Bump version to 1.17.1-beta.7; fix #649 #395
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and release OpenSAK | |
| # Runs on version tags e.g. v1.0.0 | |
| # Create release: git tag v1.0.0 && git push origin v1.0.0 | |
| # Manual trigger: GitHub → Actions → Run workflow | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| workflow_dispatch: | |
| env: | |
| PYTHON_VERSION: "3.11" | |
| # Opt into Homebrew's upcoming trust enforcement (default in 5.2/6.0) so the | |
| # macOS jobs silently ignore the runners' pre-installed untrusted taps | |
| # (aws/tap, azure/bicep) instead of printing a migration notice. create-dmg | |
| # lives in the always-trusted core tap, so the build is unaffected. | |
| HOMEBREW_REQUIRE_TAP_TRUST: "1" | |
| jobs: | |
| # ============================================================ | |
| # Tests — single gate; every build job runs only after this | |
| # ============================================================ | |
| test: | |
| uses: ./.github/workflows/tests.yml | |
| # ============================================================ | |
| # Windows .exe | |
| # ============================================================ | |
| build-windows: | |
| name: "Build Windows .exe" | |
| runs-on: windows-latest | |
| needs: test | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: pip | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e . pyinstaller | |
| - name: Fetch boundary baseline | |
| run: python scripts/fetch_boundary_baseline.py | |
| - name: Build .exe | |
| run: pyinstaller opensak.spec --clean --noconfirm | |
| env: | |
| PYTHONPATH: src | |
| - name: Create ZIP | |
| shell: powershell | |
| run: Compress-Archive -Path dist/OpenSAK -DestinationPath dist/OpenSAK-${{ github.ref_name }}-Windows.zip | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: OpenSAK-${{ github.ref_name }}-Windows | |
| path: dist/OpenSAK-${{ github.ref_name }}-Windows.zip | |
| retention-days: 7 | |
| # ============================================================ | |
| # Linux AppImage | |
| # ============================================================ | |
| build-linux: | |
| name: "Build Linux AppImage" | |
| runs-on: ubuntu-22.04 | |
| needs: test | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install system packages | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libxcb-cursor0 libxcb-xinerama0 libxkbcommon-x11-0 libglib2.0-0 libegl1 libgl1-mesa-dev libdbus-1-3 xvfb libfuse2 imagemagick | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: pip | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e . pyinstaller | |
| - name: Fetch boundary baseline | |
| run: python scripts/fetch_boundary_baseline.py | |
| - name: Build Linux binary | |
| run: xvfb-run -a pyinstaller opensak.spec --clean --noconfirm | |
| env: | |
| PYTHONPATH: src | |
| - name: Download appimagetool | |
| run: | | |
| wget -q https://github.com/AppImage/AppImageKit/releases/download/continuous/appimagetool-x86_64.AppImage -O appimagetool | |
| chmod +x appimagetool | |
| - name: Build AppDir | |
| run: python3 scripts/make_appdir.py | |
| - name: Build AppImage | |
| run: ARCH=x86_64 ./appimagetool --appimage-extract-and-run AppDir OpenSAK-${{ github.ref_name }}-Linux-x86_64.AppImage | |
| env: | |
| ARCH: x86_64 | |
| - name: Verify output and create fallback tar.gz | |
| run: | | |
| if [ -f OpenSAK-${{ github.ref_name }}-Linux-x86_64.AppImage ]; then | |
| echo "AppImage OK" | |
| ls -lh OpenSAK-${{ github.ref_name }}-Linux-x86_64.AppImage | |
| chmod +x OpenSAK-${{ github.ref_name }}-Linux-x86_64.AppImage | |
| else | |
| echo "AppImage failed - creating tar.gz fallback" | |
| tar -czf OpenSAK-${{ github.ref_name }}-Linux-x86_64.tar.gz -C dist OpenSAK/ | |
| fi | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: OpenSAK-${{ github.ref_name }}-Linux | |
| path: | | |
| OpenSAK-${{ github.ref_name }}-Linux-x86_64.AppImage | |
| OpenSAK-${{ github.ref_name }}-Linux-x86_64.tar.gz | |
| retention-days: 7 | |
| # ============================================================ | |
| # macOS arm64 (Apple Silicon — M1/M2/M3/M4) | |
| # ============================================================ | |
| build-macos-arm64: | |
| name: "Build macOS arm64 (Apple Silicon)" | |
| runs-on: macos-latest | |
| needs: test | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: pip | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e . pyinstaller | |
| - name: Fetch boundary baseline | |
| run: python scripts/fetch_boundary_baseline.py | |
| - name: Build macOS .app (arm64) | |
| run: pyinstaller opensak.spec --clean --noconfirm | |
| env: | |
| PYTHONPATH: src | |
| # Code signing / notarization only run when the certificate secret is | |
| # present, so the build still succeeds unsigned on forks and PRs that | |
| # don't have access to the OpenSAK org's secrets. `if:` conditions | |
| # can't reference `secrets` directly (GitHub Actions restriction), so | |
| # the check is done once here and reused via this step's output. | |
| - name: Check for Apple signing secrets | |
| id: signing | |
| run: echo "enabled=${{ secrets.APPLE_CERTIFICATE_P12_BASE64 != '' }}" >> "$GITHUB_OUTPUT" | |
| - name: Import signing certificate | |
| if: steps.signing.outputs.enabled == 'true' | |
| uses: ./.github/actions/macos-import-certificate | |
| with: | |
| p12-base64: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 }} | |
| p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| - name: Codesign app bundle | |
| if: steps.signing.outputs.enabled == 'true' | |
| uses: ./.github/actions/macos-codesign | |
| with: | |
| target-path: dist/OpenSAK.app | |
| - name: Create .dmg (arm64) | |
| run: | | |
| brew install create-dmg | |
| create-dmg \ | |
| --volname "OpenSAK" \ | |
| --window-size 500 300 \ | |
| --icon-size 100 \ | |
| --app-drop-link 350 150 \ | |
| OpenSAK-${{ github.ref_name }}-macOS-arm64.dmg \ | |
| dist/OpenSAK.app \ | |
| || (cd dist && zip -r ../OpenSAK-${{ github.ref_name }}-macOS-arm64.zip OpenSAK.app && echo "Fallback ZIP created") | |
| - name: Codesign .dmg | |
| if: steps.signing.outputs.enabled == 'true' | |
| uses: ./.github/actions/macos-codesign | |
| with: | |
| target-path: OpenSAK-${{ github.ref_name }}-macOS-arm64.dmg | |
| - name: Notarize .dmg | |
| if: steps.signing.outputs.enabled == 'true' | |
| uses: ./.github/actions/macos-notarize | |
| with: | |
| target-path: OpenSAK-${{ github.ref_name }}-macOS-arm64.dmg | |
| apple-id: ${{ secrets.APPLE_ID }} | |
| app-specific-password: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| team-id: ${{ secrets.APPLE_TEAM_ID }} | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: OpenSAK-${{ github.ref_name }}-macOS-arm64 | |
| path: | | |
| OpenSAK-${{ github.ref_name }}-macOS-arm64.dmg | |
| OpenSAK-${{ github.ref_name }}-macOS-arm64.zip | |
| retention-days: 7 | |
| # ============================================================ | |
| # macOS x86_64 (Intel) | |
| # ============================================================ | |
| build-macos-x86: | |
| name: "Build macOS x86_64 (Intel)" | |
| runs-on: macos-15-intel | |
| needs: test | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: pip | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e . pyinstaller | |
| - name: Fetch boundary baseline | |
| run: python scripts/fetch_boundary_baseline.py | |
| - name: Build macOS .app (x86_64) | |
| run: pyinstaller opensak.spec --clean --noconfirm | |
| env: | |
| PYTHONPATH: src | |
| - name: Check for Apple signing secrets | |
| id: signing | |
| run: echo "enabled=${{ secrets.APPLE_CERTIFICATE_P12_BASE64 != '' }}" >> "$GITHUB_OUTPUT" | |
| - name: Import signing certificate | |
| if: steps.signing.outputs.enabled == 'true' | |
| uses: ./.github/actions/macos-import-certificate | |
| with: | |
| p12-base64: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 }} | |
| p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| - name: Codesign app bundle | |
| if: steps.signing.outputs.enabled == 'true' | |
| uses: ./.github/actions/macos-codesign | |
| with: | |
| target-path: dist/OpenSAK.app | |
| - name: Create .dmg (x86_64) | |
| run: | | |
| brew install create-dmg | |
| create-dmg \ | |
| --volname "OpenSAK" \ | |
| --window-size 500 300 \ | |
| --icon-size 100 \ | |
| --app-drop-link 350 150 \ | |
| OpenSAK-${{ github.ref_name }}-macOS-x86_64.dmg \ | |
| dist/OpenSAK.app \ | |
| || (cd dist && zip -r ../OpenSAK-${{ github.ref_name }}-macOS-x86_64.zip OpenSAK.app && echo "Fallback ZIP created") | |
| - name: Codesign .dmg | |
| if: steps.signing.outputs.enabled == 'true' | |
| uses: ./.github/actions/macos-codesign | |
| with: | |
| target-path: OpenSAK-${{ github.ref_name }}-macOS-x86_64.dmg | |
| - name: Notarize .dmg | |
| if: steps.signing.outputs.enabled == 'true' | |
| uses: ./.github/actions/macos-notarize | |
| with: | |
| target-path: OpenSAK-${{ github.ref_name }}-macOS-x86_64.dmg | |
| apple-id: ${{ secrets.APPLE_ID }} | |
| app-specific-password: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| team-id: ${{ secrets.APPLE_TEAM_ID }} | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: OpenSAK-${{ github.ref_name }}-macOS-x86_64 | |
| path: | | |
| OpenSAK-${{ github.ref_name }}-macOS-x86_64.dmg | |
| OpenSAK-${{ github.ref_name }}-macOS-x86_64.zip | |
| retention-days: 7 | |
| # ============================================================ | |
| # Create GitHub Release | |
| # ============================================================ | |
| create-release: | |
| name: "Create GitHub Release" | |
| runs-on: ubuntu-latest | |
| needs: [build-windows, build-linux, build-macos-arm64, build-macos-x86] | |
| if: startsWith(github.ref, 'refs/tags/') | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| name: OpenSAK-${{ github.ref_name }}-Windows | |
| path: release-files/ | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| name: OpenSAK-${{ github.ref_name }}-Linux | |
| path: release-files/ | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| name: OpenSAK-${{ github.ref_name }}-macOS-arm64 | |
| path: release-files/ | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| name: OpenSAK-${{ github.ref_name }}-macOS-x86_64 | |
| path: release-files/ | |
| - name: List release files | |
| run: ls -lh release-files/ | |
| - name: Extract version from tag | |
| id: version | |
| run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| tag_name: ${{ steps.version.outputs.VERSION }} | |
| name: "OpenSAK ${{ steps.version.outputs.VERSION }}" | |
| draft: false | |
| prerelease: ${{ contains(github.ref, 'beta') || contains(github.ref, 'alpha') }} | |
| body: | | |
| ## OpenSAK ${{ steps.version.outputs.VERSION }} | |
| ### Download | |
| | Platform | File | Instructions | | |
| |----------|------|--------------| | |
| | 🪟 Windows | `OpenSAK-${{ steps.version.outputs.VERSION }}-Windows.zip` | Unzip and double-click `OpenSAK.exe` | | |
| | 🐧 Linux | `OpenSAK-${{ steps.version.outputs.VERSION }}-Linux-x86_64.AppImage` | See instructions below | | |
| | 🍎 macOS Apple Silicon (M1/M2/M3/M4) | `OpenSAK-${{ steps.version.outputs.VERSION }}-macOS-arm64.dmg` | Open and drag OpenSAK to Applications | | |
| | 🍎 macOS Intel | `OpenSAK-${{ steps.version.outputs.VERSION }}-macOS-x86_64.dmg` | Open and drag OpenSAK to Applications | | |
| > **Not sure which Mac you have?** Click the Apple menu () → "About This Mac". | |
| > If it says "Apple M1/M2/M3/M4" choose **arm64**. If it says "Intel" choose **x86_64**. | |
| ### Linux | |
| ```bash | |
| chmod +x OpenSAK-${{ steps.version.outputs.VERSION }}-Linux-x86_64.AppImage | |
| ./OpenSAK-${{ steps.version.outputs.VERSION }}-Linux-x86_64.AppImage | |
| ``` | |
| Or right-click → Properties → Allow executing as program, then double-click. | |
| ### Windows | |
| 1. Download `OpenSAK-${{ steps.version.outputs.VERSION }}-Windows.zip` | |
| 2. Right-click → Extract All | |
| 3. Open the extracted folder and double-click `OpenSAK.exe` | |
| ### macOS | |
| 1. Download the correct .dmg for your Mac (arm64 or x86_64) | |
| 2. Open the .dmg and drag OpenSAK to your Applications folder — the app is signed and notarized by Apple, so it opens normally on first launch | |
| --- | |
| See [CHANGELOG.md](https://github.com/OpenSAK-Org/OpenSAK/blob/${{ steps.version.outputs.VERSION }}/CHANGELOG.md) for details. | |
| files: release-files/**/* | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |