ci(desktop): fix unsigned macOS builds and Linux Electron sandbox (#89) #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: desktop-release | |
| # Builds the DeepSQL desktop client for every platform. Each OS builds its own | |
| # targets on its own runner: cross-building Windows needs Wine and Linux targets | |
| # need a matching glibc, and both are far less reliable than just using the | |
| # native runner. | |
| # | |
| # Tag-triggered runs attach the installers to the GitHub release. Manual runs | |
| # upload them as workflow artifacts, which is the easy way to hand a build to a | |
| # colleague before there is a release to cut. | |
| on: | |
| push: | |
| tags: | |
| - 'desktop-v*' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| build: | |
| name: ${{ matrix.name }} | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - { os: macos-latest, name: macOS, target: '--mac' } | |
| - { os: windows-latest, name: Windows, target: '--win' } | |
| - { os: ubuntu-latest, name: Linux, target: '--linux' } | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: desktop/package-lock.json | |
| - name: Install dependencies | |
| working-directory: desktop | |
| run: npm ci | |
| - name: Self-test the SSH tunnel transport | |
| # Runs a real SSH server in-process, so it needs a display-free Electron. | |
| # xvfb is only required on Linux; the other runners have a window server. | |
| # | |
| # ELECTRON_DISABLE_SANDBOX: GitHub-hosted Linux runners ship Electron's | |
| # chrome-sandbox without root:4755, so Chromium aborts with SIGTRAP | |
| # before the test starts ("SUID sandbox helper binary … is not | |
| # configured correctly"). Verified on desktop-v1.0.0. Sandbox is | |
| # irrelevant for this headless selftest. | |
| working-directory: desktop | |
| env: | |
| ELECTRON_DISABLE_SANDBOX: '1' | |
| run: ${{ matrix.os == 'ubuntu-latest' && 'xvfb-run --auto-servernum npm run selftest:tunnel' || 'npm run selftest:tunnel' }} | |
| shell: bash | |
| - name: Build installers | |
| working-directory: desktop | |
| env: | |
| # Keep secrets in DESKTOP_* names first. Passing an empty CSC_LINK from | |
| # an unset repository secret still counts as "set" for electron-builder, | |
| # which then tries to open it as a file and fails macOS with | |
| # "…/desktop not a file" (observed on desktop-v1.0.0). Only export the | |
| # real CSC_* / Apple vars when a signing secret is actually configured. | |
| DESKTOP_CSC_LINK: ${{ secrets.DESKTOP_CSC_LINK }} | |
| DESKTOP_CSC_KEY_PASSWORD: ${{ secrets.DESKTOP_CSC_KEY_PASSWORD }} | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| run: | | |
| set -euo pipefail | |
| if [ -n "${DESKTOP_CSC_LINK:-}" ]; then | |
| export CSC_LINK="$DESKTOP_CSC_LINK" | |
| export CSC_KEY_PASSWORD="${DESKTOP_CSC_KEY_PASSWORD:-}" | |
| else | |
| export CSC_IDENTITY_AUTO_DISCOVERY=false | |
| echo "No DESKTOP_CSC_LINK secret — building unsigned installers." | |
| fi | |
| npx electron-builder ${{ matrix.target }} --publish never | |
| shell: bash | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: deepsql-desktop-${{ matrix.name }} | |
| if-no-files-found: error | |
| path: | | |
| desktop/release/*.dmg | |
| desktop/release/*.zip | |
| desktop/release/*.exe | |
| desktop/release/*.AppImage | |
| desktop/release/*.deb | |
| desktop/release/*.rpm | |
| release: | |
| name: attach to release | |
| needs: build | |
| if: startsWith(github.ref, 'refs/tags/desktop-v') | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| path: artifacts | |
| merge-multiple: true | |
| - uses: softprops/action-gh-release@v2 | |
| with: | |
| files: artifacts/* | |
| fail_on_unmatched_files: true |