release: 2.1.0-rc1 (#57) #5
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Tag a release to build + publish installers: | |
| # git tag v2.0.0 && git push origin v2.0.0 | |
| # A "-" in the tag (e.g. v2.0.0-rc1) marks it as a GitHub pre-release, which the | |
| # in-app updater surfaces to users who opted into pre-releases. | |
| on: | |
| push: | |
| tags: ["v*"] | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| env: | |
| QT_QPA_PLATFORM: offscreen | |
| jobs: | |
| # Refuse to build a release whose tag disagrees with the app's own version. | |
| # autoptz.__version__ is the single source of truth; a tag like v2.1.0 must | |
| # match it, or the installers would report the wrong version to users. | |
| guard: | |
| name: Verify tag matches __version__ | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Tag must match autoptz.__version__ | |
| shell: bash | |
| run: | | |
| ver="$(sed -nE 's/^__version__ *= *"([^"]+)".*/\1/p' autoptz/__init__.py)" | |
| if [ "$GITHUB_REF_TYPE" = "tag" ]; then | |
| tag="${GITHUB_REF_NAME#v}" | |
| echo "tag=v$tag __version__=$ver" | |
| if [ "$tag" != "$ver" ]; then | |
| echo "::error::Tag v$tag does not match autoptz.__version__ ($ver). Bump autoptz/__init__.py to match before tagging." | |
| exit 1 | |
| fi | |
| echo "OK: tag matches __version__" | |
| else | |
| echo "Manual dispatch (ref_type=$GITHUB_REF_TYPE); __version__=$ver — skipping tag match." | |
| fi | |
| macos: | |
| name: Build macOS .dmg (${{ matrix.arch }}) | |
| needs: guard | |
| runs-on: ${{ matrix.runner }} | |
| strategy: | |
| # Build both Mac architectures as separate native bundles. PyInstaller and | |
| # the ML wheels (torch, onnxruntime) are arch-specific, so there is no single | |
| # universal2 build — Apple Silicon and Intel each get their own signed dmg. | |
| # fail-fast: false so an Intel-only hiccup can't sink the arm64 build. | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - runner: macos-14 # Apple Silicon (arm64) | |
| arch: arm64 | |
| - runner: macos-13 # Intel (x86_64) | |
| arch: x86_64 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| # Import the Developer ID Application cert into a temporary keychain so | |
| # build_macos.sh can codesign. No-op (unsigned build) when the secret is | |
| # absent, so forks / unconfigured repos still produce a working .dmg. | |
| - name: Import Developer ID certificate | |
| env: | |
| CERT_B64: ${{ secrets.MACOS_CERTIFICATE_P12_BASE64 }} | |
| CERT_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }} | |
| run: | | |
| if [ -z "${CERT_B64}" ]; then | |
| echo "MACOS_CERTIFICATE_P12_BASE64 not set — building unsigned." | |
| exit 0 | |
| fi | |
| KEYCHAIN="$RUNNER_TEMP/signing.keychain-db" | |
| KEYCHAIN_PW="$(uuidgen)" | |
| printf '%s' "${CERT_B64}" | base64 --decode > "$RUNNER_TEMP/cert.p12" | |
| security create-keychain -p "$KEYCHAIN_PW" "$KEYCHAIN" | |
| security set-keychain-settings -lut 21600 "$KEYCHAIN" | |
| security unlock-keychain -p "$KEYCHAIN_PW" "$KEYCHAIN" | |
| security import "$RUNNER_TEMP/cert.p12" -k "$KEYCHAIN" -P "${CERT_PASSWORD}" \ | |
| -T /usr/bin/codesign -T /usr/bin/security | |
| security set-key-partition-list -S apple-tool:,apple:,codesign: \ | |
| -s -k "$KEYCHAIN_PW" "$KEYCHAIN" >/dev/null | |
| security list-keychains -d user -s "$KEYCHAIN" \ | |
| $(security list-keychains -d user | sed 's/["[:space:]]//g') | |
| rm -f "$RUNNER_TEMP/cert.p12" | |
| - name: Build .app + .dmg | |
| env: | |
| MAKE_DMG: "1" | |
| MACOS_SIGN_IDENTITY: ${{ secrets.MACOS_SIGN_IDENTITY }} | |
| MACOS_NOTARY_APPLE_ID: ${{ secrets.MACOS_NOTARY_APPLE_ID }} | |
| MACOS_NOTARY_TEAM_ID: ${{ secrets.MACOS_NOTARY_TEAM_ID }} | |
| MACOS_NOTARY_PASSWORD: ${{ secrets.MACOS_NOTARY_PASSWORD }} | |
| run: bash packaging/build_macos.sh | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: macos-${{ matrix.arch }} | |
| path: dist/*.dmg | |
| if-no-files-found: error | |
| windows: | |
| name: Build Windows installer | |
| needs: guard | |
| runs-on: windows-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| - name: Install Inno Setup | |
| run: choco install innosetup --no-progress -y | |
| - name: Build .exe + installer | |
| env: | |
| MAKE_INSTALLER: "1" | |
| run: powershell -ExecutionPolicy Bypass -File packaging\build_windows.ps1 | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: windows | |
| path: dist/*-setup.exe | |
| if-no-files-found: error | |
| linux: | |
| name: Build Linux AppImage | |
| needs: guard | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| - name: Install system libs | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y --no-install-recommends \ | |
| libegl1 libgl1 libxkbcommon0 libdbus-1-3 libfuse2 \ | |
| libxcb-cursor0 libxcb-icccm4 libxcb-image0 libxcb-keysyms1 \ | |
| libxcb-randr0 libxcb-render-util0 libxcb-shape0 libxcb-xinerama0 | |
| - name: Build AppImage | |
| env: | |
| MAKE_APPIMAGE: "1" | |
| run: bash packaging/build_linux.sh | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: linux | |
| path: dist/*.AppImage | |
| if-no-files-found: error | |
| release: | |
| name: Publish GitHub Release | |
| needs: [macos, windows, linux] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| path: artifacts | |
| - name: Publish | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| files: artifacts/**/* | |
| generate_release_notes: true | |
| prerelease: ${{ contains(github.ref_name, '-') }} | |
| fail_on_unmatched_files: true |