native: keyboard nav scrolls minimally into view (anchor:nil), not ce… #30
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| permissions: | |
| contents: write | |
| jobs: | |
| macos: | |
| runs-on: macos-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| arch: [x64, arm64] | |
| env: | |
| MACOS_CERTIFICATE_CONFIGURED: ${{ (secrets.MACOS_CERTIFICATE != '' || secrets.CSC_LINK != '') && 'true' || 'false' }} | |
| APPLE_NOTARIZATION_CONFIGURED: ${{ (secrets.APPLE_API_KEY != '' || secrets.APPLE_ID != '') && 'true' || 'false' }} | |
| APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} | |
| APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 20 | |
| cache: npm | |
| scope: "@leeguoo" | |
| registry-url: "https://registry.npmjs.org" | |
| - run: npm ci | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - run: npm run typecheck | |
| - name: Prepare Apple notarization key | |
| shell: bash | |
| env: | |
| APPLE_API_KEY_CONTENT: ${{ secrets.APPLE_API_KEY }} | |
| run: | | |
| set -euo pipefail | |
| if [[ -z "${APPLE_API_KEY_CONTENT:-}" ]]; then | |
| if [[ -n "${APPLE_API_KEY_ID:-}" || -n "${APPLE_API_ISSUER:-}" ]]; then | |
| echo "APPLE_API_KEY is required when APPLE_API_KEY_ID or APPLE_API_ISSUER is configured." >&2 | |
| exit 1 | |
| fi | |
| echo "APPLE_API_KEY is not configured; macOS notarization will be skipped." | |
| exit 0 | |
| fi | |
| if [[ -z "${APPLE_API_KEY_ID:-}" || -z "${APPLE_API_ISSUER:-}" ]]; then | |
| echo "APPLE_API_KEY_ID and APPLE_API_ISSUER are required when APPLE_API_KEY is configured." >&2 | |
| exit 1 | |
| fi | |
| key_path="${RUNNER_TEMP}/AuthKey_${APPLE_API_KEY_ID}.p8" | |
| printf '%s' "${APPLE_API_KEY_CONTENT}" > "${key_path}" | |
| chmod 600 "${key_path}" | |
| echo "APPLE_API_KEY=${key_path}" >> "${GITHUB_ENV}" | |
| - name: Validate Apple ID notarization secrets | |
| shell: bash | |
| env: | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| run: | | |
| set -euo pipefail | |
| if [[ -z "${APPLE_ID:-}" && -z "${APPLE_APP_SPECIFIC_PASSWORD:-}" && -z "${APPLE_TEAM_ID:-}" ]]; then | |
| echo "APPLE_ID is not configured; Apple ID notarization will be skipped." | |
| exit 0 | |
| fi | |
| if [[ -z "${APPLE_ID:-}" || -z "${APPLE_APP_SPECIFIC_PASSWORD:-}" || -z "${APPLE_TEAM_ID:-}" ]]; then | |
| echo "APPLE_ID, APPLE_APP_SPECIFIC_PASSWORD, and APPLE_TEAM_ID must be configured together." >&2 | |
| exit 1 | |
| fi | |
| if [[ "${MACOS_CERTIFICATE_CONFIGURED}" != "true" ]]; then | |
| echo "Apple ID notarization secrets are configured but no signing certificate (MACOS_CERTIFICATE or CSC_LINK) is set; notarization requires a Developer ID signed build." >&2 | |
| exit 1 | |
| fi | |
| - name: Build macOS artifacts | |
| shell: bash | |
| env: | |
| MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE || secrets.CSC_LINK }} | |
| MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD || secrets.CSC_KEY_PASSWORD }} | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| run: | | |
| set -euo pipefail | |
| if [[ -n "${MACOS_CERTIFICATE:-}" ]]; then | |
| export CSC_LINK="${MACOS_CERTIFICATE}" | |
| export CSC_KEY_PASSWORD="${MACOS_CERTIFICATE_PASSWORD:-}" | |
| export CSC_IDENTITY_AUTO_DISCOVERY=true | |
| else | |
| unset CSC_LINK CSC_KEY_PASSWORD | |
| export CSC_IDENTITY_AUTO_DISCOVERY=false | |
| fi | |
| if [[ -z "${APPLE_ID:-}" ]]; then | |
| unset APPLE_ID APPLE_APP_SPECIFIC_PASSWORD APPLE_TEAM_ID | |
| fi | |
| npm --workspace @paste/macos run dist -- --mac dmg zip --${{ matrix.arch }} | |
| - name: Verify Developer ID signature when certificate is configured | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| if [[ "${MACOS_CERTIFICATE_CONFIGURED}" != "true" ]]; then | |
| echo "MACOS_CERTIFICATE is not configured; macOS auto-update will stay disabled for this release." | |
| exit 0 | |
| fi | |
| app_path="$(find apps/macos/dist-electron -maxdepth 2 -name 'Pastyx.app' -type d | head -n 1)" | |
| if [[ -z "${app_path}" ]]; then | |
| echo "Pastyx.app not found in apps/macos/dist-electron" >&2 | |
| exit 1 | |
| fi | |
| codesign -dv --verbose=4 "${app_path}" 2>&1 | tee /tmp/pastyx-codesign.txt | |
| grep -q '^Authority=Developer ID Application:' /tmp/pastyx-codesign.txt | |
| - name: Verify notarization when notarization secrets are configured | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| if [[ "${APPLE_NOTARIZATION_CONFIGURED}" != "true" ]]; then | |
| echo "Notarization secrets are not configured; notarization validation skipped." | |
| exit 0 | |
| fi | |
| app_path="$(find apps/macos/dist-electron -maxdepth 2 -name 'Pastyx.app' -type d | head -n 1)" | |
| if [[ -z "${app_path}" ]]; then | |
| echo "Pastyx.app not found in apps/macos/dist-electron" >&2 | |
| exit 1 | |
| fi | |
| xcrun stapler validate "${app_path}" | |
| - run: node apps/macos/electron/prepare-release-assets.cjs apps/macos/dist-electron | |
| - name: Normalize macOS update metadata filenames | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| cd apps/macos/dist-electron | |
| if [[ "${{ matrix.arch }}" == "arm64" ]]; then | |
| if [[ -f latest-mac.yml && ! -f latest-mac-arm64.yml ]]; then | |
| mv latest-mac.yml latest-mac-arm64.yml | |
| fi | |
| fi | |
| if [[ "${{ matrix.arch }}" == "x64" ]]; then | |
| if [[ -f latest-mac-x64.yml && ! -f latest-mac.yml ]]; then | |
| mv latest-mac-x64.yml latest-mac.yml | |
| fi | |
| fi | |
| - uses: actions/upload-artifact@v6 | |
| with: | |
| name: macos-${{ matrix.arch }} | |
| path: | | |
| apps/macos/dist-electron/*.dmg | |
| apps/macos/dist-electron/*.zip | |
| apps/macos/dist-electron/*.blockmap | |
| apps/macos/dist-electron/latest*.yml | |
| windows: | |
| runs-on: windows-latest | |
| env: | |
| CSC_IDENTITY_AUTO_DISCOVERY: 'false' | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 20 | |
| cache: npm | |
| scope: "@leeguoo" | |
| registry-url: "https://registry.npmjs.org" | |
| - run: npm ci | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - run: npm run typecheck | |
| - run: npm --workspace @paste/macos run dist -- --win nsis zip --x64 | |
| - run: node apps/macos/electron/prepare-release-assets.cjs apps/macos/dist-electron | |
| - uses: actions/upload-artifact@v6 | |
| with: | |
| name: windows-x64 | |
| path: | | |
| apps/macos/dist-electron/*.exe | |
| apps/macos/dist-electron/*.zip | |
| apps/macos/dist-electron/*.blockmap | |
| apps/macos/dist-electron/latest*.yml | |
| release: | |
| runs-on: ubuntu-latest | |
| needs: [macos, windows] | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/download-artifact@v6 | |
| with: | |
| path: dist | |
| - name: Create GitHub release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| mapfile -t files < <(find dist -type f | sort) | |
| if [[ ${#files[@]} -eq 0 ]]; then | |
| echo "No release artifacts found under dist/" >&2 | |
| exit 1 | |
| fi | |
| gh release create "${GITHUB_REF_NAME}" "${files[@]}" \ | |
| -R "${GITHUB_REPOSITORY}" \ | |
| --title "${GITHUB_REF_NAME}" \ | |
| --generate-notes \ | |
| --verify-tag |