chore(deps): upgrade Electron to v42 and devtools-installer to v4 #1355
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI/CD | |
| on: | |
| push: | |
| workflow_dispatch: | |
| concurrency: | |
| group: '${{ github.workflow }} @ ${{ github.head_ref || github.ref }}' | |
| permissions: | |
| contents: read | |
| jobs: | |
| ci: | |
| strategy: | |
| matrix: | |
| os: | |
| - macos-latest | |
| - windows-latest | |
| runs-on: ${{ matrix.os }} | |
| defaults: | |
| run: | |
| shell: bash | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 | |
| with: | |
| cache: 'npm' | |
| node-version-file: '.nvmrc' | |
| - name: Debug info | |
| run: | | |
| cat <<EOF | |
| Node version: $(node --version) | |
| NPM version: $(npm --version) | |
| GitHub ref: ${{ github.ref }} | |
| GitHub head ref: ${{ github.head_ref }} | |
| Working directory: $(pwd) | |
| EOF | |
| - name: Install NPM dependencies | |
| run: npm ci | |
| - name: Test | |
| run: npm run test | |
| - name: Build | |
| timeout-minutes: 30 | |
| env: | |
| # TODO: fix whatever is causing excessive memory usage during build | |
| NODE_OPTIONS: --max-old-space-size=4096 | |
| run: npm run distDev | |
| - name: Upload macOS artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| if: matrix.os == 'macos-latest' | |
| with: | |
| name: macOS-unsigned | |
| path: dist/Scratch*.dmg | |
| - name: Upload Windows artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| if: matrix.os == 'windows-latest' | |
| with: | |
| name: Windows-unsigned | |
| path: | | |
| dist/Scratch*.appx | |
| dist/Scratch*.exe | |
| # Builds a fully signed and notarized release candidate. Gated by the | |
| # 'release-candidate' GitHub Environment, which must be configured with | |
| # required reviewers under Settings -> Environments. Runs after ci on | |
| # develop pushes, or on manual workflow_dispatch from any branch | |
| # (use the "Run workflow" button to pick which ref to release). | |
| release-candidate: | |
| needs: ci | |
| if: | | |
| (github.event_name == 'push' && github.ref_name == 'develop') || | |
| github.event_name == 'workflow_dispatch' | |
| environment: release-candidate | |
| permissions: | |
| contents: read | |
| strategy: | |
| matrix: | |
| os: | |
| - macos-latest | |
| - windows-latest | |
| runs-on: ${{ matrix.os }} | |
| defaults: | |
| run: | |
| shell: bash | |
| env: | |
| # Temporary workaround: Windows signing is currently broken due to | |
| # a security-policy change. See | |
| # https://github.com/electron/windows-installer/issues/473 | |
| # While this is true, the release-candidate job still runs Windows | |
| # through the build (so we get an installer artifact) but skips | |
| # the signing step. | |
| SCRATCH_SHOULD_SIGN: ${{ matrix.os != 'windows-latest' }} | |
| # App Store Connect API key — fastlane and electron-builder read | |
| # different env var names but use the same credentials. The .p8 | |
| # file path (APPLE_API_KEY / APP_STORE_CONNECT_API_KEY_KEY_FILEPATH) | |
| # is written and exported by the "Decode App Store Connect API Key" | |
| # step below. | |
| APP_STORE_CONNECT_API_KEY_KEY_ID: ${{ vars.APP_STORE_CONNECT_API_KEY_KEY_ID }} | |
| APP_STORE_CONNECT_API_KEY_ISSUER_ID: ${{ vars.APP_STORE_CONNECT_API_KEY_ISSUER_ID }} | |
| APPLE_API_KEY_ID: ${{ vars.APP_STORE_CONNECT_API_KEY_KEY_ID }} | |
| APPLE_API_ISSUER: ${{ vars.APP_STORE_CONNECT_API_KEY_ISSUER_ID }} | |
| steps: | |
| # Re-check out the same SHA the ci job tested. Tier 1: source-identical | |
| # rebuild. The binary may differ in non-meaningful ways (timestamps, | |
| # webpack chunk order); the source is exactly what passed CI. | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| ref: ${{ github.sha }} | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 | |
| with: | |
| cache: 'npm' | |
| node-version-file: '.nvmrc' | |
| - name: Debug info | |
| run: | | |
| cat <<EOF | |
| Node version: $(node --version) | |
| NPM version: $(npm --version) | |
| GitHub ref: ${{ github.ref }} | |
| GitHub head ref: ${{ github.head_ref }} | |
| Working directory: $(pwd) | |
| EOF | |
| - name: Install NPM dependencies | |
| run: npm ci | |
| - name: Setup Keys for Fastlane | |
| if: matrix.os == 'macos-latest' | |
| uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 | |
| with: | |
| ssh-private-key: ${{ secrets.FASTLANE_ACCESS_KEY }} | |
| - name: Decode App Store Connect API Key | |
| if: matrix.os == 'macos-latest' | |
| env: | |
| APP_STORE_CONNECT_API_KEY_KEY: ${{ secrets.APP_STORE_CONNECT_API_KEY_KEY }} | |
| run: | | |
| KEY_PATH="$RUNNER_TEMP/AuthKey.p8" | |
| printf '%s' "$APP_STORE_CONNECT_API_KEY_KEY" | base64 -d > "$KEY_PATH" | |
| chmod 600 "$KEY_PATH" | |
| echo "APPLE_API_KEY=$KEY_PATH" >> "$GITHUB_ENV" | |
| echo "APP_STORE_CONNECT_API_KEY_KEY_FILEPATH=$KEY_PATH" >> "$GITHUB_ENV" | |
| - name: Setup Ruby | |
| if: matrix.os == 'macos-latest' | |
| uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0 | |
| with: | |
| bundler-cache: true | |
| - name: Fastlane | |
| env: | |
| GIT_URL: ${{ secrets.FL_GIT_URL }} | |
| STORAGE_MODE: ${{ vars.FL_STORAGE_MODE }} | |
| MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }} | |
| if: matrix.os == 'macos-latest' | |
| run: bundle exec fastlane prepare_signing | |
| - name: Build (signed) | |
| timeout-minutes: 30 # macOS notarization can take a while | |
| env: | |
| NODE_OPTIONS: --max-old-space-size=4096 | |
| # Only expose Windows code-signing secrets to runs that will use them. | |
| # SCRATCH_SHOULD_SIGN is currently false on Windows (temporary workaround above); | |
| # both expressions evaluate to '' until Windows signing is re-enabled. | |
| WIN_CSC_LINK: ${{ matrix.os == 'windows-latest' && env.SCRATCH_SHOULD_SIGN == 'true' && secrets.WIN_CSC_LINK || '' }} | |
| WIN_CSC_KEY_PASSWORD: ${{ matrix.os == 'windows-latest' && env.SCRATCH_SHOULD_SIGN == 'true' && secrets.WIN_CSC_KEY_PASSWORD || '' }} | |
| run: npm run ${{ env.SCRATCH_SHOULD_SIGN == 'true' && 'dist' || 'distDev' }} | |
| - name: Zip MAS-Dev build | |
| if: matrix.os == 'macos-latest' | |
| run: | | |
| NPM_APP_VERSION="`node -pe "require('./package.json').version"`" | |
| cd dist/mas-dev-universal | |
| ditto -v -c -k --sequesterRsrc --keepParent --zlibCompressionLevel 9 \ | |
| Scratch*.app ../mas-dev-universal-${NPM_APP_VERSION}.zip | |
| - name: Upload macOS artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| if: matrix.os == 'macos-latest' | |
| with: | |
| name: macOS-signed | |
| path: | | |
| dist/Scratch*.dmg | |
| dist/mas-universal/Scratch*.pkg | |
| dist/mas-dev-universal-*.zip | |
| - name: Upload Windows artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| if: matrix.os == 'windows-latest' | |
| with: | |
| name: Windows-installer | |
| path: | | |
| dist/Scratch*.appx | |
| dist/Scratch*.exe |