Skip to content

Commit 44e52ae

Browse files
felixriesebergfelixrieseberg
authored
Merge pull request #158 from felixrieseberg/claude/reverent-margulis-bc27e8
Modernize build tooling
2 parents 6b84c60 + 708aa26 commit 44e52ae

32 files changed

Lines changed: 9233 additions & 3333 deletions

‎.github/workflows/build.yml‎

Lines changed: 32 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -10,42 +10,34 @@ on:
1010

1111
jobs:
1212
lint:
13-
runs-on: ubuntu-20.04
13+
runs-on: ubuntu-latest
1414
steps:
15-
- uses: actions/checkout@v3
15+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1616
- name: Setup Node.js
17-
uses: actions/setup-node@v3
17+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
1818
with:
19-
node-version: lts/*
20-
- name: Get yarn cache directory path
21-
id: yarn-cache-dir-path
22-
run: echo "::set-output name=dir::$(yarn cache dir)"
23-
- uses: actions/cache@v3
24-
id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
25-
with:
26-
path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
27-
key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
28-
restore-keys: |
29-
${{ runner.os }}-yarn-
19+
node-version: 20.x
20+
cache: npm
3021
- name: Install
31-
run: yarn --frozen-lockfile
22+
run: npm ci
3223
- name: lint
33-
run: yarn lint
24+
run: npm run lint
3425
build:
3526
needs: lint
3627
name: Build (${{ matrix.os }} - ${{ matrix.arch }})
3728
runs-on: ${{ matrix.os }}
3829
strategy:
30+
fail-fast: false
3931
matrix:
4032
# Build for supported platforms
4133
# https://github.com/electron/electron-packager/blob/ebcbd439ff3e0f6f92fa880ff28a8670a9bcf2ab/src/targets.js#L9
4234
# 32-bit Linux unsupported as of 2019: https://www.electronjs.org/blog/linux-32bit-support
43-
os: [ macOS-latest, ubuntu-20.04, windows-latest ]
35+
os: [ macOS-latest, ubuntu-latest, windows-latest ]
4436
arch: [ x64, arm64 ]
4537
include:
4638
- os: windows-latest
4739
arch: ia32
48-
- os: ubuntu-20.04
40+
- os: ubuntu-latest
4941
arch: armv7l
5042
# Publishing artifacts for multiple Windows architectures has
5143
# a bug which can cause the wrong architecture to be downloaded
@@ -55,36 +47,26 @@ jobs:
5547
arch: arm64
5648

5749
steps:
58-
- uses: actions/checkout@v3
50+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5951
- name: Setup Node.js
60-
uses: actions/setup-node@v3
61-
with:
62-
node-version: lts/*
63-
- name: Get yarn cache directory path
64-
id: yarn-cache-dir-path
65-
run: echo "::set-output name=dir::$(yarn cache dir)"
66-
- uses: actions/cache@v3
67-
if: matrix.os != 'macOS-latest'
68-
id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
52+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
6953
with:
70-
path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
71-
key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
72-
restore-keys: |
73-
${{ runner.os }}-yarn-
54+
node-version: 20.x
55+
cache: npm
7456
- name: Set MacOS signing certs
7557
if: matrix.os == 'macOS-latest'
7658
run: chmod +x tools/add-macos-cert.sh && ./tools/add-macos-cert.sh
7759
env:
7860
MACOS_CERT_P12: ${{ secrets.MACOS_CERT_P12 }}
7961
MACOS_CERT_PASSWORD: ${{ secrets.MACOS_CERT_PASSWORD }}
80-
- name: Set Windows signing certificate
81-
if: matrix.os == 'windows-latest'
82-
continue-on-error: true
83-
id: write_file
84-
uses: timheuer/base64-to-file@v1
85-
with:
86-
fileName: 'win-certificate.pfx'
87-
encodedString: ${{ secrets.WINDOWS_CODESIGN_P12 }}
62+
- name: Set up Azure Trusted Signing
63+
if: matrix.os == 'windows-latest' && startsWith(github.ref, 'refs/tags/')
64+
shell: pwsh
65+
run: |
66+
nuget install Microsoft.Trusted.Signing.Client -Version 1.0.60 -OutputDirectory . -NonInteractive
67+
$signtool = Get-ChildItem -Path "C:\Program Files (x86)\Windows Kits\10\bin" -Recurse -Filter signtool.exe | Where-Object { $_.FullName -like "*\x64\*" } | Sort-Object FullName -Descending | Select-Object -First 1
68+
echo "SIGNTOOL_PATH=$($signtool.FullName)" >> $env:GITHUB_ENV
69+
echo "AZURE_CODE_SIGNING_DLIB=$((Resolve-Path 'Microsoft.Trusted.Signing.Client.1.0.60/bin/x64/Azure.CodeSigning.Dlib.dll').Path)" >> $env:GITHUB_ENV
8870
- name: Download disk image (ps1)
8971
run: tools/download-disk.ps1
9072
if: matrix.os == 'windows-latest' && startsWith(github.ref, 'refs/tags/')
@@ -96,22 +78,21 @@ jobs:
9678
env:
9779
DISK_URL: ${{ secrets.DISK_URL }}
9880
- name: Install
99-
run: yarn
81+
run: npm ci
10082
- name: Make
10183
if: startsWith(github.ref, 'refs/tags/')
102-
run: yarn make --arch=${{ matrix.arch }}
84+
run: npm run make -- --arch=${{ matrix.arch }}
10385
env:
10486
APPLE_ID: ${{ secrets.APPLE_ID }}
10587
APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
106-
WINDOWS_CODESIGN_FILE: ${{ steps.write_file.outputs.filePath }}
107-
WINDOWS_CODESIGN_PASSWORD: ${{ secrets.WINDOWS_CODESIGN_PASSWORD }}
108-
# - name: Archive production artifacts
109-
# uses: actions/upload-artifact@v2
110-
# with:
111-
# name: ${{ matrix.os }}
112-
# path: out/make/**/*
88+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
89+
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
90+
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
91+
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
92+
AZURE_CODE_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_CODE_SIGNING_ACCOUNT_NAME }}
93+
AZURE_CODE_SIGNING_CERTIFICATE_PROFILE_NAME: ${{ secrets.AZURE_CODE_SIGNING_CERTIFICATE_PROFILE_NAME }}
11394
- name: Release
114-
uses: softprops/action-gh-release@v1
95+
uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
11596
if: startsWith(github.ref, 'refs/tags/')
11697
env:
11798
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -122,4 +103,4 @@ jobs:
122103
out/**/*.dmg
123104
out/**/*setup*.exe
124105
out/**/*.rpm
125-
out/**/*.zip
106+
out/**/*.zip

‎.gitignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,11 @@ typings/
8787

8888
# Electron-Forge
8989
out/
90+
dist/
91+
92+
# Windows signing
93+
Microsoft.Trusted.Signing.Client*/
94+
trusted-signing-metadata.json
9095

9196
# Custom stuff
9297
src/basilisk/user_files

‎forge.config.js‎

Lines changed: 53 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,41 @@ const path = require('path');
22
const fs = require('fs');
33
const package = require('./package.json');
44

5-
if (process.env['WINDOWS_CODESIGN_FILE']) {
6-
const certPath = path.join(__dirname, 'win-certificate.pfx');
7-
const certExists = fs.existsSync(certPath);
5+
require('dotenv').config()
86

9-
if (certExists) {
10-
process.env['WINDOWS_CODESIGN_FILE'] = certPath;
11-
}
7+
const FLAGS = {
8+
SIGNTOOL_PATH: process.env.SIGNTOOL_PATH,
9+
AZURE_CODE_SIGNING_DLIB: process.env.AZURE_CODE_SIGNING_DLIB || path.join(__dirname, 'Microsoft.Trusted.Signing.Client.1.0.60/bin/x64/Azure.CodeSigning.Dlib.dll'),
10+
AZURE_METADATA_JSON: process.env.AZURE_METADATA_JSON || path.resolve(__dirname, 'trusted-signing-metadata.json'),
11+
AZURE_TENANT_ID: process.env.AZURE_TENANT_ID,
12+
AZURE_CLIENT_ID: process.env.AZURE_CLIENT_ID,
13+
AZURE_CLIENT_SECRET: process.env.AZURE_CLIENT_SECRET,
14+
APPLE_ID: process.env.APPLE_ID,
15+
APPLE_ID_PASSWORD: process.env.APPLE_ID_PASSWORD,
16+
}
17+
18+
let windowsSign;
19+
if (FLAGS.AZURE_TENANT_ID && FLAGS.SIGNTOOL_PATH) {
20+
fs.writeFileSync(FLAGS.AZURE_METADATA_JSON, JSON.stringify({
21+
Endpoint: process.env.AZURE_CODE_SIGNING_ENDPOINT || "https://wcus.codesigning.azure.net",
22+
CodeSigningAccountName: process.env.AZURE_CODE_SIGNING_ACCOUNT_NAME,
23+
CertificateProfileName: process.env.AZURE_CODE_SIGNING_CERTIFICATE_PROFILE_NAME,
24+
}, null, 2));
25+
26+
windowsSign = {
27+
signToolPath: FLAGS.SIGNTOOL_PATH,
28+
signWithParams: `/v /dlib ${FLAGS.AZURE_CODE_SIGNING_DLIB} /dmdf ${FLAGS.AZURE_METADATA_JSON}`,
29+
timestampServer: "http://timestamp.acs.microsoft.com",
30+
hashes: ["sha256"],
31+
};
32+
} else {
33+
console.warn('AZURE_TENANT_ID / SIGNTOOL_PATH not set; Windows binaries will not be signed');
1234
}
1335

1436
module.exports = {
37+
hooks: {
38+
generateAssets: require('./tools/generateAssets'),
39+
},
1540
packagerConfig: {
1641
asar: false,
1742
icon: path.resolve(__dirname, 'assets', 'icon'),
@@ -23,31 +48,38 @@ module.exports = {
2348
},
2449
osxSign: {
2550
identity: 'Developer ID Application: Felix Rieseberg (LT94ZKYDCJ)',
26-
'hardened-runtime': true,
27-
'gatekeeper-assess': false,
28-
'entitlements': 'assets/entitlements.plist',
29-
'entitlements-inherit': 'assets/entitlements.plist',
30-
'signature-flags': 'library'
3151
},
3252
osxNotarize: {
33-
appBundleId: 'com.felixrieseberg.macintoshjs',
34-
appleId: process.env['APPLE_ID'],
35-
appleIdPassword: process.env['APPLE_ID_PASSWORD'],
36-
ascProvider: 'LT94ZKYDCJ'
53+
appleId: FLAGS.APPLE_ID,
54+
appleIdPassword: FLAGS.APPLE_ID_PASSWORD,
55+
teamId: 'LT94ZKYDCJ'
3756
},
57+
windowsSign,
3858
ignore: [
39-
/\/github(\/?)/,
4059
/\/assets(\/?)/,
4160
/\/docs(\/?)/,
4261
/\/tools(\/?)/,
62+
/^\/src\/main(\/?)/,
4363
/\/src\/basilisk\/user_files(\/?)/,
64+
/\/patches(\/?)/,
65+
/\/@types(\/?)/,
66+
/^\/\.env/,
4467
/package-lock\.json/,
68+
/yarn\.lock/,
4569
/README\.md/,
4670
/CREDITS\.md/,
71+
/tsconfig\.json/,
4772
/issue_template\.md/,
4873
/HELP\.md/,
74+
/forge\.config\.js/,
75+
/\.github(\/?)/,
76+
/\.vscode(\/?)/,
77+
/\.gitignore/,
78+
/\.gitattributes/,
4979
/win-certificate\.pfx/,
50-
/user_image_.*/
80+
/user_image_.*/,
81+
/\/Microsoft\.Trusted\.Signing\.Client.*/,
82+
/\/trusted-signing-metadata/,
5183
]
5284
},
5385
makers: [
@@ -61,11 +93,11 @@ module.exports = {
6193
exe: 'macintosh.js.exe',
6294
noMsi: true,
6395
remoteReleases: '',
96+
iconUrl: 'https://raw.githubusercontent.com/felixrieseberg/macintosh.js/master/assets/icon.ico',
97+
loadingGif: './assets/loadingGif.gif',
6498
setupExe: `macintoshjs-${package.version}-setup-${arch}.exe`,
6599
setupIcon: path.resolve(__dirname, 'assets', 'icon.ico'),
66-
certificateFile: process.env['WINDOWS_CODESIGN_FILE'],
67-
certificatePassword: process.env['WINDOWS_CODESIGN_PASSWORD'],
68-
loadingGif: './assets/loadingGif.gif',
100+
windowsSign
69101
}
70102
}
71103
},
@@ -75,32 +107,11 @@ module.exports = {
75107
},
76108
{
77109
name: '@electron-forge/maker-deb',
78-
platforms: ['linux'],
79-
options: {
80-
maintainer: 'Felix Rieseberg',
81-
homepage: 'https://github.com/felixrieseberg/macintosh.js',
82-
categories: [
83-
'Education',
84-
],
85-
icon: path.resolve(__dirname, 'assets', 'icon.png')
86-
}
110+
platforms: ['linux']
87111
},
88112
{
89113
name: '@electron-forge/maker-rpm',
90114
platforms: ['linux']
91115
}
92-
],
93-
publishers: [
94-
{
95-
name: '@electron-forge/publisher-github',
96-
config: {
97-
repository: {
98-
owner: 'felixrieseberg',
99-
name: 'macintosh.js'
100-
},
101-
draft: true,
102-
prerelease: true
103-
}
104-
}
105116
]
106117
};

0 commit comments

Comments
 (0)