ice/.github/workflows/release.yml at main · light-cloud-com/ice · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
name: Release desktop

# Builds the Electron desktop app for macOS (arm64 + Intel x64), Windows, and
# Linux and publishes the artifacts to a GitHub draft release. Trigger by pushing
# a `v*` tag (e.g. `git tag v0.1.50 && git push origin v0.1.50`) or manually from
# the Actions tab.
#
# macOS builds are **Developer ID code-signed** here (CSC_LINK / CSC_KEY_PASSWORD
# secrets, gated to the macOS runners). Notarization is done AFTER CI by
# scripts/notarize-release.mjs (Pattern C) so the build never blocks on Apple's
# notary queue. Windows ships unsigned (SmartScreen prompt) until an EV cert is
# wired up — tracked on ROADMAP.md.

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      dry_run:
        description: "Build only, don't publish to GitHub Releases"
        required: false
        default: false
        type: boolean

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write # needed to create/update the GitHub release

jobs:
  build:
    name: ${{ matrix.name }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            name: macOS (arm64)
            dist_script: dist:desktop:mac:arm64
          # Native Intel runner — building x64 here means better-sqlite3 + the
          # Prisma engine are compiled as x64 natively (no broken cross-build).
          # macos-15-intel is GitHub's Intel image (available until ~Fall 2027).
          - os: macos-15-intel
            name: macOS (x64)
            dist_script: dist:desktop:mac:x64
          - os: windows-latest
            name: Windows (x64)
            dist_script: dist:desktop:win
          - os: ubuntu-latest
            name: Linux (x64)
            dist_script: dist:desktop:linux

    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Generate Prisma client
        run: pnpm --filter @ice/db exec prisma generate

      - name: Build and package desktop app
        run: pnpm ${{ matrix.dist_script }}
        env:
          # electron-builder publishes to GitHub Releases when GH_TOKEN is set.
          # We only set it on tag pushes so manual workflow_dispatch runs with
          # dry_run=true leave no trace.
          GH_TOKEN: ${{ (github.event_name == 'push' && !inputs.dry_run) && secrets.GITHUB_TOKEN || '' }}
          # macOS Developer ID signing. Gated to the macOS runners so the Windows
          # job never tries to load a mac .p12 from CSC_LINK. Notarization is NOT
          # done here (mac.notarize: false) — see scripts/notarize-release.mjs.
          CSC_LINK: ${{ startsWith(matrix.os, 'macos') && secrets.CSC_LINK || '' }}
          CSC_KEY_PASSWORD: ${{ startsWith(matrix.os, 'macos') && secrets.CSC_KEY_PASSWORD || '' }}

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: desktop-${{ runner.os }}
          path: |
            apps/desktop/release/*.dmg
            apps/desktop/release/*.zip
            apps/desktop/release/*.exe
            apps/desktop/release/*.AppImage
            apps/desktop/release/*.deb
            apps/desktop/release/latest*.yml
          if-no-files-found: warn
          retention-days: 14