mirror of
https://github.com/Ark0N/Codeman.git
synced 2026-11-14 10:39:32 +01:00
Codeman maintainer
d5273347c3
Every Codeman release now carries the Mac app as Codeman.dmg and Codeman.dmg.sha256, under a name that never changes, so https://github.com/Ark0N/Codeman/releases/latest/download/Codeman.dmg always serves the newest app. .github/workflows/desktop-dmg.yml (workflow_call from Release with tag codeman@<version>; workflow_dispatch with an optional tag) has three jobs, so no job that holds a secret runs code from a crate: - build (macos-26, contents: read, no secret, no cache) runs cargo test --locked and bundle-macos.sh --universal ad hoc, with CODEMAN_DESKTOP_INSTALLER_URL, CODEMAN_DESKTOP_INSTALL_BRANCH and SIGN_IDENTITY unset, checks both slices, the signature and that no test installer URL or branch is baked in, and uploads the app as a ditto zip. - sign (macos-26, contents: read) refuses an artifact with an entry outside Codeman.app, a ".." or a symlink, imports MACOS_CERT_P12 into a keychain under RUNNER_TEMP with a random password, picks the one Developer ID Application identity by its hash and checks it belongs to APPLE_TEAM_ID, runs sign-macos.sh with the Apple ID login and uploads the signed pair as the codeman-dmg artifact. Its last step deletes the keychain and the decoded .p12 whatever happened before. - attach (ubuntu, contents: write, no secret) runs only with a tag, on master (Release itself, or a rebuild started there) and in Ark0N/Codeman; it uploads the pair with --clobber and checks that the release's download link, and the Latest one when this release holds Latest, serve those bytes. A run without a tag is the dry run: everything but attach. release.yml reads the Codeman version from changesets' publishedPackages (published alone is also true for an xterm-zerolag-input-only release) and runs the macOS app job only for a Codeman release, passing it the five secrets by name, never secrets: inherit. A new step puts Latest back on the newest codeman@ release after every publish, so a release that moved only xterm-zerolag-input no longer takes the badge and breaks the stable link. Both new steps sit after the retag and only warn on failure, so npm, the tag and the MCP publish are never held up by them. desktop-ci.yml checks pull requests and master pushes that touch packages/desktop: cargo fmt --check, clippy -D warnings, cargo test --locked and bash -n under macOS's bash 3.2, on macos-26 with a read-only token. Both workflows pin Rust 1.99.1, what the macos-26 image and the Mac mini ran on 2026-11-08. docs/releasing.md: step 6 holds a site change that links the app until the DMG check passes, step 7 names the new job, and a new section covers the secrets, the check, a dry run, a rebuild and what to do when notarization fails. actionlint 1.7.12 (with shellcheck 0.11.0) reports nothing on the three workflows, and master's test/release-notes.test.ts assertions hold on the new release.yml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
73 lines
2.0 KiB
YAML
73 lines
2.0 KiB
YAML
name: Desktop app
|
|
|
|
# Checks the native macOS app in packages/desktop on the pull requests and master
|
|
# pushes that change it: formatting, clippy and the unit tests, on macOS. No
|
|
# secret and a read-only token, because cargo runs the build script of every
|
|
# crate in Cargo.lock. The release build, signing and notarization live in
|
|
# desktop-dmg.yml.
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- 'packages/desktop/**'
|
|
- '.github/workflows/desktop-ci.yml'
|
|
push:
|
|
branches: [master]
|
|
paths:
|
|
- 'packages/desktop/**'
|
|
- '.github/workflows/desktop-ci.yml'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: desktop-ci-${{ github.event.pull_request.number || github.sha }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
# Keep in step with desktop-dmg.yml, which builds the release with it.
|
|
RUST_TOOLCHAIN: '1.99.1'
|
|
|
|
jobs:
|
|
check:
|
|
name: fmt, clippy, test
|
|
runs-on: macos-26
|
|
timeout-minutes: 45
|
|
defaults:
|
|
run:
|
|
working-directory: packages/desktop
|
|
steps:
|
|
- name: Checkout repo
|
|
uses: actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Rust toolchain
|
|
run: |
|
|
rustup toolchain install "$RUST_TOOLCHAIN" --profile minimal --component clippy --component rustfmt
|
|
rustup default "$RUST_TOOLCHAIN"
|
|
rustc --version
|
|
cargo --version
|
|
|
|
- name: Format
|
|
run: cargo fmt --check
|
|
|
|
# A test build bakes another installer in at compile time (option_env! in
|
|
# setup.rs), so neither variable may reach cargo.
|
|
- name: Clippy
|
|
run: |
|
|
unset CODEMAN_DESKTOP_INSTALLER_URL CODEMAN_DESKTOP_INSTALL_BRANCH
|
|
cargo clippy --locked --all-targets -- -D warnings
|
|
|
|
- name: Unit tests
|
|
run: |
|
|
unset CODEMAN_DESKTOP_INSTALLER_URL CODEMAN_DESKTOP_INSTALL_BRANCH
|
|
cargo test --locked
|
|
|
|
# /bin/bash on macOS is 3.2, the bash these scripts run under on a Mac.
|
|
- name: Scripts parse on bash 3.2
|
|
run: |
|
|
for script in scripts/*.sh; do
|
|
/bin/bash -n "$script"
|
|
done
|