got-feedBack/feedBack-desktop
1
0
Fork 0
mirror of https://github.com/got-feedBack/feedBack-desktop.git synced 2026-08-10 18:59:55 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

ci: adapt workflows to trunk-based development (#62)

Browse Source 
* ci: adapt workflows to trunk-based development

Nightly builds main directly (old release/v* discovery pinned nightlies
to shipped branches forever). ship-ci adds push triggers on main and
release/** for post-merge signal. New rc.yml builds the desktop app
matrix from release branches during stabilization (signed, not
notarized, 14-day artifacts).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ci: fix rc.yml mac-zip rename skew + drop duplicate build-core

rc.yml: glob release/mac*/*.app (was hardcoded Slopsmith.app, which no longer exists after the fee[dB]ack rebrand) and derive the zip name from the bundle; rename the win zip + comments off 'Slopsmith'. nightly.yml: remove build-core — core's own nightly already pushes ghcr feedback:nightly on the same cron (duplicate/race, per PR author's open question).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: byrongamatos <xasiklas@gmail.com>
This commit is contained in:
OmikronApex
2026-07-03 11:29:33 +02:00
committed by GitHub
co-authored by Claude Fable 5 byrongamatos
parent b4c63f82e7
commit 921ae0b66d
3 changed files with 174 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/nightly.yml
+7 -55
View File
@@ -1,5 +1,9 @@
name: Nightly
# Trunk-based: nightly always builds main — the release/v* branch discovery
# from the old release-centric flow is gone (it pinned nightlies to the
# highest release branch forever, even after it shipped). Stabilization
# builds from release/** come from rc.yml instead.
on:
schedule:
- cron: '0 2 * * *'
@@ -9,67 +13,16 @@ jobs:
setup:
runs-on: ubuntu-latest
outputs:
branch: ${{ steps.branch.outputs.branch }}
date: ${{ steps.date.outputs.date }}
steps:
# Find the most recently created release/v* branch by sorting version
# strings. Falls back to main if no release branch exists (quiet window
# between a release shipping and the next branch being cut).
- name: Find active release branch
id: branch
env:
GH_TOKEN: ${{ github.token }}
run: |
branch=$(gh api "repos/${{ github.repository }}/git/matching-refs/heads/release/v" \
--jq '[.[].ref | ltrimstr("refs/heads/")] | sort | last // empty' 2>/dev/null || echo "")
if [[ -z "$branch" ]]; then
branch="main"
fi
echo "branch=$branch" >> "$GITHUB_OUTPUT"
echo "Active branch: $branch"
- name: Get date
id: date
run: echo "date=$(date -u +%Y%m%d)" >> "$GITHUB_OUTPUT"
build-core:
needs: setup
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- name: Clone core at active branch
env:
GH_CLONE_TOKEN: ${{ secrets.FEEDBACK_CLONE_TOKEN }}
run: |
git clone --depth 1 --branch "${{ needs.setup.outputs.branch }}" \
"https://x-access-token:${GH_CLONE_TOKEN}@github.com/got-feedback/feedback.git" core
echo "Cloned feedback core @ $(git -C core rev-parse --short HEAD) (${{ needs.setup.outputs.branch }})"
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Log in to GHCR
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Build and push Docker image
uses: docker/build-push-action@v6
with:
context: core
platforms: linux/amd64,linux/arm64
push: true
tags: |
ghcr.io/got-feedback/feedback:nightly
ghcr.io/got-feedback/feedback:nightly-${{ needs.setup.outputs.date }}
cache-from: type=gha
cache-to: type=gha,mode=max
# build-core removed: core's own nightly.yml already builds + pushes
# ghcr.io/got-feedback/feedback:nightly on the same 02:00 UTC cron, so this
# was duplicate/racing work. Core owns its image now.
build:
needs: setup
@@ -92,7 +45,6 @@ jobs:
steps:
- uses: actions/checkout@v4
with:
ref: ${{ needs.setup.outputs.branch }}
submodules: recursive
- name: Read build configuration
.github/workflows/rc.yml
+162
View File
@@ -0,0 +1,162 @@
name: rc
# Release-candidate desktop builds for stabilization: every push to a
# release/** branch builds the app matrix and uploads rc-* artifacts.
# Core's RC Docker images come from the core repo's own rc.yml; final
# signed/notarized releases still come from release.yml on tag push.
on:
push:
branches: ['release/**']
workflow_dispatch:
permissions:
contents: read
# One build per branch at a time; a newer push supersedes an in-flight one.
concurrency:
group: rc-${{ github.ref }}
cancel-in-progress: true
jobs:
setup:
runs-on: ubuntu-latest
outputs:
date: ${{ steps.date.outputs.date }}
version: ${{ steps.version.outputs.version }}
steps:
- name: Get date
id: date
run: echo "date=$(date -u +%Y%m%d)" >> "$GITHUB_OUTPUT"
- name: Derive version from branch name
id: version
run: |
# release/v0.3.0 -> 0.3.0 (tolerate a missing v prefix too)
version="${GITHUB_REF_NAME#release/}"
version="${version#v}"
echo "version=$version" >> "$GITHUB_OUTPUT"
build:
needs: setup
strategy:
fail-fast: false
matrix:
include:
- os: ubuntu-22.04
platform: linux
arch: x64
- os: macos-14
platform: mac
arch: arm64
- os: windows-latest
platform: win
arch: x64
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
- name: Read build configuration
id: config
shell: bash
run: |
NODE_VERSION=$(node -p "require('./.build-config.json').versions.node")
PYTHON_VERSION=$(node -p "require('./.build-config.json').versions.python")
echo "node=$NODE_VERSION" >> $GITHUB_OUTPUT
echo "python=$PYTHON_VERSION" >> $GITHUB_OUTPUT
echo "Node ${NODE_VERSION}, Python ${PYTHON_VERSION}"
- uses: actions/setup-node@v4
with:
node-version: ${{ steps.config.outputs.node }}
- uses: actions/setup-python@v5
with:
python-version: ${{ steps.config.outputs.python }}
# macOS: import signing cert so build-macos.sh can codesign the .app.
# RC builds are signed but not notarized (same as nightlies) — testers
# clear Gatekeeper with `xattr -dr com.apple.quarantine <app>.app`.
# Graceful fallback: no-op when secrets are absent.
- name: Import Apple signing certificate
if: matrix.platform == 'mac'
env:
APPLE_CERTIFICATE_P12_BASE64: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 }}
APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
run: |
set -euo pipefail
if [[ -z "${APPLE_CERTIFICATE_P12_BASE64:-}" ]]; then
echo "APPLE_CERTIFICATE_P12_BASE64 not set — skipping (unsigned build)"
exit 0
fi
printf '%s' "$APPLE_CERTIFICATE_P12_BASE64" | base64 --decode > "$RUNNER_TEMP/cert.p12"
security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
security default-keychain -s build.keychain
security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
security set-keychain-settings -lut 21600 build.keychain
security list-keychains -d user -s build.keychain login.keychain-db
security import "$RUNNER_TEMP/cert.p12" -k build.keychain \
-P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
security set-key-partition-list \
-S apple-tool:,apple:,codesign: \
-s -k "$KEYCHAIN_PASSWORD" build.keychain
rm -f "$RUNNER_TEMP/cert.p12"
security find-identity -v -p codesigning build.keychain | grep -q "Developer ID Application"
- name: Build
run: ./scripts/build-release.sh
shell: bash
env:
# PAT with read access to the private got-feedback repos so
# build-common.sh can clone core + the bundled plugins.
GH_CLONE_TOKEN: ${{ secrets.FEEDBACK_CLONE_TOKEN }}
APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
# No notarization for RC builds — testers use xattr -dr com.apple.quarantine
CSC_FOR_PULL_REQUEST: "true"
# macOS: zip the .app for tester distribution (same as nightly.yml).
- name: Zip macOS app
if: matrix.platform == 'mac'
shell: bash
run: |
set -euo pipefail
app=$(ls -d release/mac*/*.app 2>/dev/null | head -n1 || true)
if [[ -z "${app:-}" || ! -d "$app" ]]; then
echo "::error::No .app bundle found under release/mac*/"
exit 1
fi
name=$(basename "$app" .app)
ditto -c -k --sequesterRsrc --keepParent "$app" "release/${name}-macos-arm64.zip"
echo "Zipped $app -> release/${name}-macos-arm64.zip"
# Windows: electron-builder's `dir` target leaves win-unpacked/ with no
# packaged installer (Velopack is skipped for RC builds). Zip the directory
# so testers can download and extract, then launch the app .exe directly.
- name: Zip win-unpacked
if: matrix.platform == 'win'
shell: pwsh
run: |
Compress-Archive -Path release\win-unpacked\* -DestinationPath release\feedback-windows-x64.zip
Write-Host "Zipped win-unpacked -> release\feedback-windows-x64.zip"
- name: Clean up signing keychain
if: always() && matrix.platform == 'mac'
run: |
security delete-keychain build.keychain 2>/dev/null || true
- name: Upload RC artifacts
uses: actions/upload-artifact@v4
with:
name: rc-${{ needs.setup.outputs.version }}-${{ needs.setup.outputs.date }}-${{ matrix.platform }}-${{ matrix.arch }}
path: |
release/*.AppImage
release/*.deb
release/*.zip
build/Release/*.pdb
if-no-files-found: warn
retention-days: 14
.github/workflows/ship-ci.yml
+5
View File
@@ -8,6 +8,11 @@ name: Ship CI
on:
pull_request:
branches: [main, 'release/**']
# Trunk-based: post-merge CI on main catches semantic conflicts between
# independently-green PRs; push on release/** covers stabilization
# cherry-picks that land without a PR.
push:
branches: [main, 'release/**']
workflow_dispatch:
concurrency: