chore: release 0.4.0, the Windows release #11
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # A tag publishes; a manual run builds the same artifacts without publishing, | |
| # which is how a release is rehearsed before its version number is spent. | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| # Two runs for the same tag would race to create one release. Queue instead of | |
| # cancelling, so a rehearsal already in flight still finishes. | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| macos: | |
| runs-on: macos-latest | |
| steps: | |
| # The only target is arm64, and nothing else in the job would notice if | |
| # GitHub's default runner ever moved back to Intel. | |
| - name: Confirm the runner is arm64 | |
| run: | | |
| if [ "$(uname -m)" != "arm64" ]; then | |
| echo "This build targets arm64 only; the runner reports $(uname -m)." >&2 | |
| exit 1 | |
| fi | |
| - uses: actions/checkout@v4 | |
| # Reads the pinned version from package.json's packageManager field. | |
| - uses: pnpm/action-setup@v4 | |
| # Deliberately uncached. Restoring the pnpm store replays Electron's | |
| # postinstall from cached output instead of extracting the download, and | |
| # that copy flattens the symlinks inside Electron Framework.framework. | |
| # codesign then calls the bundle ambiguous and refuses to verify it, so | |
| # the minute this saves costs the release its signature. | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm typecheck | |
| - run: pnpm test | |
| # A tag naming a version the app does not carry would ship an artifact | |
| # whose filename disagrees with its own release page. | |
| - name: Confirm the tag matches the package version | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| run: | | |
| tagged="${GITHUB_REF_NAME#v}" | |
| packaged="$(node -p "require('./package.json').version")" | |
| if [ "$tagged" != "$packaged" ]; then | |
| echo "Tag $GITHUB_REF_NAME does not match package.json version $packaged." >&2 | |
| exit 1 | |
| fi | |
| - name: Build the app | |
| # Without this, electron-builder searches the keychain for a Developer | |
| # ID this build deliberately does not have. Signing is ad-hoc and | |
| # happens in the afterPack hook. | |
| env: | |
| CSC_IDENTITY_AUTO_DISCOVERY: 'false' | |
| run: pnpm dist | |
| # An arm64 bundle with no signature at all installs fine and then fails to | |
| # launch with no error, so the signature is confirmed before publishing. | |
| - name: Confirm the bundle is signed | |
| run: codesign --verify --strict "release/mac-arm64/Codex Quota.app" | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: codex-quota-macos-arm64 | |
| path: | | |
| release/*.dmg | |
| release/*.zip | |
| if-no-files-found: error | |
| windows: | |
| runs-on: windows-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm typecheck | |
| - run: pnpm test | |
| - name: Confirm the tag matches the package version | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| shell: pwsh | |
| run: | | |
| $tagged = $env:GITHUB_REF_NAME.Substring(1) | |
| $packaged = node -p "require('./package.json').version" | |
| if ($tagged -ne $packaged) { | |
| Write-Error "Tag $env:GITHUB_REF_NAME does not match package.json version $packaged." | |
| exit 1 | |
| } | |
| - name: Build the Windows installer | |
| env: | |
| CSC_IDENTITY_AUTO_DISCOVERY: 'false' | |
| run: pnpm dist:win | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: codex-quota-windows-x64 | |
| path: | | |
| release/CodexQuota-*-win-*.exe | |
| if-no-files-found: error | |
| publish: | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| needs: [macos, windows] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| path: dist | |
| - name: Publish the release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| cat > release-notes.md <<'NOTES' | |
| ## Install | |
| ### macOS | |
| Download the DMG, open it, and drag **Codex Quota** to Applications. | |
| The build is signed ad-hoc and is not notarized, so the first launch | |
| needs the quarantine flag cleared: | |
| ```bash | |
| xattr -dr com.apple.quarantine "/Applications/Codex Quota.app" | |
| ``` | |
| Apple silicon only. | |
| ### Windows | |
| Download the NSIS installer (`CodexQuota-*-win-x64.exe`) and run it. | |
| Closing the window leaves the app in the notification area; quit from | |
| the tray icon. | |
| The installer is unsigned. Windows may show a SmartScreen warning on | |
| first launch — choose **More info** and **Run anyway** if you trust | |
| the build. | |
| The app runs whatever `codex` is already installed on the machine and | |
| does not bundle a copy. | |
| NOTES | |
| gh release create "$GITHUB_REF_NAME" \ | |
| --title "Codex Quota $GITHUB_REF_NAME" \ | |
| --notes-file release-notes.md \ | |
| dist/codex-quota-macos-arm64/*.dmg \ | |
| dist/codex-quota-macos-arm64/*.zip \ | |
| dist/codex-quota-windows-x64/*.exe |