fix(backend): use binary mode for salt file to fix Windows password bug #19
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| jobs: | |
| create-release: | |
| name: Create GitHub Release | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Create Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| generate_release_notes: true | |
| draft: true | |
| prerelease: ${{ contains(github.ref, 'alpha') || contains(github.ref, 'beta') }} | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| build-extension: | |
| name: Build Chrome Extension | |
| runs-on: ubuntu-latest | |
| needs: create-release | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: 'pnpm' | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Build extension | |
| run: pnpm --filter think-extension build | |
| - name: Create ZIP archive | |
| run: | | |
| cd extension/dist | |
| zip -r ../../think-extension-${{ github.ref_name }}.zip . | |
| - name: Upload extension artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: chrome-extension | |
| path: think-extension-${{ github.ref_name }}.zip | |
| retention-days: 1 | |
| build-macos: | |
| name: Build macOS App | |
| runs-on: macos-latest | |
| needs: create-release | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: 'pnpm' | |
| - name: Setup Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Install Poetry | |
| uses: snok/install-poetry@v1 | |
| with: | |
| version: '1.8.0' | |
| virtualenvs-create: true | |
| virtualenvs-in-project: true | |
| - name: Install SQLCipher | |
| run: brew install sqlcipher | |
| - name: Install pnpm dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Install backend dependencies | |
| working-directory: backend | |
| run: | | |
| export C_INCLUDE_PATH="$(brew --prefix sqlcipher)/include" | |
| export LIBRARY_PATH="$(brew --prefix sqlcipher)/lib" | |
| export CFLAGS="-I$(brew --prefix sqlcipher)/include" | |
| export LDFLAGS="-L$(brew --prefix sqlcipher)/lib" | |
| poetry run pip install pysqlcipher3 --no-cache-dir | |
| poetry install | |
| - name: Import Code Signing Certificate | |
| env: | |
| MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }} | |
| MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }} | |
| run: | | |
| KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db | |
| KEYCHAIN_PASSWORD=$(openssl rand -base64 32) | |
| echo "$MACOS_CERTIFICATE" | base64 --decode > $RUNNER_TEMP/certificate.p12 | |
| security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| security set-keychain-settings -lut 21600 $KEYCHAIN_PATH | |
| security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| security import $RUNNER_TEMP/certificate.p12 -P "$MACOS_CERTIFICATE_PWD" \ | |
| -A -t cert -f pkcs12 -k $KEYCHAIN_PATH | |
| security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| security list-keychain -d user -s $KEYCHAIN_PATH | |
| - name: Build all (stub + backend + app) | |
| env: | |
| CODESIGN_IDENTITY: ${{ secrets.CODESIGN_IDENTITY }} | |
| NOTARIZE: '1' | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| CSC_LINK: ${{ secrets.MACOS_CERTIFICATE }} | |
| CSC_KEY_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PWD }} | |
| run: pnpm build:all:release | |
| - name: Upload DMG artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: electron-app-macos | |
| path: app/release/*.dmg | |
| retention-days: 1 | |
| build-windows: | |
| name: Build Windows App | |
| runs-on: windows-latest | |
| needs: create-release | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: 'pnpm' | |
| - name: Setup Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Install Poetry | |
| run: pip install poetry==1.8.0 | |
| - name: Configure Poetry | |
| run: poetry config virtualenvs.in-project true | |
| working-directory: backend | |
| - name: Install pnpm dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Install backend dependencies | |
| working-directory: backend | |
| run: poetry install | |
| - name: Download MSVC-compiled sqlite-vec | |
| shell: pwsh | |
| run: | | |
| # Download MSVC-compiled vec0.dll from sqlite-vec releases | |
| $vec0Url = "https://github.com/asg017/sqlite-vec/releases/download/v0.1.6/sqlite-vec-0.1.6-loadable-windows-x86_64.tar.gz" | |
| $tarPath = "$env:RUNNER_TEMP\sqlite-vec.tar.gz" | |
| $extractPath = "$env:RUNNER_TEMP\sqlite-vec" | |
| Invoke-WebRequest -Uri $vec0Url -OutFile $tarPath | |
| New-Item -ItemType Directory -Path $extractPath -Force | |
| tar -xzf $tarPath -C $extractPath | |
| # Find where sqlite_vec package is installed and copy vec0.dll there | |
| $sitePackages = poetry run python -c "import site; print(site.getsitepackages()[0])" | |
| $sqliteVecDir = Join-Path $sitePackages "sqlite_vec" | |
| if (Test-Path $sqliteVecDir) { | |
| Copy-Item "$extractPath\vec0.dll" -Destination $sqliteVecDir -Force | |
| Write-Host "Copied vec0.dll to $sqliteVecDir" | |
| } else { | |
| Write-Host "Warning: sqlite_vec directory not found at $sqliteVecDir" | |
| } | |
| working-directory: backend | |
| - name: Build backend | |
| run: pnpm build:backend | |
| - name: Build native stub | |
| run: pnpm build:stub | |
| - name: Build app (frontend) | |
| run: pnpm --filter think-app build | |
| - name: Build Electron app (NSIS installer) | |
| run: pnpm --filter think-app electron:build | |
| - name: Upload Windows artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: electron-app-windows | |
| path: app/release/*.exe | |
| retention-days: 1 | |
| upload-release: | |
| name: Upload Release Artifacts | |
| runs-on: ubuntu-latest | |
| needs: [create-release, build-extension, build-macos, build-windows] | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: artifacts | |
| - name: List artifacts | |
| run: find artifacts -type f | |
| - name: Upload to Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| files: | | |
| artifacts/chrome-extension/*.zip | |
| artifacts/electron-app-macos/*.dmg | |
| artifacts/electron-app-windows/*.exe | |
| draft: true | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |