lee/Recordly
1
0
Fork 0
mirror of https://github.com/webadderallorg/Recordly.git synced 2026-09-24 14:55:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: smoke and attest packaged artifacts

Browse Source 
Add packaged-artifact smoke checks, checksums, attestations, and release asset staging guardrails.
This commit is contained in:
Wiii
2026-04-27 18:26:25 +07:00
committed by GitHub
parent a4f475228a
commit 158d214b27
5 changed files with 503 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build.yml
+70 -8
View File
@@ -4,6 +4,12 @@ name: Build Electron App
on:
workflow_dispatch:
permissions:
contents: read
id-token: write
attestations: write
artifact-metadata: write
jobs:
build-windows:
runs-on: windows-latest
@@ -35,17 +41,43 @@ jobs:
npm run build:platform-native-helpers
npx tsc
npx vite build
npx electron-builder --win nsis --x64 --publish never
npx electron-builder --win dir nsis --x64 --publish never
- name: Smoke test packaged Windows paths
run: npm run smoke:packaged-binaries
- name: Generate Windows artifact checksums
run: npm run checksums:release -- SHA256SUMS-windows.txt
- name: Attest Windows artifacts
uses: actions/attest@v4
with:
subject-checksums: release/SHA256SUMS-windows.txt
- name: Upload Windows build
uses: actions/upload-artifact@v4
with:
name: windows-installer
path: release/**/*.exe
name: windows-x64-release
path: |
release/*.exe
release/*.blockmap
release/latest*.yml
release/SHA256SUMS*.txt
if-no-files-found: error
retention-days: 30
build-macos:
runs-on: macos-latest
runs-on: ${{ matrix.runner }}
strategy:
fail-fast: false
matrix:
include:
- arch: x64
arch_tag: darwin-x64
runner: macos-15-intel
- arch: arm64
arch_tag: darwin-arm64
runner: macos-14
steps:
- name: Checkout code
uses: actions/checkout@v4
@@ -78,16 +110,32 @@ jobs:
npm run build:platform-native-helpers
npx tsc
npx vite build
npx electron-builder --mac dmg zip --publish never
npx electron-builder --mac dir dmg zip --${{ matrix.arch }} --publish never
- name: Smoke test packaged macOS paths
env:
PACKAGED_SMOKE_ARCH_TAGS: ${{ matrix.arch_tag }}
run: npm run smoke:packaged-binaries
- name: Generate macOS artifact checksums
run: npm run checksums:release -- SHA256SUMS-macos-${{ matrix.arch }}.txt
- name: Attest macOS artifacts
uses: actions/attest@v4
with:
subject-checksums: release/SHA256SUMS-macos-${{ matrix.arch }}.txt
- name: Upload macOS build
uses: actions/upload-artifact@v4
with:
name: macos-installer
name: macos-${{ matrix.arch }}-release
path: |
release/**/*.dmg
release/**/*.zip
release/**/*.blockmap
release/latest-mac.yml
release/SHA256SUMS*.txt
if-no-files-found: error
retention-days: 30
build-linux:
@@ -127,13 +175,27 @@ jobs:
npm run build:platform-native-helpers
npx tsc
npx vite build
npx electron-builder --linux AppImage --x64 --publish never
npx electron-builder --linux dir AppImage --x64 --publish never
- name: Smoke test packaged Linux paths
run: npm run smoke:packaged-binaries
- name: Generate Linux artifact checksums
run: npm run checksums:release -- SHA256SUMS-linux.txt
- name: Attest Linux artifacts
uses: actions/attest@v4
with:
subject-checksums: release/SHA256SUMS-linux.txt
- name: Upload Linux build
uses: actions/upload-artifact@v4
with:
name: linux-installer
name: linux-x64-release
path: |
release/**/*.AppImage
release/**/*.blockmap
release/latest-linux.yml
release/SHA256SUMS*.txt
if-no-files-found: error
retention-days: 30
.github/workflows/release.yml
+98 -5
View File
@@ -13,6 +13,9 @@ on:
permissions:
contents: write
actions: write
id-token: write
attestations: write
artifact-metadata: write
concurrency:
group: release-${{ github.event.release.tag_name || github.event.inputs.tag_name || github.run_id }}
@@ -146,7 +149,20 @@ jobs:
run: |
npx tsc
npx vite build
npx electron-builder --mac dmg zip --x64 --publish never
npx electron-builder --mac dir dmg zip --x64 --publish never
- name: Smoke test packaged macOS x64 paths
env:
PACKAGED_SMOKE_ARCH_TAGS: darwin-x64
run: npm run smoke:packaged-binaries
- name: Generate macOS x64 artifact checksums
run: npm run checksums:release -- SHA256SUMS-macos-x64.txt
- name: Attest macOS x64 artifacts
uses: actions/attest@v4
with:
subject-checksums: release/SHA256SUMS-macos-x64.txt
- name: Upload macOS x64 artifacts
uses: actions/upload-artifact@v4
@@ -157,6 +173,7 @@ jobs:
release/*.zip
release/*.blockmap
release/latest-mac.yml
release/SHA256SUMS*.txt
if-no-files-found: error
build-macos-arm64:
@@ -233,7 +250,20 @@ jobs:
run: |
npx tsc
npx vite build
npx electron-builder --mac dmg zip --arm64 --publish never
npx electron-builder --mac dir dmg zip --arm64 --publish never
- name: Smoke test packaged macOS arm64 paths
env:
PACKAGED_SMOKE_ARCH_TAGS: darwin-arm64
run: npm run smoke:packaged-binaries
- name: Generate macOS arm64 artifact checksums
run: npm run checksums:release -- SHA256SUMS-macos-arm64.txt
- name: Attest macOS arm64 artifacts
uses: actions/attest@v4
with:
subject-checksums: release/SHA256SUMS-macos-arm64.txt
- name: Upload macOS arm64 artifacts
uses: actions/upload-artifact@v4
@@ -244,6 +274,7 @@ jobs:
release/*.zip
release/*.blockmap
release/latest-mac.yml
release/SHA256SUMS*.txt
if-no-files-found: error
merge-macos-update-metadata:
@@ -384,7 +415,18 @@ jobs:
npm run build:platform-native-helpers
npx tsc
npx vite build
npx electron-builder --win nsis --x64 --publish never
npx electron-builder --win dir nsis --x64 --publish never
- name: Smoke test packaged Windows x64 paths
run: npm run smoke:packaged-binaries
- name: Generate Windows x64 artifact checksums
run: npm run checksums:release -- SHA256SUMS-windows-x64.txt
- name: Attest Windows x64 artifacts
uses: actions/attest@v4
with:
subject-checksums: release/SHA256SUMS-windows-x64.txt
- name: Upload Windows x64 artifacts
uses: actions/upload-artifact@v4
@@ -394,6 +436,7 @@ jobs:
release/*.exe
release/*.blockmap
release/latest*.yml
release/SHA256SUMS*.txt
if-no-files-found: error
build-linux-x64:
@@ -446,7 +489,18 @@ jobs:
npm run build:platform-native-helpers
npx tsc
npx vite build
npx electron-builder --linux AppImage --x64 --publish never
npx electron-builder --linux dir AppImage --x64 --publish never
- name: Smoke test packaged Linux x64 paths
run: npm run smoke:packaged-binaries
- name: Generate Linux x64 artifact checksums
run: npm run checksums:release -- SHA256SUMS-linux-x64.txt
- name: Attest Linux x64 artifacts
uses: actions/attest@v4
with:
subject-checksums: release/SHA256SUMS-linux-x64.txt
- name: Upload Linux x64 artifacts
uses: actions/upload-artifact@v4
@@ -456,6 +510,7 @@ jobs:
release/*.AppImage
release/*.blockmap
release/latest-linux.yml
release/SHA256SUMS*.txt
if-no-files-found: error
publish-release-assets:
@@ -499,12 +554,13 @@ jobs:
name: linux-x64-release
path: release-assets/linux-x64
- name: Upload release assets to GitHub
- name: Stage release assets
shell: bash
run: |
set -euo pipefail
shopt -s nullglob
mkdir -p release-assets/upload
assets=(
release-assets/macos-x64/*.dmg
release-assets/macos-x64/*.zip
@@ -521,6 +577,43 @@ jobs:
release-assets/linux-x64/latest-linux.yml
)
if [ ${#assets[@]} -eq 0 ]; then
echo "No release assets found to checksum."
exit 1
fi
for file in "${assets[@]}"; do
target="release-assets/upload/$(basename "$file")"
if [ -e "$target" ]; then
echo "Duplicate release asset name: $(basename "$file")"
exit 1
fi
cp "$file" "$target"
done
- name: Generate release asset checksums
shell: bash
run: |
set -euo pipefail
cd release-assets/upload
sha256sum * | sort -k2,2 > SHA256SUMS.txt
sha256sum -c SHA256SUMS.txt
- name: Attest release assets
uses: actions/attest@v4
with:
subject-checksums: release-assets/upload/SHA256SUMS.txt
- name: Upload release assets to GitHub
shell: bash
run: |
set -euo pipefail
shopt -s nullglob
assets=(
release-assets/upload/*
)
if [ ${#assets[@]} -eq 0 ]; then
echo "No release assets found to upload."
exit 1