feat: install updates in the app, not in a browser tab #5
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| on: | |
| push: | |
| tags: ['v*'] | |
| jobs: | |
| release: | |
| name: draft release | |
| runs-on: macos-15 | |
| permissions: | |
| contents: write | |
| steps: | |
| # git-cliff writes the notes from the commit history, so it needs one. | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: app/src-tauri | |
| - run: bun install --frozen-lockfile | |
| working-directory: app | |
| - name: Stamp the version from the tag | |
| run: bun run scripts/set-version.ts "${GITHUB_REF_NAME}" | |
| # Not git-cliff-action: its runner script uses GNU stat and silently | |
| # produces nothing on macOS. | |
| - name: Write the notes from the commits | |
| id: notes | |
| run: | | |
| brew install git-cliff | |
| { | |
| echo 'content<<CLIFF_NOTES_EOF' | |
| git cliff --config cliff.toml --latest --strip header | |
| echo CLIFF_NOTES_EOF | |
| } >> "$GITHUB_OUTPUT" | |
| - uses: tauri-apps/tauri-action@v0 | |
| with: | |
| projectPath: app | |
| tagName: ${{ github.ref_name }} | |
| releaseName: IconState ${{ github.ref_name }} | |
| releaseBody: ${{ steps.notes.outputs.content }} | |
| releaseDraft: true | |
| prerelease: false | |
| includeUpdaterJson: true | |
| args: --bundles app,dmg | |
| # To sign and notarise, add the Apple secrets to this step's env: | |
| # APPLE_CERTIFICATE, APPLE_CERTIFICATE_PASSWORD, APPLE_SIGNING_IDENTITY, | |
| # APPLE_ID, APPLE_PASSWORD, APPLE_TEAM_ID. They cannot sit here empty | |
| # waiting for the day — Tauri reads an empty APPLE_CERTIFICATE as a real | |
| # one and fails the build trying to import it. | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Signs the update package with the project's own key, which is what | |
| # lets the app install an update in place. Nothing to do with Apple. | |
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| - name: Check the bundle | |
| run: ./scripts/verify-bundle.sh |