/mac_x64
RELEASE_CHANNEL: preview
RELEASE_MANIFEST_DIR: ${{ runner.temp }}/release-platform-manifests
RELEASE_OUTPUTS_PATH: ${{ runner.temp }}/release-platform-outputs/mac_x64.json
RELEASE_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
RELEASE_SIGNED: "true"
RELEASE_STORAGE_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_RELEASES_AK }}
RELEASE_STORAGE_BUCKET: ${{ secrets.CLOUDFLARE_R2_RELEASES_BUCKET }}
RELEASE_STORAGE_ENDPOINT: ${{ secrets.CLOUDFLARE_R2_RELEASES_URL }}
RELEASE_STORAGE_REGION: auto
RELEASE_STORAGE_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_RELEASES_SK }}
RELEASE_TARGET: mac_x64
RELEASE_VERSION: ${{ needs.metadata.outputs.release_version }}
run: node --experimental-strip-types .github/workflow/scripts/release/storage/publish-platform.ts
- name: Upload mac intel preview publish manifest
uses: actions/upload-artifact@v7
with:
name: open-design-preview-mac-intel-release-assets
path: ${{ runner.temp }}/release-assets
name: open-design-preview-mac-x64-publish-manifest
path: ${{ runner.temp }}/release-platform-manifests/mac_x64.json
if-no-files-found: error
retention-days: 1
build_win:
@@ -557,19 +610,45 @@ jobs:
- name: Prepare windows preview assets
shell: pwsh
env:
CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
RELEASE_CHANNEL: preview
RELEASE_NOTES: Open Design Preview ${{ needs.metadata.outputs.release_version }}
RELEASE_VERSION: ${{ needs.metadata.outputs.release_version }}
TOOLS_PACK_NAMESPACE: release-preview-win
run: ./.github/scripts/release/assets/win.ps1
run: |
.\.github\workflow\scripts\release\prepare-platform-assets.ps1 `
-ReleaseTarget win_x64 `
-ReleaseAssetsDir "${{ runner.temp }}\release-assets\win_x64" `
-BuildJsonPath "${{ runner.temp }}\windows-tools-pack-build.json" `
-ReleaseNamespace release-preview-win `
-ReleaseVersion "${{ needs.metadata.outputs.release_version }}" `
-ReleaseAssetSuffix "" `
-ReleaseChannel preview `
-ReleasePublicOrigin "${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}" `
-ReleaseNotes "Open Design Preview ${{ needs.metadata.outputs.release_version }}" `
-IncludeZip $true
- name: Upload windows preview bundle
- name: Publish windows preview platform
env:
RELEASE_ASSET_SUFFIX: ""
RELEASE_ASSETS_DIR: ${{ runner.temp }}\release-assets\win_x64
RELEASE_CHANNEL: preview
RELEASE_MANIFEST_DIR: ${{ runner.temp }}\release-platform-manifests
RELEASE_OUTPUTS_PATH: ${{ runner.temp }}\release-platform-outputs\win_x64.json
RELEASE_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
RELEASE_REPORT_DIR: ${{ runner.temp }}\release-report\win
RELEASE_SIGNED: "false"
RELEASE_STORAGE_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_RELEASES_AK }}
RELEASE_STORAGE_BUCKET: ${{ secrets.CLOUDFLARE_R2_RELEASES_BUCKET }}
RELEASE_STORAGE_ENDPOINT: ${{ secrets.CLOUDFLARE_R2_RELEASES_URL }}
RELEASE_STORAGE_REGION: auto
RELEASE_STORAGE_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_RELEASES_SK }}
RELEASE_TARGET: win_x64
RELEASE_VERSION: ${{ needs.metadata.outputs.release_version }}
WIN_INCLUDE_ZIP: "true"
run: node --experimental-strip-types .github/workflow/scripts/release/storage/publish-platform.ts
- name: Upload windows preview publish manifest
uses: actions/upload-artifact@v7
with:
name: open-design-preview-win-release-assets
path: ${{ runner.temp }}/release-assets
name: open-design-preview-win-x64-publish-manifest
path: ${{ runner.temp }}\release-platform-manifests\win_x64.json
if-no-files-found: error
retention-days: 1
build_linux:
@@ -612,15 +691,40 @@ jobs:
- name: Prepare linux preview assets
env:
RELEASE_ASSET_SUFFIX: ""
RELEASE_ASSETS_DIR: ${{ runner.temp }}/release-assets/linux_x64
RELEASE_CHANNEL: preview
RELEASE_NAMESPACE: release-preview-linux
RELEASE_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
RELEASE_TARGET: linux_x64
RELEASE_VERSION: ${{ needs.metadata.outputs.release_version }}
TOOLS_PACK_NAMESPACE: release-preview-linux
run: bash .github/scripts/release/assets/linux.sh
TOOLS_PACK_DIR: ${{ runner.temp }}/tools-pack
run: bash .github/workflow/scripts/release/prepare-platform-assets.sh
- name: Upload linux preview bundle
- name: Publish linux preview platform
env:
RELEASE_ASSET_SUFFIX: ""
RELEASE_ASSETS_DIR: ${{ runner.temp }}/release-assets/linux_x64
RELEASE_CHANNEL: preview
RELEASE_MANIFEST_DIR: ${{ runner.temp }}/release-platform-manifests
RELEASE_OUTPUTS_PATH: ${{ runner.temp }}/release-platform-outputs/linux_x64.json
RELEASE_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
RELEASE_SIGNED: "false"
RELEASE_STORAGE_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_RELEASES_AK }}
RELEASE_STORAGE_BUCKET: ${{ secrets.CLOUDFLARE_R2_RELEASES_BUCKET }}
RELEASE_STORAGE_ENDPOINT: ${{ secrets.CLOUDFLARE_R2_RELEASES_URL }}
RELEASE_STORAGE_REGION: auto
RELEASE_STORAGE_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_RELEASES_SK }}
RELEASE_TARGET: linux_x64
RELEASE_VERSION: ${{ needs.metadata.outputs.release_version }}
run: node --experimental-strip-types .github/workflow/scripts/release/storage/publish-platform.ts
- name: Upload linux preview publish manifest
uses: actions/upload-artifact@v7
with:
name: open-design-preview-linux-release-assets
path: ${{ runner.temp }}/release-assets
name: open-design-preview-linux-x64-publish-manifest
path: ${{ runner.temp }}/release-platform-manifests/linux_x64.json
if-no-files-found: error
retention-days: 1
publish:
@@ -678,78 +782,91 @@ jobs:
with:
node-version: 24
- name: Download mac preview bundle
- name: Download mac preview publish manifest
uses: actions/download-artifact@v8
with:
name: open-design-preview-mac-release-assets
path: ${{ runner.temp }}/release-assets/mac
name: open-design-preview-mac-arm64-publish-manifest
path: ${{ runner.temp }}/release-platform-manifests
- name: Download mac intel preview bundle
- name: Download mac intel preview publish manifest
uses: actions/download-artifact@v8
with:
name: open-design-preview-mac-intel-release-assets
path: ${{ runner.temp }}/release-assets/mac-intel
name: open-design-preview-mac-x64-publish-manifest
path: ${{ runner.temp }}/release-platform-manifests
- name: Download windows preview bundle
- name: Download windows preview publish manifest
uses: actions/download-artifact@v8
with:
name: open-design-preview-win-release-assets
path: ${{ runner.temp }}/release-assets/win
name: open-design-preview-win-x64-publish-manifest
path: ${{ runner.temp }}/release-platform-manifests
- name: Download linux preview bundle
- name: Download linux preview publish manifest
if: ${{ needs.build_linux.result == 'success' }}
uses: actions/download-artifact@v8
with:
name: open-design-preview-linux-release-assets
path: ${{ runner.temp }}/release-assets/linux
name: open-design-preview-linux-x64-publish-manifest
path: ${{ runner.temp }}/release-platform-manifests
- name: Download mac e2e spec report
uses: actions/download-artifact@v8
with:
name: open-design-preview-mac-e2e-report
path: ${{ runner.temp }}/release-report/mac
- name: Download windows e2e spec report
uses: actions/download-artifact@v8
with:
name: open-design-preview-win-e2e-report
path: ${{ runner.temp }}/release-report/win
- name: Publish preview assets and metadata to R2
id: r2
run: bash .github/scripts/release/r2/publish.sh
- name: Verify R2 preview publish
- name: Publish preview metadata
env:
R2_LINUX_APPIMAGE_URL: ${{ steps.r2.outputs.linux_appimage_url }}
R2_MAC_DMG_URL: ${{ steps.r2.outputs.mac_dmg_url }}
R2_MAC_FEED_URL: ${{ steps.r2.outputs.mac_feed_url }}
R2_MAC_INTEL_DMG_URL: ${{ steps.r2.outputs.mac_intel_dmg_url }}
R2_MAC_INTEL_ZIP_URL: ${{ steps.r2.outputs.mac_intel_zip_url }}
R2_MAC_ZIP_URL: ${{ steps.r2.outputs.mac_zip_url }}
R2_METADATA_URL: ${{ steps.r2.outputs.metadata_url }}
R2_REPORT_ZIP_URL: ${{ steps.r2.outputs.report_zip_url }}
R2_WIN_FEED_URL: ${{ steps.r2.outputs.win_feed_url }}
R2_WIN_INSTALLER_URL: ${{ steps.r2.outputs.win_installer_url }}
R2_WIN_PORTABLE_ZIP_URL: ${{ steps.r2.outputs.win_portable_zip_url }}
run: bash .github/scripts/release/r2/verify.sh
BASE_VERSION: ${{ needs.metadata.outputs.base_version }}
ENABLE_LINUX_X64: ${{ needs.build_linux.result == 'success' }}
ENABLE_MAC_ARM64: "true"
ENABLE_MAC_X64: "true"
ENABLE_WIN_X64: "true"
LINUX_X64_RESULT: ${{ needs.build_linux.result }}
MAC_ARM64_RESULT: ${{ needs.build_mac.result }}
MAC_X64_RESULT: ${{ needs.build_mac_intel.result }}
RELEASE_ASSET_SUFFIX: ""
RELEASE_CHANNEL: preview
RELEASE_MANIFEST_DIR: ${{ runner.temp }}/release-platform-manifests
RELEASE_METADATA_DIR: ${{ runner.temp }}/release-metadata
RELEASE_OUTPUTS_PATH: ${{ runner.temp }}/release-metadata/outputs.json
RELEASE_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
RELEASE_SIGNED: "true"
RELEASE_STORAGE_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_RELEASES_AK }}
RELEASE_STORAGE_BUCKET: ${{ secrets.CLOUDFLARE_R2_RELEASES_BUCKET }}
RELEASE_STORAGE_ENDPOINT: ${{ secrets.CLOUDFLARE_R2_RELEASES_URL }}
RELEASE_STORAGE_REGION: auto
RELEASE_STORAGE_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_RELEASES_SK }}
RELEASE_VERSION: ${{ needs.metadata.outputs.release_version }}
STATE_SOURCE: ${{ needs.metadata.outputs.state_source }}
WIN_X64_RESULT: ${{ needs.build_win.result }}
run: node --experimental-strip-types .github/workflow/scripts/release/storage/publish-metadata.ts
- name: Read metadata outputs
id: outputs
uses: actions/github-script@v8
with:
script: |
const fs = require("fs");
const outputs = JSON.parse(fs.readFileSync(`${process.env.RUNNER_TEMP}/release-metadata/outputs.json`, "utf8"));
for (const [key, value] of Object.entries(outputs)) core.setOutput(key, String(value));
- name: Verify preview metadata
env:
ENABLE_LINUX_X64: ${{ needs.build_linux.result == 'success' }}
ENABLE_MAC_ARM64: "true"
ENABLE_MAC_X64: "true"
ENABLE_WIN_X64: "true"
LINUX_X64_RESULT: ${{ needs.build_linux.result }}
MAC_ARM64_RESULT: ${{ needs.build_mac.result }}
MAC_X64_RESULT: ${{ needs.build_mac_intel.result }}
RELEASE_CHANNEL: preview
RELEASE_METADATA_URL: ${{ steps.outputs.outputs.version_metadata_url }}
RELEASE_VERSION: ${{ needs.metadata.outputs.release_version }}
WIN_X64_RESULT: ${{ needs.build_win.result }}
run: node --experimental-strip-types .github/workflow/scripts/release/storage/verify-metadata.ts
- name: Write preview metadata summary
env:
RELEASE_CHANNEL: preview
RELEASE_METADATA_URL: ${{ steps.outputs.outputs.version_metadata_url }}
RELEASE_SUMMARY_PATH: ${{ runner.temp }}/release-metadata/summary.md
run: node --experimental-strip-types .github/workflow/scripts/release/storage/summary-metadata.ts
- name: Publish summary
env:
R2_LINUX_APPIMAGE_URL: ${{ steps.r2.outputs.linux_appimage_url }}
R2_MAC_DMG_URL: ${{ steps.r2.outputs.mac_dmg_url }}
R2_MAC_FEED_URL: ${{ steps.r2.outputs.mac_feed_url }}
R2_MAC_INTEL_DMG_URL: ${{ steps.r2.outputs.mac_intel_dmg_url }}
R2_MAC_INTEL_ZIP_URL: ${{ steps.r2.outputs.mac_intel_zip_url }}
R2_MAC_ZIP_URL: ${{ steps.r2.outputs.mac_zip_url }}
R2_METADATA_URL: ${{ steps.r2.outputs.metadata_url }}
R2_REPORT_ZIP_URL: ${{ steps.r2.outputs.report_zip_url }}
R2_VERSION_METADATA_URL: ${{ steps.r2.outputs.version_metadata_url }}
R2_VERSION_PREFIX: ${{ steps.r2.outputs.version_prefix }}
R2_WIN_FEED_URL: ${{ steps.r2.outputs.win_feed_url }}
R2_WIN_INSTALLER_URL: ${{ steps.r2.outputs.win_installer_url }}
R2_WIN_PORTABLE_ZIP_URL: ${{ steps.r2.outputs.win_portable_zip_url }}
run: bash .github/scripts/release/r2/summary.sh
run: cat "${{ runner.temp }}/release-metadata/summary.md" >> "$GITHUB_STEP_SUMMARY"
- name: Cleanup workflow artifacts
if: ${{ success() }}
.github/workflows/release-stable.yml
+234 -48
View File
@@ -339,6 +339,7 @@ jobs:
--require-vela-cli
--json
--signed
--notarize
)
if build_output="$(pnpm "${build_args[@]}" 2> >(tee -a "$build_log_path" >&2))"; then
printf '%s\n' "$build_output" | tee "$build_json_path"
@@ -453,12 +454,46 @@ jobs:
- name: Prepare mac release assets
id: assets
env:
CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
RELEASE_ARTIFACT_MODE: all
RELEASE_ASSET_SUFFIX: ""
RELEASE_ASSETS_DIR: ${{ runner.temp }}/release-assets
RELEASE_CHANNEL: ${{ needs.metadata.outputs.channel }}
RELEASE_NAMESPACE: ${{ needs.metadata.outputs.namespace }}
RELEASE_NOTES: Open Design ${{ needs.metadata.outputs.release_version }}
RELEASE_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
RELEASE_TARGET: mac_arm64
RELEASE_VERSION: ${{ needs.metadata.outputs.release_version }}
TOOLS_PACK_NAMESPACE: ${{ needs.metadata.outputs.namespace }}
run: bash .github/scripts/release/assets/mac.sh
TOOLS_PACK_DIR: ${{ runner.temp }}/tools-pack
run: bash .github/workflow/scripts/release/prepare-platform-assets.sh
- name: Publish mac platform
env:
RELEASE_ARTIFACT_MODE: all
RELEASE_ASSET_SUFFIX: ""
RELEASE_ASSETS_DIR: ${{ runner.temp }}/release-assets
RELEASE_CHANNEL: ${{ needs.metadata.outputs.channel }}
RELEASE_MANIFEST_DIR: ${{ runner.temp }}/release-platform-manifests
RELEASE_OUTPUTS_PATH: ${{ runner.temp }}/release-platform-outputs/mac_arm64.json
RELEASE_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
RELEASE_REPORT_DIR: ${{ runner.temp }}/release-report/mac
RELEASE_REPORT_ZIP_PATH: ${{ runner.temp }}/release-report/mac-report.zip
RELEASE_SIGNED: "true"
RELEASE_STORAGE_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_RELEASES_AK }}
RELEASE_STORAGE_BUCKET: ${{ secrets.CLOUDFLARE_R2_RELEASES_BUCKET }}
RELEASE_STORAGE_ENDPOINT: ${{ secrets.CLOUDFLARE_R2_RELEASES_URL }}
RELEASE_STORAGE_REGION: auto
RELEASE_STORAGE_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_RELEASES_SK }}
RELEASE_TARGET: mac_arm64
RELEASE_VERSION: ${{ needs.metadata.outputs.release_version }}
run: node --experimental-strip-types .github/workflow/scripts/release/storage/publish-platform.ts
- name: Upload mac publish manifest
uses: actions/upload-artifact@v7
with:
name: open-design-release-mac-arm64-publish-manifest
path: ${{ runner.temp }}/release-platform-manifests/mac_arm64.json
if-no-files-found: error
retention-days: 1
- name: Upload mac release bundle
uses: actions/upload-artifact@v7
@@ -524,15 +559,49 @@ jobs:
--to all \
--require-vela-cli \
--json \
--signed
--signed \
--notarize
- name: Prepare mac intel release assets
id: assets
env:
RELEASE_ARTIFACT_MODE: all
RELEASE_ASSET_SUFFIX: ""
RELEASE_ASSETS_DIR: ${{ runner.temp }}/release-assets
RELEASE_CHANNEL: ${{ needs.metadata.outputs.channel }}
RELEASE_NAMESPACE: ${{ needs.metadata.outputs.mac_intel_namespace }}
RELEASE_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
RELEASE_TARGET: mac_x64
RELEASE_VERSION: ${{ needs.metadata.outputs.release_version }}
TOOLS_PACK_NAMESPACE: ${{ needs.metadata.outputs.mac_intel_namespace }}
run: bash .github/scripts/release/assets/mac-intel.sh
TOOLS_PACK_DIR: ${{ runner.temp }}/tools-pack
run: bash .github/workflow/scripts/release/prepare-platform-assets.sh
- name: Publish mac intel platform
env:
RELEASE_ARTIFACT_MODE: all
RELEASE_ASSET_SUFFIX: ""
RELEASE_ASSETS_DIR: ${{ runner.temp }}/release-assets
RELEASE_CHANNEL: ${{ needs.metadata.outputs.channel }}
RELEASE_MANIFEST_DIR: ${{ runner.temp }}/release-platform-manifests
RELEASE_OUTPUTS_PATH: ${{ runner.temp }}/release-platform-outputs/mac_x64.json
RELEASE_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
RELEASE_SIGNED: "true"
RELEASE_STORAGE_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_RELEASES_AK }}
RELEASE_STORAGE_BUCKET: ${{ secrets.CLOUDFLARE_R2_RELEASES_BUCKET }}
RELEASE_STORAGE_ENDPOINT: ${{ secrets.CLOUDFLARE_R2_RELEASES_URL }}
RELEASE_STORAGE_REGION: auto
RELEASE_STORAGE_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_RELEASES_SK }}
RELEASE_TARGET: mac_x64
RELEASE_VERSION: ${{ needs.metadata.outputs.release_version }}
run: node --experimental-strip-types .github/workflow/scripts/release/storage/publish-platform.ts
- name: Upload mac intel publish manifest
uses: actions/upload-artifact@v7
with:
name: open-design-release-mac-x64-publish-manifest
path: ${{ runner.temp }}/release-platform-manifests/mac_x64.json
if-no-files-found: error
retention-days: 1
- name: Upload mac intel release bundle
uses: actions/upload-artifact@v7
@@ -715,13 +784,46 @@ jobs:
- name: Prepare windows release assets
shell: pwsh
run: |
.\.github\workflow\scripts\release\prepare-platform-assets.ps1 `
-ReleaseTarget win_x64 `
-ReleaseAssetsDir "${{ runner.temp }}\release-assets" `
-BuildJsonPath "${{ runner.temp }}\windows-tools-pack-build.json" `
-ReleaseNamespace "${{ needs.metadata.outputs.win_namespace }}" `
-ReleaseVersion "${{ needs.metadata.outputs.release_version }}" `
-ReleaseAssetSuffix "" `
-ReleaseChannel "${{ needs.metadata.outputs.channel }}" `
-ReleasePublicOrigin "${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}" `
-ReleaseNotes "Open Design ${{ needs.metadata.outputs.release_version }}" `
-IncludeZip $true
- name: Publish windows platform
env:
CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
RELEASE_ASSET_SUFFIX: ""
RELEASE_ASSETS_DIR: ${{ runner.temp }}\release-assets
RELEASE_CHANNEL: ${{ needs.metadata.outputs.channel }}
RELEASE_NOTES: Open Design ${{ needs.metadata.outputs.release_version }}
RELEASE_MANIFEST_DIR: ${{ runner.temp }}\release-platform-manifests
RELEASE_OUTPUTS_PATH: ${{ runner.temp }}\release-platform-outputs\win_x64.json
RELEASE_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
RELEASE_REPORT_DIR: ${{ runner.temp }}\release-report\win
RELEASE_SIGNED: "false"
RELEASE_STORAGE_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_RELEASES_AK }}
RELEASE_STORAGE_BUCKET: ${{ secrets.CLOUDFLARE_R2_RELEASES_BUCKET }}
RELEASE_STORAGE_ENDPOINT: ${{ secrets.CLOUDFLARE_R2_RELEASES_URL }}
RELEASE_STORAGE_REGION: auto
RELEASE_STORAGE_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_RELEASES_SK }}
RELEASE_TARGET: win_x64
RELEASE_VERSION: ${{ needs.metadata.outputs.release_version }}
TOOLS_PACK_NAMESPACE: ${{ needs.metadata.outputs.win_namespace }}
run: ./.github/scripts/release/assets/win.ps1
WIN_INCLUDE_ZIP: "true"
run: node --experimental-strip-types .github/workflow/scripts/release/storage/publish-platform.ts
- name: Upload windows publish manifest
uses: actions/upload-artifact@v7
with:
name: open-design-release-win-x64-publish-manifest
path: ${{ runner.temp }}\release-platform-manifests\win_x64.json
if-no-files-found: error
retention-days: 1
- name: Upload windows release bundle
uses: actions/upload-artifact@v7
@@ -831,9 +933,42 @@ jobs:
- name: Prepare linux release assets
env:
RELEASE_ASSET_SUFFIX: ""
RELEASE_ASSETS_DIR: ${{ runner.temp }}/release-assets
RELEASE_CHANNEL: ${{ needs.metadata.outputs.channel }}
RELEASE_NAMESPACE: ${{ needs.metadata.outputs.linux_namespace }}
RELEASE_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
RELEASE_TARGET: linux_x64
RELEASE_VERSION: ${{ needs.metadata.outputs.release_version }}
TOOLS_PACK_NAMESPACE: ${{ needs.metadata.outputs.linux_namespace }}
run: bash .github/scripts/release/assets/linux.sh
TOOLS_PACK_DIR: ${{ runner.temp }}/tools-pack
run: bash .github/workflow/scripts/release/prepare-platform-assets.sh
- name: Publish linux platform
env:
RELEASE_ASSET_SUFFIX: ""
RELEASE_ASSETS_DIR: ${{ runner.temp }}/release-assets
RELEASE_CHANNEL: ${{ needs.metadata.outputs.channel }}
RELEASE_MANIFEST_DIR: ${{ runner.temp }}/release-platform-manifests
RELEASE_OUTPUTS_PATH: ${{ runner.temp }}/release-platform-outputs/linux_x64.json
RELEASE_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
RELEASE_REPORT_DIR: ${{ runner.temp }}/release-report/linux
RELEASE_SIGNED: "false"
RELEASE_STORAGE_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_RELEASES_AK }}
RELEASE_STORAGE_BUCKET: ${{ secrets.CLOUDFLARE_R2_RELEASES_BUCKET }}
RELEASE_STORAGE_ENDPOINT: ${{ secrets.CLOUDFLARE_R2_RELEASES_URL }}
RELEASE_STORAGE_REGION: auto
RELEASE_STORAGE_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_RELEASES_SK }}
RELEASE_TARGET: linux_x64
RELEASE_VERSION: ${{ needs.metadata.outputs.release_version }}
run: node --experimental-strip-types .github/workflow/scripts/release/storage/publish-platform.ts
- name: Upload linux publish manifest
uses: actions/upload-artifact@v7
with:
name: open-design-release-linux-x64-publish-manifest
path: ${{ runner.temp }}/release-platform-manifests/linux_x64.json
if-no-files-found: error
retention-days: 1
- name: Upload linux release bundle
uses: actions/upload-artifact@v7
@@ -865,11 +1000,11 @@ jobs:
}}
runs-on: ubuntu-latest
outputs:
version_metadata_url: ${{ steps.r2.outputs.version_metadata_url }}
mac_arm64_url: ${{ steps.r2.outputs.mac_dmg_url }}
mac_intel_url: ${{ steps.r2.outputs.mac_intel_dmg_url }}
win_url: ${{ steps.r2.outputs.win_installer_url }}
linux_url: ${{ steps.r2.outputs.linux_appimage_url }}
version_metadata_url: ${{ steps.outputs.outputs.version_metadata_url }}
mac_arm64_url: ${{ steps.outputs.outputs.mac_arm64_dmg_url }}
mac_intel_url: ${{ steps.outputs.outputs.mac_x64_dmg_url }}
win_url: ${{ steps.outputs.outputs.win_x64_installer_url }}
linux_url: ${{ steps.outputs.outputs.linux_x64_appImage_url }}
env:
GH_TOKEN: ${{ github.token }}
# Record the real built commit in metadata.json. Under workflow_call the
@@ -911,6 +1046,31 @@ jobs:
with:
node-version: 24
- name: Download mac publish manifest
uses: actions/download-artifact@v8
with:
name: open-design-release-mac-arm64-publish-manifest
path: ${{ runner.temp }}/release-platform-manifests
- name: Download mac intel publish manifest
uses: actions/download-artifact@v8
with:
name: open-design-release-mac-x64-publish-manifest
path: ${{ runner.temp }}/release-platform-manifests
- name: Download windows publish manifest
uses: actions/download-artifact@v8
with:
name: open-design-release-win-x64-publish-manifest
path: ${{ runner.temp }}/release-platform-manifests
- name: Download linux publish manifest
if: ${{ needs.build_linux.result == 'success' }}
uses: actions/download-artifact@v8
with:
name: open-design-release-linux-x64-publish-manifest
path: ${{ runner.temp }}/release-platform-manifests
- name: Pre-flight tag/release check
if: ${{ needs.metadata.outputs.github_release_enabled == 'true' }}
run: |
@@ -1000,24 +1160,58 @@ jobs:
fi
gh release upload "$VERSION_TAG" "$all_release_dir"/*
- name: Publish release assets and metadata to R2
id: r2
run: bash .github/scripts/release/r2/publish.sh
- name: Verify R2 release publish
- name: Publish release metadata to R2
env:
R2_LINUX_APPIMAGE_URL: ${{ steps.r2.outputs.linux_appimage_url }}
R2_MAC_DMG_URL: ${{ steps.r2.outputs.mac_dmg_url }}
R2_MAC_FEED_URL: ${{ steps.r2.outputs.mac_feed_url }}
R2_MAC_INTEL_DMG_URL: ${{ steps.r2.outputs.mac_intel_dmg_url }}
R2_MAC_INTEL_ZIP_URL: ${{ steps.r2.outputs.mac_intel_zip_url }}
R2_MAC_ZIP_URL: ${{ steps.r2.outputs.mac_zip_url }}
R2_METADATA_URL: ${{ steps.r2.outputs.metadata_url }}
R2_REPORT_ZIP_URL: ${{ steps.r2.outputs.report_zip_url }}
R2_WIN_FEED_URL: ${{ steps.r2.outputs.win_feed_url }}
R2_WIN_INSTALLER_URL: ${{ steps.r2.outputs.win_installer_url }}
R2_WIN_PORTABLE_ZIP_URL: ${{ steps.r2.outputs.win_portable_zip_url }}
run: bash .github/scripts/release/r2/verify.sh
BASE_VERSION: ${{ needs.metadata.outputs.base_version }}
ENABLE_LINUX_X64: ${{ needs.build_linux.result == 'success' }}
ENABLE_MAC_ARM64: "true"
ENABLE_MAC_X64: "true"
ENABLE_WIN_X64: "true"
LINUX_X64_RESULT: ${{ needs.build_linux.result }}
MAC_ARM64_RESULT: ${{ needs.build_mac.result }}
MAC_X64_RESULT: ${{ needs.build_mac_intel.result }}
RELEASE_ASSET_SUFFIX: ""
RELEASE_CHANNEL: ${{ needs.metadata.outputs.channel }}
RELEASE_MANIFEST_DIR: ${{ runner.temp }}/release-platform-manifests
RELEASE_METADATA_DIR: ${{ runner.temp }}/release-metadata
RELEASE_OUTPUTS_PATH: ${{ runner.temp }}/release-metadata/outputs.json
RELEASE_PUBLIC_ORIGIN: ${{ vars.CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN }}
RELEASE_SIGNED: "true"
RELEASE_STORAGE_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_RELEASES_AK }}
RELEASE_STORAGE_BUCKET: ${{ secrets.CLOUDFLARE_R2_RELEASES_BUCKET }}
RELEASE_STORAGE_ENDPOINT: ${{ secrets.CLOUDFLARE_R2_RELEASES_URL }}
RELEASE_STORAGE_REGION: auto
RELEASE_STORAGE_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_RELEASES_SK }}
RELEASE_VERSION: ${{ needs.metadata.outputs.release_version }}
STABLE_VERSION: ${{ needs.metadata.outputs.stable_version }}
STATE_SOURCE: ${{ needs.metadata.outputs.state_source }}
VERSION_TAG: ${{ needs.metadata.outputs.version_tag }}
WIN_X64_RESULT: ${{ needs.build_win.result }}
run: node --experimental-strip-types .github/workflow/scripts/release/storage/publish-metadata.ts
- name: Read metadata outputs
id: outputs
uses: actions/github-script@v8
with:
script: |
const fs = require("fs");
const outputs = JSON.parse(fs.readFileSync(`${process.env.RUNNER_TEMP}/release-metadata/outputs.json`, "utf8"));
for (const [key, value] of Object.entries(outputs)) core.setOutput(key, String(value));
- name: Verify release metadata
env:
ENABLE_LINUX_X64: ${{ needs.build_linux.result == 'success' }}
ENABLE_MAC_ARM64: "true"
ENABLE_MAC_X64: "true"
ENABLE_WIN_X64: "true"
LINUX_X64_RESULT: ${{ needs.build_linux.result }}
MAC_ARM64_RESULT: ${{ needs.build_mac.result }}
MAC_X64_RESULT: ${{ needs.build_mac_intel.result }}
RELEASE_CHANNEL: ${{ needs.metadata.outputs.channel }}
RELEASE_METADATA_URL: ${{ steps.outputs.outputs.version_metadata_url }}
RELEASE_VERSION: ${{ needs.metadata.outputs.release_version }}
WIN_X64_RESULT: ${{ needs.build_win.result }}
run: node --experimental-strip-types .github/workflow/scripts/release/storage/verify-metadata.ts
- name: Promote draft to published latest
if: ${{ needs.metadata.outputs.github_release_enabled == 'true' }}
@@ -1038,20 +1232,12 @@ jobs:
- name: Publish summary
env:
R2_LINUX_APPIMAGE_URL: ${{ steps.r2.outputs.linux_appimage_url }}
R2_MAC_DMG_URL: ${{ steps.r2.outputs.mac_dmg_url }}
R2_MAC_FEED_URL: ${{ steps.r2.outputs.mac_feed_url }}
R2_MAC_INTEL_DMG_URL: ${{ steps.r2.outputs.mac_intel_dmg_url }}
R2_MAC_INTEL_ZIP_URL: ${{ steps.r2.outputs.mac_intel_zip_url }}
R2_MAC_ZIP_URL: ${{ steps.r2.outputs.mac_zip_url }}
R2_METADATA_URL: ${{ steps.r2.outputs.metadata_url }}
R2_REPORT_ZIP_URL: ${{ steps.r2.outputs.report_zip_url }}
R2_VERSION_METADATA_URL: ${{ steps.r2.outputs.version_metadata_url }}
R2_VERSION_PREFIX: ${{ steps.r2.outputs.version_prefix }}
R2_WIN_FEED_URL: ${{ steps.r2.outputs.win_feed_url }}
R2_WIN_INSTALLER_URL: ${{ steps.r2.outputs.win_installer_url }}
R2_WIN_PORTABLE_ZIP_URL: ${{ steps.r2.outputs.win_portable_zip_url }}
run: bash .github/scripts/release/r2/summary.sh
RELEASE_CHANNEL: ${{ needs.metadata.outputs.channel }}
RELEASE_METADATA_URL: ${{ steps.outputs.outputs.version_metadata_url }}
RELEASE_SUMMARY_PATH: ${{ runner.temp }}/release-metadata/summary.md
run: |
node --experimental-strip-types .github/workflow/scripts/release/storage/summary-metadata.ts
cat "${{ runner.temp }}/release-metadata/summary.md" >> "$GITHUB_STEP_SUMMARY"
- name: Cleanup workflow artifacts
if: ${{ success() }}