FlowyLabs/llink
1
0
Fork 0
Code Issues 71 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

ci: setup windows with signing and gcs publish

Browse Source
This commit is contained in:
talksik
2026-04-15 10:04:29 -07:00
parent 07f02ecfeb
commit dd8e7da911
3 changed files with 275 additions and 255 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build-windows.yml
+78 -53
View File
@@ -1,53 +1,78 @@
# Phase 1: build unsigned Windows installers on demand, upload as run artifacts. name: Build Windows
#
# To graduate to Phase 2 (signed + published to GCS): on:
# 1. Add GCP auth step (`google-github-actions/auth@v2` via WIF) + `setup-gcloud`. workflow_dispatch:
# Swap `yarn make:win` for a new `yarn release:win` script that runs
# `electron-forge publish` per arch and a gsutil cache-control step. permissions:
# 2. Add an Azure Trusted Signing setup step that downloads the # Azure Trusted Signing uses OIDC federated credentials from GitHub.
# Microsoft.Trusted.Signing.Client dlib and writes a metadata JSON file, id-token: write
# then exports AZURE_DLIB_PATH + AZURE_METADATA_JSON_PATH. Set contents: read
# AZURE_TENANT_ID / AZURE_CLIENT_ID / AZURE_CLIENT_SECRET from secrets.
# The dormant `windowsSign` branch in js/forge.config.ts activates jobs:
# automatically once AZURE_METADATA_JSON_PATH is set. build:
runs-on: windows-latest
name: Build Windows defaults:
run:
on: working-directory: js
workflow_dispatch: env:
APP_ENV: prod
jobs: AZURE_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
build: AZURE_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
runs-on: windows-latest
defaults: steps:
run: - uses: actions/checkout@v4
working-directory: js
env: - name: Enable corepack
APP_ENV: prod run: corepack enable
shell: pwsh
steps: working-directory: .
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
- name: Enable corepack with:
run: corepack enable node-version: 20
shell: pwsh cache: yarn
working-directory: . cache-dependency-path: js/yarn.lock
- uses: actions/setup-node@v4 - name: Install dependencies
with: run: yarn install --frozen-lockfile --network-timeout 600000
node-version: 20
cache: yarn - name: Azure login (OIDC)
cache-dependency-path: js/yarn.lock uses: azure/login@v2
with:
- name: Install dependencies tenant-id: ${{ vars.AZURE_TENANT_ID }}
run: yarn install --frozen-lockfile --network-timeout 600000 client-id: ${{ vars.AZURE_CLIENT_ID }}
allow-no-subscriptions: true
- name: Build Windows installers (x64 + arm64, unsigned)
run: yarn make:win - name: Install Trusted Signing client dlib
shell: pwsh
- name: Upload installers working-directory: .
uses: actions/upload-artifact@v4 run: |
with: nuget install Microsoft.Trusted.Signing.Client -Version 1.0.60 -OutputDirectory $env:RUNNER_TEMP\trusted-signing -ExcludeVersion
name: flowy-llink-windows-unsigned $dlib = Join-Path $env:RUNNER_TEMP "trusted-signing\Microsoft.Trusted.Signing.Client\bin\x64\Azure.CodeSigning.Dlib.dll"
path: js/out/make/**/* if (-not (Test-Path $dlib)) { throw "Dlib not found at $dlib" }
if-no-files-found: error "AZURE_DLIB_PATH=$dlib" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
"AZURE_METADATA_JSON_PATH=$env:GITHUB_WORKSPACE\js\build\signing-metadata.json" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
- name: Authenticate to Google Cloud
uses: google-github-actions/auth@v2
with:
credentials_json: ${{ secrets.PROD_GKE_SERVICE_ACCOUNT_KEY }}
- name: Set up gcloud
uses: google-github-actions/setup-gcloud@v2
- name: Publish signed installer (x64)
run: yarn publish:win
- name: Invalidate RELEASES cache
shell: pwsh
working-directory: .
run: gsutil setmeta -h "Cache-Control:no-cache, no-store, must-revalidate" gs://flowy-releases/llink/win32/x64/RELEASES.json
- name: Upload installers (debug artifact)
if: always()
uses: actions/upload-artifact@v4
with:
name: flowy-llink-windows-signed
path: js/out/make/**/*
if-no-files-found: warn
js/forge.config.ts
+115 -121
View File
@@ -1,121 +1,115 @@
import type { ForgeConfig } from '@electron-forge/shared-types'; import type { ForgeConfig } from '@electron-forge/shared-types';
import { MakerSquirrel } from '@electron-forge/maker-squirrel'; import { MakerSquirrel } from '@electron-forge/maker-squirrel';
import { MakerZIP } from '@electron-forge/maker-zip'; import { MakerZIP } from '@electron-forge/maker-zip';
import { MakerDeb } from '@electron-forge/maker-deb'; import { MakerDeb } from '@electron-forge/maker-deb';
import { MakerRpm } from '@electron-forge/maker-rpm'; import { MakerRpm } from '@electron-forge/maker-rpm';
import { VitePlugin } from '@electron-forge/plugin-vite'; import { VitePlugin } from '@electron-forge/plugin-vite';
import { FusesPlugin } from '@electron-forge/plugin-fuses'; import { FusesPlugin } from '@electron-forge/plugin-fuses';
import { FuseV1Options, FuseVersion } from '@electron/fuses'; import { FuseV1Options, FuseVersion } from '@electron/fuses';
const config: ForgeConfig = { const config: ForgeConfig = {
packagerConfig: { packagerConfig: {
asar: true, asar: true,
icon: './assets/flowy', icon: './assets/flowy',
appBundleId: 'live.flowy.llink', appBundleId: 'live.flowy.llink',
protocols: [ protocols: [
{ name: 'llink', schemes: ['llink'] }, { name: 'llink', schemes: ['llink'] },
], ],
extendInfo: { extendInfo: {
NSMicrophoneUsageDescription: 'llink needs microphone access to record audio messages.', NSMicrophoneUsageDescription: 'llink needs microphone access to record audio messages.',
NSCameraUsageDescription: 'llink needs camera access to record video messages.', NSCameraUsageDescription: 'llink needs camera access to record video messages.',
}, },
osxSign: {}, osxSign: {},
osxNotarize: { osxNotarize: {
keychainProfile: 'default', keychainProfile: 'default',
} }
}, },
publishers: [ publishers: [
{ {
name: '@electron-forge/publisher-gcs', name: '@electron-forge/publisher-gcs',
config: { config: {
storageOptions: { storageOptions: {
projectId: 'flowy-prod-440017' projectId: 'flowy-prod-440017'
}, },
bucket: 'flowy-releases', bucket: 'flowy-releases',
folder: 'llink', folder: 'llink',
// NOTE: commented out because we do not want to apply per object ACL which conflicts with uniform bucket-level access that's already public // NOTE: commented out because we do not want to apply per object ACL which conflicts with uniform bucket-level access that's already public
// public: true // public: true
} }
} }
], ],
rebuildConfig: {}, rebuildConfig: {},
makers: [ makers: [
new MakerSquirrel((arch) => ({ new MakerSquirrel((arch) => ({
// `remoteReleases` is only useful when producing delta packages against a remoteReleases: `https://storage.googleapis.com/flowy-releases/llink/win32/${arch}`,
// previously-published build. During a plain `make` (no publish), Squirrel // Windows code signing via Azure Trusted Signing. Dormant unless the workflow
// fetches this URL and fails with a 404 if nothing has been uploaded yet. // provisions the dlib + metadata file and exports these env vars, so local
// Gate it on SQUIRREL_REMOTE_RELEASES=1 which the publish workflow sets. // `yarn make` and unsigned CI builds both work unchanged.
...(process.env.SQUIRREL_REMOTE_RELEASES === '1' ? { windowsSign: process.env.AZURE_METADATA_JSON_PATH ? {
remoteReleases: `https://storage.googleapis.com/flowy-releases/llink/win32/${arch}`, signWithParams: [
} : {}), '/v',
// Windows code signing via Azure Trusted Signing. Dormant unless the workflow '/fd', 'SHA256',
// provisions the dlib + metadata file and exports these env vars, so local '/tr', 'http://timestamp.acs.microsoft.com',
// `yarn make` and unsigned CI builds both work unchanged. '/td', 'SHA256',
windowsSign: process.env.AZURE_METADATA_JSON_PATH ? { '/dlib', process.env.AZURE_DLIB_PATH,
signWithParams: [ '/dmdf', process.env.AZURE_METADATA_JSON_PATH,
'/v', ].join(' '),
'/fd', 'SHA256', } : undefined,
'/tr', 'http://timestamp.acs.microsoft.com', })),
'/td', 'SHA256', new MakerZIP((arch) => ({
'/dlib', process.env.AZURE_DLIB_PATH, macUpdateManifestBaseUrl: `https://storage.googleapis.com/flowy-releases/llink/darwin/${arch}`
'/dmdf', process.env.AZURE_METADATA_JSON_PATH, }), ['darwin']),
].join(' '), new MakerRpm({}),
} : undefined, new MakerDeb({}),
})), ],
new MakerZIP((arch) => ({ plugins: [
macUpdateManifestBaseUrl: `https://storage.googleapis.com/flowy-releases/llink/darwin/${arch}` new VitePlugin({
}), ['darwin']), // `build` can specify multiple entry builds, which can be Main process, Preload scripts, Worker process, etc.
new MakerRpm({}), // If you are familiar with Vite configuration, it will look really familiar.
new MakerDeb({}), build: [
], {
plugins: [ // `entry` is just an alias for `build.lib.entry` in the corresponding file of `config`.
new VitePlugin({ entry: 'src/main.ts',
// `build` can specify multiple entry builds, which can be Main process, Preload scripts, Worker process, etc. config: 'vite.main.config.ts',
// If you are familiar with Vite configuration, it will look really familiar. target: 'main',
build: [ },
{ {
// `entry` is just an alias for `build.lib.entry` in the corresponding file of `config`. entry: 'src/preload.ts',
entry: 'src/main.ts', config: 'vite.preload.config.ts',
config: 'vite.main.config.ts', target: 'preload',
target: 'main', },
}, ],
{ renderer: [
entry: 'src/preload.ts', {
config: 'vite.preload.config.ts', name: 'main_window',
target: 'preload', config: 'vite.renderer.config.mts',
}, },
], {
renderer: [ name: 'autoplay_window',
{ config: 'vite.autoplay.config.mts',
name: 'main_window', },
config: 'vite.renderer.config.mts', {
}, name: 'huddle_window',
{ config: 'vite.huddle.config.mts',
name: 'autoplay_window', },
config: 'vite.autoplay.config.mts', {
}, name: 'screen_record_window',
{ config: 'vite.screen-record.config.mts',
name: 'huddle_window', },
config: 'vite.huddle.config.mts', ],
}, }),
{ // Fuses are used to enable/disable various Electron functionality
name: 'screen_record_window', // at package time, before code signing the application
config: 'vite.screen-record.config.mts', new FusesPlugin({
}, version: FuseVersion.V1,
], [FuseV1Options.RunAsNode]: false,
}), [FuseV1Options.EnableCookieEncryption]: true,
// Fuses are used to enable/disable various Electron functionality [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
// at package time, before code signing the application [FuseV1Options.EnableNodeCliInspectArguments]: false,
new FusesPlugin({ [FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: true,
version: FuseVersion.V1, [FuseV1Options.OnlyLoadAppFromAsar]: true,
[FuseV1Options.RunAsNode]: false, }),
[FuseV1Options.EnableCookieEncryption]: true, ],
[FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false, };
[FuseV1Options.EnableNodeCliInspectArguments]: false,
[FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: true, export default config;
[FuseV1Options.OnlyLoadAppFromAsar]: true,
}),
],
};
export default config;
js/package.json
+82 -81
View File
@@ -1,81 +1,82 @@
{ {
"name": "Flowy.llink", "name": "Flowy.llink",
"productName": "Flowy.llink", "productName": "Flowy.llink",
"version": "1.1.0", "version": "1.1.0",
"description": "Flowy.llink is a team communication app for teams", "description": "Flowy.llink is a team communication app for teams",
"main": ".vite/build/main.js", "main": ".vite/build/main.js",
"private": true, "private": true,
"scripts": { "scripts": {
"start": "electron-forge start", "start": "electron-forge start",
"package": "APP_ENV=prod electron-forge package --arch=arm64 && APP_ENV=prod electron-forge package --arch=x64", "package:mac": "APP_ENV=prod electron-forge package --arch=arm64 && APP_ENV=prod electron-forge package --arch=x64",
"make": "APP_ENV=prod electron-forge make --arch=arm64 && APP_ENV=prod electron-forge make --arch=x64", "make:mac": "APP_ENV=prod electron-forge make --arch=arm64 && APP_ENV=prod electron-forge make --arch=x64",
"make:win": "electron-forge make --platform=win32 --arch=x64 && electron-forge make --platform=win32 --arch=arm64", "make:win": "electron-forge make --platform=win32 --arch=x64",
"release": "echo '\n⚠️ Have you bumped the version in package.json? (current: '$(node -p \"require('./package.json').version\")') [y/N]' && read -r answer && [ \"$answer\" = \"y\" ] && APP_ENV=prod electron-forge publish --arch=arm64 && APP_ENV=prod electron-forge publish --arch=x64 && gsutil setmeta -h 'Cache-Control:no-cache, no-store, must-revalidate' gs://flowy-releases/llink/darwin/arm64/RELEASES.json && gsutil setmeta -h 'Cache-Control:no-cache, no-store, must-revalidate' gs://flowy-releases/llink/darwin/x64/RELEASES.json", "publish:win": "electron-forge publish --platform=win32 --arch=x64",
"invalidate-gcs-cache": "gsutil -h \"Cache-Control:no-cache, no-store, max-age=0\" cp gs://flowy-releases/llink/darwin/arm64/RELEASES.json gs://flowy-releases/llink/darwin/arm64/RELEASES.json ; gsutil -h \"Cache-Control:no-cache, no-store, max-age=0\" cp gs://flowy-releases/llink/darwin/x64/RELEASES.json gs://flowy-releases/llink/darwin/x64/RELEASES.json", "publish:mac": "echo '\n⚠️ Have you bumped the version in package.json? (current: '$(node -p \"require('./package.json').version\")') [y/N]' && read -r answer && [ \"$answer\" = \"y\" ] && APP_ENV=prod electron-forge publish --arch=arm64 && APP_ENV=prod electron-forge publish --arch=x64",
"lint": "eslint --ext .ts,.tsx .", "invalidate-gcs-cache": "gsutil setmeta -h 'Cache-Control:no-cache, no-store, must-revalidate' gs://flowy-releases/llink/darwin/arm64/RELEASES.json && gsutil setmeta -h 'Cache-Control:no-cache, no-store, must-revalidate' gs://flowy-releases/llink/darwin/x64/RELEASES.json && gsutil setmeta -h 'Cache-Control:no-cache, no-store, must-revalidate' gs://flowy-releases/llink/win32/x64/RELEASES.json",
"compile": "npx tsc --noEmit 2>&1 | grep '^src/'" "lint": "eslint --ext .ts,.tsx .",
}, "compile": "npx tsc --noEmit 2>&1 | grep '^src/'"
"keywords": [], },
"author": { "keywords": [],
"name": "talksik", "author": {
"email": "[email protected]" "name": "talksik",
}, "email": "[email protected]"
"license": "MIT", },
"packageManager": "[email protected]", "license": "MIT",
"devDependencies": { "packageManager": "[email protected]",
"@electron-forge/cli": "^7.11.1", "devDependencies": {
"@electron-forge/maker-deb": "^7.11.1", "@electron-forge/cli": "^7.11.1",
"@electron-forge/maker-rpm": "^7.11.1", "@electron-forge/maker-deb": "^7.11.1",
"@electron-forge/maker-squirrel": "^7.11.1", "@electron-forge/maker-rpm": "^7.11.1",
"@electron-forge/maker-zip": "^7.11.1", "@electron-forge/maker-squirrel": "^7.11.1",
"@electron-forge/plugin-auto-unpack-natives": "^7.11.1", "@electron-forge/maker-zip": "^7.11.1",
"@electron-forge/plugin-fuses": "^7.11.1", "@electron-forge/plugin-auto-unpack-natives": "^7.11.1",
"@electron-forge/plugin-vite": "^7.11.1", "@electron-forge/plugin-fuses": "^7.11.1",
"@electron-forge/publisher-gcs": "^7.11.1", "@electron-forge/plugin-vite": "^7.11.1",
"@electron/fuses": "^1.8.0", "@electron-forge/publisher-gcs": "^7.11.1",
"@tailwindcss/vite": "^4.2.0", "@electron/fuses": "^1.8.0",
"@tanstack/eslint-plugin-query": "^5.91.4", "@tailwindcss/vite": "^4.2.0",
"@types/electron-squirrel-startup": "^1.0.2", "@tanstack/eslint-plugin-query": "^5.91.4",
"@types/node": "^25.3.0", "@types/electron-squirrel-startup": "^1.0.2",
"@types/react": "^19.2.14", "@types/node": "^25.3.0",
"@types/react-dom": "^19.2.3", "@types/react": "^19.2.14",
"@typescript-eslint/eslint-plugin": "^5.62.0", "@types/react-dom": "^19.2.3",
"@typescript-eslint/parser": "^5.62.0", "@typescript-eslint/eslint-plugin": "^5.62.0",
"@vitejs/plugin-react": "^5.1.4", "@typescript-eslint/parser": "^5.62.0",
"electron": "40.6.0", "@vitejs/plugin-react": "^5.1.4",
"eslint": "^8.57.1", "electron": "40.6.0",
"eslint-plugin-import": "^2.32.0", "eslint": "^8.57.1",
"eslint-plugin-react-hooks": "^7.0.1", "eslint-plugin-import": "^2.32.0",
"typescript": "^5.9.3", "eslint-plugin-react-hooks": "^7.0.1",
"vite": "^5.4.21" "typescript": "^5.9.3",
}, "vite": "^5.4.21"
"dependencies": { },
"@livekit/components-react": "^2.9.20", "dependencies": {
"@livekit/components-styles": "^1.2.0", "@livekit/components-react": "^2.9.20",
"@tanstack/react-query": "^5.90.21", "@livekit/components-styles": "^1.2.0",
"class-variance-authority": "^0.7.1", "@tanstack/react-query": "^5.90.21",
"clsx": "^2.1.1", "class-variance-authority": "^0.7.1",
"electron-squirrel-startup": "^1.0.1", "clsx": "^2.1.1",
"firebase": "^12.10.0", "electron-squirrel-startup": "^1.0.1",
"highlight.js": "^11.11.1", "firebase": "^12.10.0",
"livekit-client": "^2.18.0", "highlight.js": "^11.11.1",
"lucide-react": "^0.575.0", "livekit-client": "^2.18.0",
"next-themes": "^0.4.6", "lucide-react": "^0.575.0",
"radix-ui": "^1.4.3", "next-themes": "^0.4.6",
"react": "^19.2.4", "radix-ui": "^1.4.3",
"react-dom": "^19.2.4", "react": "^19.2.4",
"react-markdown": "^10.1.0", "react-dom": "^19.2.4",
"react-router-dom": "^7.13.0", "react-markdown": "^10.1.0",
"react-use": "^17.6.0", "react-router-dom": "^7.13.0",
"rehype-highlight": "^7.0.2", "react-use": "^17.6.0",
"remark-gfm": "^4.0.1", "rehype-highlight": "^7.0.2",
"shadcn": "^3.8.5", "remark-gfm": "^4.0.1",
"sonner": "^2.0.7", "shadcn": "^3.8.5",
"tailwind-merge": "^3.5.0", "sonner": "^2.0.7",
"tailwindcss": "^4.2.0", "tailwind-merge": "^3.5.0",
"tw-animate-css": "^1.4.0", "tailwindcss": "^4.2.0",
"update-electron-app": "^3.1.2", "tw-animate-css": "^1.4.0",
"zod": "^4.3.6", "update-electron-app": "^3.1.2",
"zustand": "^5.0.11" "zod": "^4.3.6",
} "zustand": "^5.0.11"
} }
}