Merge branch 'main' of github.com:oliwoli/resolve-silence-cut #189
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and optionally make Release | |
| on: | |
| push: | |
| # branches: | |
| # - '**' | |
| tags: | |
| - 'v*.*.*' | |
| env: | |
| NODE_OPTIONS: "--max-old-space-size=4096" | |
| jobs: | |
| #=================================================================== | |
| # JOB 1: Build binaries for each platform in parallel | |
| #=================================================================== | |
| build: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - os: ubuntu-latest | |
| platform: linux/amd64 | |
| ext: '' | |
| label: linux | |
| - os: windows-latest | |
| platform: windows/amd64 | |
| ext: .exe | |
| label: windows | |
| - os: macos-latest | |
| platform: darwin/universal | |
| ext: '' | |
| label: macos | |
| runs-on: ${{ matrix.os }} | |
| defaults: | |
| run: | |
| shell: bash | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| with: | |
| submodules: recursive | |
| - name: Set up Python | |
| uses: actions/setup-python@v4 | |
| with: | |
| python-version: '3.13' | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.25.0' | |
| - name: Run Go tests | |
| run: go test ./... -v | |
| - name: Authenticate Private Go Modules | |
| run: git config --global url."https://user:${{ secrets.GITHUB_TOKEN }}@github.com/".insteadOf "https://github.com/" | |
| - name: Install Python deps | |
| run: | | |
| python -m pip install --upgrade pip setuptools wheel | |
| python -m pip install -r python-backend/requirements.txt | |
| python -m pip install pyinstaller | |
| - name: Import Code-Signing Certificates for macOS | |
| if: matrix.label == 'macos' | |
| uses: Apple-Actions/import-codesign-certs@v3 | |
| with: | |
| p12-file-base64: "${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12_BASE64 }}" | |
| p12-password: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }} | |
| - name: Build Python backend | |
| run: | | |
| BACKEND_BINARY="dist/python_backend" | |
| if [[ "${{ matrix.label }}" == "macos" ]]; then | |
| echo "Building Python backend with code signing for macOS..." | |
| pyinstaller python-backend/src/HushCut.py \ | |
| --name python_backend \ | |
| --onefile \ | |
| --codesign-identity "${{ secrets.APPLE_SIGN_IDENTITY }}" \ | |
| -y | |
| else | |
| echo "Building Python backend without code signing..." | |
| pyinstaller python-backend/src/HushCut.py \ | |
| --name python_backend \ | |
| --onefile \ | |
| --noconsole \ | |
| -y | |
| fi | |
| # Copy the built binary to where Wails expects it | |
| mkdir -p build/bin | |
| cp "$BACKEND_BINARY${{ matrix.ext }}" build/bin/python_backend${{ matrix.ext }} | |
| chmod +x build/bin/python_backend${{ matrix.ext }} | |
| - name: Copy Lua script | |
| run: cp python-backend/src/HushCut.lua build/bin/ | |
| - name: Install pnpm | |
| run: npm install -g pnpm | |
| - name: Make public_key files | |
| run: | | |
| mkdir -p secrets | |
| echo "${{ secrets.LICENSE_PUBLIC_KEY }}" > secrets/public_key.pem | |
| - name: Build lua helper for windows | |
| if: matrix.label == 'windows' | |
| shell: bash | |
| run: | | |
| cd lua-helper | |
| go build . | |
| mv lua-helper.exe ../build/bin/davinci_lua_helper.exe | |
| - name: Install NSIS | |
| if: matrix.label == 'windows' | |
| shell: powershell | |
| run: | | |
| choco install nsis -y | |
| $env:PATH += ";C:\Program Files (x86)\NSIS" | |
| echo "C:\Program Files (x86)\NSIS" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append | |
| - name: Build Wails App (Windows) | |
| if: matrix.label == 'windows' | |
| uses: dAppServer/wails-build-action@6f01580fdf9e01042bcf2ebe288a934e0d6eb4e2 | |
| with: | |
| build-name: HushCut${{ matrix.ext }} | |
| build-platform: ${{ matrix.platform }} | |
| package: false | |
| nsis: true | |
| - name: Clean Windows bin directory | |
| if: matrix.label == 'windows' | |
| shell: bash | |
| run: | | |
| rm -f build/bin/python_backend.exe | |
| rm -f build/bin/HushCut.exe | |
| rm -f build/bin/davinci_lua_helper.exe | |
| rm -f build/bin/HushCut.lua | |
| - name: Build Wails App (Unix) | |
| if: matrix.label != 'windows' | |
| uses: dAppServer/wails-build-action@6f01580fdf9e01042bcf2ebe288a934e0d6eb4e2 | |
| with: | |
| build-name: HushCut${{ matrix.ext }} | |
| build-platform: ${{ matrix.platform }} | |
| package: false | |
| - name: Add macOS Resources folder and cleanup | |
| if: matrix.label == 'macos' | |
| run: | | |
| RESOURCE_DIR="build/bin/HushCut.app/Contents/Resources" | |
| mkdir -p "$RESOURCE_DIR" | |
| # Copy python backend into Resources | |
| cp build/bin/python_backend "$RESOURCE_DIR/" | |
| # if [ -d build/bin/python_backend/_internal ]; then | |
| # cp -R build/bin/python_backend/_internal "$RESOURCE_DIR/" | |
| # fi | |
| cp build/bin/HushCut.lua "$RESOURCE_DIR/" | |
| # Remove unnecessary package/zip from wails | |
| rm -f build/bin/HushCut.app.zip | |
| rm -f build/bin/HushCut.pkg | |
| - name: Install latest gon for notarization | |
| if: matrix.label == 'macos' | |
| run: | | |
| brew uninstall gon || true | |
| brew install Bearer/tap/gon | |
| - name: install create-dmg for macOS | |
| if: matrix.label == 'macos' | |
| run: | | |
| npm install --global create-dmg | |
| - name: Sign macOS binary and create dmg | |
| if: matrix.label == 'macos' | |
| env: | |
| AC_USERNAME: ${{ secrets.APPLE_ID_USERNAME }} | |
| AC_PASSWORD: ${{ secrets.APPLE_ID_APP_SPECIFIC_PASSWORD }} | |
| AC_PROVIDER: ${{ secrets.APPLE_TEAM_ID }} | |
| run: | | |
| echo "Signing Package" | |
| gon -log-level=info ./code-signing/gon-sign.json | |
| cd build/bin | |
| # should code sign the dmg again automatically | |
| create-dmg HushCut.app | |
| mv HushCut*.dmg HushCut-macOS.dmg | |
| - name: Package Release Asset | |
| # This step will only run when you push a tag | |
| if: startsWith(github.ref, 'refs/tags/') | |
| shell: bash | |
| run: | | |
| # For macOS, the DMG is already created. We just need to define its path for the upload. | |
| if [[ "${{ matrix.label }}" == "macos" ]]; then | |
| ARTIFACT_PATH="build/bin/HushCut-macOS.dmg" | |
| elif [[ "${{ matrix.label }}" == "windows" ]]; then | |
| # Windows: use installer directly | |
| ARTIFACT_PATH="build/bin/HushCut-amd64-installer.exe" | |
| else | |
| # Linux: make a zip | |
| cd build/bin | |
| ARTIFACT_FILENAME="HushCut-${{ matrix.label }}.zip" | |
| zip -r "../../${ARTIFACT_FILENAME}" . | |
| ARTIFACT_PATH="${ARTIFACT_FILENAME}" | |
| fi | |
| echo "ARTIFACT_PATH=${ARTIFACT_PATH}" >> $GITHUB_ENV | |
| - name: Upload Release Artifact | |
| if: startsWith(github.ref, 'refs/tags/') | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: HushCut-${{ matrix.label }} | |
| path: ${{ env.ARTIFACT_PATH }} | |
| #=================================================================== | |
| # JOB 2: Publish all binaries to the public repository | |
| # This job runs only on tag pushes and after all builds succeed. | |
| #=================================================================== | |
| publish: | |
| name: Publish to Public Repo | |
| needs: build # Ensures this job runs only after the 'build' job completes | |
| if: startsWith(github.ref, 'refs/tags/') # Condition to run only for tags | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write # Permission to push to the repository | |
| steps: | |
| - name: Checkout current repo (for package.json) | |
| uses: actions/checkout@v4 | |
| - name: Download all build artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: artifacts # Download all artifacts into an 'artifacts' directory | |
| - name: Display downloaded file structure | |
| run: ls -R artifacts | |
| - name: Checkout public releases repo | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: oliwoli/hushcut-releases | |
| token: ${{ secrets.GH_PUBLISH_TOKEN }} | |
| path: public-repo | |
| - name: Organize artifacts and push to public repo | |
| run: | | |
| # Create destination directories | |
| mkdir -p public-repo/build/macos | |
| mkdir -p public-repo/build/windows | |
| mkdir -p public-repo/build/linux | |
| # Copy package.json from the main repo | |
| echo "Copying package.json" | |
| cp package.json public-repo/package.json | |
| # Copy artifacts into the public repo checkout | |
| # Note: download-artifact creates subdirectories named after the artifact | |
| echo "Copying artifacts" | |
| cp artifacts/HushCut-linux/HushCut-linux.zip public-repo/build/linux/ | |
| cp artifacts/HushCut-windows/HushCut-amd64-installer.exe public-repo/build/windows/ | |
| cp artifacts/HushCut-macos/HushCut-macOS.dmg public-repo/build/macos/ | |
| # Commit and push changes to the public repo | |
| cd public-repo | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| git add build/ package.json | |
| # Commit only if there are changes | |
| if git diff --staged --quiet; then | |
| echo "No changes to commit." | |
| else | |
| git commit -m "Update build artifacts and package.json for tag ${{ github.ref_name }}" | |
| git tag ${{ github.ref_name }} | |
| git push && git push --tags | |
| fi |