Electron 企业构建与受控发布

name: Desktop release
on:
  push:
    tags: ['v*']
permissions:
  contents: read
concurrency:
  group: desktop-${{ github.ref }}
  cancel-in-progress: false
jobs:
  build:
    environment: desktop-signing
    strategy:
      fail-fast: false
      matrix:
        include:
          - {os: windows-latest, platform: win, script: 'build:win:x64', files: 'dist/*.exe'}
          - {os: macos-latest, platform: mac, script: 'build:mac:arm', files: 'dist/*.dmg'}
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v6
        with: {persist-credentials: false}
      - uses: actions/setup-node@v6
        with: {node-version: '24'}
      - uses: pnpm/action-setup@v6
      - run: pnpm install --frozen-lockfile
      - run: pnpm run test:ci
      - name: Materialize notarization key
        if: matrix.platform == 'mac'
        shell: bash
        env:
          API_KEY: ${{ secrets.APPLE_API_KEY_CONTENT }}
        run: |
          umask 077
          printf '%s' "$API_KEY" > "$RUNNER_TEMP/AuthKey.p8"
      - name: Package and sign, never publish
        run: pnpm run ${{ matrix.script }} --publish never
        env:
          CSC_LINK: ${{ matrix.platform == 'win' && secrets.WIN_CSC_LINK || secrets.MAC_CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ matrix.platform == 'win' && secrets.WIN_CSC_PASSWORD || secrets.MAC_CSC_PASSWORD }}
          APPLE_API_KEY: ${{ runner.temp }}/AuthKey.p8
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
      - name: Validate Windows signatures
        if: matrix.platform == 'win'
        shell: pwsh
        run: |
          $files = @(Get-ChildItem dist/*.exe)
          if ($files.Count -eq 0) { throw 'No executable' }
          foreach ($file in $files) {
            if ((Get-AuthenticodeSignature $file.FullName).Status -ne 'Valid') { throw 'Invalid signature' }
          }
      - name: Validate macOS notarization
        if: matrix.platform == 'mac'
        shell: bash
        run: |
          set -euo pipefail
          found=0
          for file in dist/*.dmg; do
            test -f "$file"
            xcrun stapler validate "$file"
            spctl --assess --type open --context context:primary-signature --verbose "$file"
            found=1
          done
          test "$found" = 1
      - uses: actions/upload-artifact@v4
        with:
          name: desktop-${{ matrix.platform }}
          path: ${{ matrix.files }}
          if-no-files-found: error
          retention-days: 14
  release:
    needs: build
    environment: desktop-release
    runs-on: ubuntu-latest
    permissions: {contents: write}
    steps:
      - uses: actions/download-artifact@v4
        with: {pattern: 'desktop-*', path: artifacts}
      - name: Validate all platforms and publish complete draft
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          compgen -G 'artifacts/desktop-win/*.exe' >/dev/null
          compgen -G 'artifacts/desktop-mac/*.dmg' >/dev/null
          # Do not mutate an existing release, including a failed run's draft.
          if gh release view "$TAG" >/dev/null 2>&1; then
            echo 'Release exists; reconcile the previous run before retrying' >&2
            exit 1
          fi
          find artifacts -type f -print0 | sort -z | xargs -0 sha256sum > SHA256SUMS
          gh release create "$TAG" --verify-tag --draft --generate-notes
          gh release upload "$TAG" artifacts/desktop-win/*.exe artifacts/desktop-mac/*.dmg SHA256SUMS
          gh release view "$TAG" --json assets > assets.json
          EXPECTED=$(find artifacts -type f | wc -l)
          jq -e --argjson n "$EXPECTED" '.assets | length == ($n + 1)' assets.json
          if [[ "$TAG" == *-* ]]; then
            gh release edit "$TAG" --prerelease
          fi
          gh release edit "$TAG" --draft=false