Release desktop #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release desktop | |
| # Builds the Electron desktop app for macOS (arm64 + Intel x64), Windows, and | |
| # Linux and publishes the artifacts to a GitHub draft release. Trigger by pushing | |
| # a `v*` tag (e.g. `git tag v0.1.50 && git push origin v0.1.50`) or manually from | |
| # the Actions tab. | |
| # | |
| # macOS builds are **Developer ID code-signed** here (CSC_LINK / CSC_KEY_PASSWORD | |
| # secrets, gated to the macOS runners). Notarization is done AFTER CI by | |
| # scripts/notarize-release.mjs (Pattern C) so the build never blocks on Apple's | |
| # notary queue. Windows ships unsigned (SmartScreen prompt) until an EV cert is | |
| # wired up — tracked on ROADMAP.md. | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| workflow_dispatch: | |
| inputs: | |
| dry_run: | |
| description: "Build only, don't publish to GitHub Releases" | |
| required: false | |
| default: false | |
| type: boolean | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: write # needed to create/update the GitHub release | |
| jobs: | |
| build: | |
| name: ${{ matrix.name }} | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - os: macos-latest | |
| name: macOS (arm64) | |
| dist_script: dist:desktop:mac:arm64 | |
| # Native Intel runner — building x64 here means better-sqlite3 + the | |
| # Prisma engine are compiled as x64 natively (no broken cross-build). | |
| # macos-15-intel is GitHub's Intel image (available until ~Fall 2027). | |
| - os: macos-15-intel | |
| name: macOS (x64) | |
| dist_script: dist:desktop:mac:x64 | |
| - os: windows-latest | |
| name: Windows (x64) | |
| dist_script: dist:desktop:win | |
| - os: ubuntu-latest | |
| name: Linux (x64) | |
| dist_script: dist:desktop:linux | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Generate Prisma client | |
| run: pnpm --filter @ice/db exec prisma generate | |
| - name: Build and package desktop app | |
| run: pnpm ${{ matrix.dist_script }} | |
| env: | |
| # electron-builder publishes to GitHub Releases when GH_TOKEN is set. | |
| # We only set it on tag pushes so manual workflow_dispatch runs with | |
| # dry_run=true leave no trace. | |
| GH_TOKEN: ${{ (github.event_name == 'push' && !inputs.dry_run) && secrets.GITHUB_TOKEN || '' }} | |
| # macOS Developer ID signing. Gated to the macOS runners so the Windows | |
| # job never tries to load a mac .p12 from CSC_LINK. Notarization is NOT | |
| # done here (mac.notarize: false) — see scripts/notarize-release.mjs. | |
| CSC_LINK: ${{ startsWith(matrix.os, 'macos') && secrets.CSC_LINK || '' }} | |
| CSC_KEY_PASSWORD: ${{ startsWith(matrix.os, 'macos') && secrets.CSC_KEY_PASSWORD || '' }} | |
| - name: Upload build artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: desktop-${{ runner.os }} | |
| path: | | |
| apps/desktop/release/*.dmg | |
| apps/desktop/release/*.zip | |
| apps/desktop/release/*.exe | |
| apps/desktop/release/*.AppImage | |
| apps/desktop/release/*.deb | |
| apps/desktop/release/latest*.yml | |
| if-no-files-found: warn | |
| retention-days: 14 |