mirror of
https://github.com/greenart7c3/Amber.git
synced 2026-10-30 06:47:33 +00:00
greenart7c3
0c0e1139c8
create-release.yml granted contents: write to the whole workflow and actions/checkout persisted that token in .git/config, so every Gradle plugin and dependency in assembleRelease (and the daemon it left running into the signing step) could read a repo-write token. The build and signing now run in a read-only job without persisted credentials or a daemon and hand the APK over as an artifact; a separate release job, which builds nothing, gets contents: write to publish it. Pre-release detection uses the same bash rule as desktop-release.yml instead of a third-party action, and every other checkout drops persisted credentials too.
79 lines
2.8 KiB
YAML
79 lines
2.8 KiB
YAML
name: Release Desktop
|
|
|
|
# On a v* tag, builds the desktop installers for Linux (.deb, .rpm, .AppImage,
|
|
# .tar.xz), Windows (.msi, .exe) and macOS (.dmg, arm64 + x64) with the tag's
|
|
# version and attaches them to the tag's GitHub release, next to the Android
|
|
# assets from create-release.yml.
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
# To rebuild an existing release: Run workflow, "Use workflow from" the tag.
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
version:
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
tag: ${{ steps.v.outputs.tag }}
|
|
version: ${{ steps.v.outputs.version }}
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
# Installers need a plain X.Y.Z: v6.7.0-pre1 packages as 6.7.0. The
|
|
# desktop build takes its version from amberVersionName, so a tag
|
|
# that does not match it would ship mislabeled installers.
|
|
- id: v
|
|
env:
|
|
TAG: ${{ github.ref_name }}
|
|
run: |
|
|
[ "$GITHUB_REF_TYPE" = tag ] || { echo "::error::Run this on a tag, not $GITHUB_REF"; exit 1; }
|
|
version=${TAG#v}
|
|
version=${version%%-*}
|
|
[[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "::error::Tag $TAG is not vX.Y.Z[-suffix]"; exit 1; }
|
|
app=$(sed -nE 's/^amberVersionName = "([^"]+)".*/\1/p' gradle/libs.versions.toml | head -1)
|
|
[ "${app%%-*}" = "$version" ] || { echo "::error::Tag $TAG does not match amberVersionName \"$app\" in gradle/libs.versions.toml"; exit 1; }
|
|
echo "tag=$TAG" >> "$GITHUB_OUTPUT"
|
|
echo "version=$version" >> "$GITHUB_OUTPUT"
|
|
|
|
build:
|
|
needs: version
|
|
uses: ./.github/workflows/desktop.yml
|
|
with:
|
|
version: ${{ needs.version.outputs.version }}
|
|
|
|
release:
|
|
needs: [version, build]
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
|
|
with:
|
|
pattern: amber-desktop-*
|
|
path: dist
|
|
merge-multiple: true
|
|
|
|
# create-release.yml creates the release for the Android APK at the same
|
|
# time; whichever gets there first creates it and the other attaches.
|
|
- name: Attach installers to the release
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
GH_REPO: ${{ github.repository }}
|
|
TAG: ${{ needs.version.outputs.tag }}
|
|
run: |
|
|
ls -l dist
|
|
prerelease=$([[ "$TAG" == *-pre* ]] && echo --prerelease || true)
|
|
for attempt in 1 2 3 4 5; do
|
|
gh release view "$TAG" > /dev/null 2>&1 && break
|
|
gh release create "$TAG" --verify-tag --title "Release refs/tags/$TAG" --notes "" $prerelease && break
|
|
sleep 20
|
|
done
|
|
gh release upload "$TAG" dist/* --clobber
|