ff8cde2371
- .github/workflows/wai-quantum-desktop-release.yml, on a tag wai-quantum-desktop-v<version> equal to Cargo.toml's and tauri.conf.json's: a disk image for macOS (aarch64 and x86_64, with the GPU state vector); an AppImage, a Debian and an RPM package for Linux (x86_64 and arm64); an installer and a portable archive for Windows. Each build runs what it made (check, update-status, the code signature, the disk image's checksums, the AppImage, the Debian package unpacked), then attaches it with its SHA-256 over the private network. - Signing is skipped, and the log says so, while its secrets are absent: WAI_QUANTUM_DESKTOP_UPDATER_KEY (and its password) signs updates, and the built app's verify-update checks every one before it is attached; the APPLE_* secrets sign and notarise the macOS app. - release/manifests.py writes the Homebrew cask, the Scoop manifest and latest.json from the release's assets, from templates beside it, and the last job attaches them and puts latest.json on the pre-release the app asks unless that one names a newer version. Nothing is pushed to the tap or the bucket. release/manifests_test.py holds it to releases made up here. - wai-quantum-studio.yml: the desktop app's tests, clippy, check and update-status on Linux (act-22.04 with the web view's libraries) and on Windows as well as macOS, the update tests required by name; the Linux leg runs the manifests test, and the Studio job test/update.test.mjs. - The desktop README: the installers, which copies update themselves, the command that makes the update key and every secret's name. The changelog entry. Co-Authored-By: Claude Opus 5.5 <[email protected]>
47 lines
2.2 KiB
Shell
47 lines
2.2 KiB
Shell
#!/usr/bin/env bash
|
|
# Gather what `cargo tauri build` made for one target into release assets:
|
|
#
|
|
# bash release/collect.sh <bundle-dir> <version> <triple> <out-dir>
|
|
#
|
|
# <bundle-dir> is target/<triple>/release/bundle. Each asset is named
|
|
# wai-quantum-desktop-<version>-<triple>.<kind>: on macOS the disk image (.dmg)
|
|
# and the app as an update installs it (.app.tar.gz); on Linux the AppImage,
|
|
# the Debian package (.deb) and the RPM package (.rpm). Beside each one goes its
|
|
# SHA-256 (<asset>.sha256, as `shasum -a 256 -c` reads it) and, when the build
|
|
# was signed for updates, its update signature (<asset>.sig). A kind the bundle
|
|
# should hold and does not, or holds twice, fails the collection. Windows
|
|
# collects in PowerShell, in the release workflow.
|
|
set -euo pipefail
|
|
if [ $# -ne 4 ]; then
|
|
echo "usage: bash release/collect.sh <bundle-dir> <version> <triple> <out-dir>" >&2
|
|
exit 2
|
|
fi
|
|
B="$1"; VERSION="$2"; TRIPLE="$3"; OUT="$4"
|
|
NAME="wai-quantum-desktop-$VERSION-$TRIPLE"
|
|
mkdir -p "$OUT"
|
|
sha() { ( cd "$OUT" && { command -v sha256sum >/dev/null && sha256sum "$1" || shasum -a 256 "$1"; } > "$1.sha256" ); }
|
|
# One file in $1 matching the glob $2, copied as $NAME.$3, with its .sig when there is one.
|
|
one() {
|
|
local dir="$1" glob="$2" kind="$3" found=()
|
|
shopt -s nullglob
|
|
found=("$dir"/$glob)
|
|
shopt -u nullglob
|
|
[ "${#found[@]}" -eq 1 ] || { echo "::error::$dir holds ${#found[@]} files matching $glob, not one: ${found[*]:-none}" >&2; exit 1; }
|
|
cp "${found[0]}" "$OUT/$NAME.$kind"
|
|
sha "$NAME.$kind"
|
|
if [ -f "${found[0]}.sig" ]; then
|
|
cp "${found[0]}.sig" "$OUT/$NAME.$kind.sig"
|
|
fi
|
|
echo "collected $OUT/$NAME.$kind ($(cut -d' ' -f1 "$OUT/$NAME.$kind.sha256"))$([ -f "$OUT/$NAME.$kind.sig" ] && echo ', signed for updates')"
|
|
}
|
|
case "$TRIPLE" in
|
|
*-apple-darwin)
|
|
one "$B/dmg" '*.dmg' dmg
|
|
# The app itself, as an update installs it: made only when the build is signed for updates.
|
|
if compgen -G "$B/macos/*.app.tar.gz" > /dev/null; then one "$B/macos" '*.app.tar.gz' app.tar.gz; fi ;;
|
|
*-linux-gnu)
|
|
one "$B/appimage" '*.AppImage' AppImage
|
|
one "$B/deb" '*.deb' deb
|
|
one "$B/rpm" '*.rpm' rpm ;;
|
|
*) echo "::error::release/collect.sh does not collect $TRIPLE" >&2; exit 2 ;;
|
|
esac
|