源码快照 @ 2026-09-01 (source-only, 剔除非源码素材)

.github/workflows/desktop-nightly.yml

@@ -0,0 +1,322 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Desktop Nightly
+
+on:
+  workflow_run:
+    workflows:
+      - npm publication
+    types:
+      - completed
+
+permissions:
+  actions: read
+  contents: read
+
+concurrency:
+  group: desktop-nightly
+  cancel-in-progress: false
+
+jobs:
+  identity:
+    if: >-
+      vars.DESKTOP_NIGHTLY_ENABLED == 'true' &&
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.head_branch == 'main' &&
+      github.event.workflow_run.display_title == 'npm nightly publication'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    outputs:
+      source_commit: ${{ github.event.workflow_run.head_sha }}
+      version: ${{ steps.identity.outputs.version }}
+    steps:
+      - name: Reject in-place workflow reruns
+        if: github.run_attempt != 1
+        run: |
+          echo "Desktop Nightly retries require a fresh npm Nightly dispatch" >&2
+          exit 1
+
+      - name: Check out the published Nightly source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          persist-credentials: false
+
+      - name: Require the successful Apache npm Nightly run
+        env:
+          UPSTREAM_REPOSITORY: ${{ github.event.workflow_run.head_repository.full_name }}
+        run: |
+          test "$GITHUB_REPOSITORY" = apache/maka
+          test "$UPSTREAM_REPOSITORY" = apache/maka
+
+      - name: Download the published Nightly version
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: product-nightly-version
+          path: ${{ runner.temp }}/product-nightly-version
+          github-token: ${{ github.token }}
+          repository: ${{ github.repository }}
+          run-id: ${{ github.event.workflow_run.id }}
+
+      - name: Bind Desktop to the exact npm Nightly version
+        id: identity
+        env:
+          VERSION_PATH: ${{ runner.temp }}/product-nightly-version/version.txt
+        run: |
+          node scripts/product-nightly.mjs inspect-version "$VERSION_PATH" "$GITHUB_OUTPUT"
+
+  desktop:
+    needs: identity
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: macos
+            runner: macos-15
+          - platform: windows
+            runner: windows-2025
+    runs-on: ${{ matrix.runner }}
+    environment: nightly
+    timeout-minutes: 75
+    defaults:
+      run:
+        shell: bash
+    env:
+      MAKA_DESKTOP_NIGHTLY_VERSION: ${{ needs.identity.outputs.version }}
+    steps:
+      - name: Reject in-place workflow reruns
+        if: github.run_attempt != 1
+        run: |
+          echo "Desktop Nightly retries require a fresh npm Nightly dispatch" >&2
+          exit 1
+
+      - name: Check out the exact Nightly source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.identity.outputs.source_commit }}
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '24'
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Audit the shipped Desktop dependency closure
+        run: |
+          npm audit --omit=dev --audit-level=moderate
+          node scripts/audit-shipped-dependencies.mjs
+
+      - name: Update stable Rust for native Desktop artifacts
+        run: rustup update stable --no-self-update
+
+      - name: Write the App Store Connect API key
+        if: matrix.platform == 'macos'
+        env:
+          APPLE_API_KEY_CONTENT: ${{ secrets.APPLE_API_KEY }}
+          APPLE_API_KEY_PATH: ${{ runner.temp }}/AuthKey_Maka.p8
+        run: |
+          umask 077
+          printf '%s' "$APPLE_API_KEY_CONTENT" > "$APPLE_API_KEY_PATH"
+
+      - name: Package the signed and notarized macOS Nightly
+        if: matrix.platform == 'macos'
+        env:
+          CSC_LINK: ${{ secrets.CSC_LINK }}
+          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+          APPLE_API_KEY: ${{ runner.temp }}/AuthKey_Maka.p8
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+        run: npm run package:macos-arm64
+
+      - name: Notarize and verify the macOS Nightly
+        if: matrix.platform == 'macos'
+        env:
+          APPLE_API_KEY: ${{ runner.temp }}/AuthKey_Maka.p8
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+          DMG_PATH: apps/desktop/release/Maka-${{ needs.identity.outputs.version }}-mac-arm64.dmg
+        run: |
+          xcrun notarytool submit "$DMG_PATH" \
+            --key "$APPLE_API_KEY" \
+            --key-id "$APPLE_API_KEY_ID" \
+            --issuer "$APPLE_API_ISSUER" \
+            --wait
+          xcrun stapler staple "$DMG_PATH"
+          npm run verify:macos-arm64 -- "$DMG_PATH"
+
+      - name: Package the Windows Nightly
+        if: matrix.platform == 'windows'
+        run: npm run package:windows-x64
+
+      - name: Verify the Windows Nightly
+        if: matrix.platform == 'windows'
+        run: >-
+          npm run verify:windows-x64 --
+          "apps/desktop/release/Maka-${{ needs.identity.outputs.version }}-win-x64.exe"
+
+      - name: Stage the exact Nightly artifacts
+        env:
+          NIGHTLY_VERSION: ${{ needs.identity.outputs.version }}
+          STAGE_DIRECTORY: ${{ runner.temp }}/desktop-nightly
+        run: |
+          mkdir -p "$STAGE_DIRECTORY"
+          if [[ "${{ matrix.platform }}" = macos ]]; then
+            cp -- \
+              "apps/desktop/release/Maka-$NIGHTLY_VERSION-mac-arm64.dmg" \
+              "apps/desktop/release/Maka-$NIGHTLY_VERSION-mac-arm64.zip" \
+              "apps/desktop/release/Maka-$NIGHTLY_VERSION-mac-arm64.zip.blockmap" \
+              apps/desktop/release/dev-mac.yml \
+              "$STAGE_DIRECTORY/"
+          else
+            cp -- \
+              "apps/desktop/release/Maka-$NIGHTLY_VERSION-win-x64.exe" \
+              "apps/desktop/release/Maka-$NIGHTLY_VERSION-win-x64.exe.blockmap" \
+              "apps/desktop/release/Maka-$NIGHTLY_VERSION-win-x64.zip" \
+              apps/desktop/release/dev.yml \
+              "$STAGE_DIRECTORY/"
+          fi
+
+      - name: Preserve the verified Nightly artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: desktop-nightly-${{ matrix.platform }}
+          path: ${{ runner.temp }}/desktop-nightly
+          if-no-files-found: error
+          compression-level: 0
+          retention-days: 30
+
+  publish:
+    needs: [identity, desktop]
+    runs-on: ubuntu-24.04
+    environment: nightly
+    timeout-minutes: 20
+    permissions:
+      artifact-metadata: write
+      attestations: write
+      contents: write
+      id-token: write
+    steps:
+      - name: Reject in-place workflow reruns
+        if: github.run_attempt != 1
+        run: |
+          echo "Desktop Nightly retries require a fresh npm Nightly dispatch" >&2
+          exit 1
+
+      - name: Check out the Nightly publisher
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.identity.outputs.source_commit }}
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '24'
+          cache: npm
+
+      - name: Install publisher dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Download both verified Desktop builds
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: desktop-nightly-*
+          path: ${{ github.workspace }}/.nightly-input
+          merge-multiple: true
+
+      - name: Stage the exact GitHub Release assets
+        env:
+          NIGHTLY_VERSION: ${{ needs.identity.outputs.version }}
+        run: |
+          node scripts/desktop-nightly.mjs stage \
+            "$GITHUB_WORKSPACE/.nightly-input" \
+            "$GITHUB_WORKSPACE/.nightly-stage" \
+            "$NIGHTLY_VERSION"
+
+      - name: Attest every GitHub Nightly asset subject
+        id: attest
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: ${{ github.workspace }}/.nightly-stage/release/*
+
+      - name: Verify the issued Nightly provenance
+        env:
+          ATTESTATION_BUNDLE: ${{ steps.attest.outputs.bundle-path }}
+          CERTIFICATE_IDENTITY: https://github.com/${{ github.repository }}/.github/workflows/desktop-nightly.yml@refs/heads/main
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          verified=0
+          while IFS= read -r -d '' artifact; do
+            gh attestation verify "$artifact" \
+              --bundle "$ATTESTATION_BUNDLE" \
+              --repo "$GITHUB_REPOSITORY" \
+              --cert-identity "$CERTIFICATE_IDENTITY" \
+              --cert-oidc-issuer https://token.actions.githubusercontent.com
+            verified=$((verified + 1))
+          done < <(find "$GITHUB_WORKSPACE/.nightly-stage/release" -maxdepth 1 -type f -print0)
+          if (( verified != 8 )); then
+            echo "Expected 8 verified Desktop Nightly subjects, found $verified" >&2
+            exit 1
+          fi
+
+      - name: Add the one offline provenance bundle
+        env:
+          ATTESTATION_BUNDLE: ${{ steps.attest.outputs.bundle-path }}
+          NIGHTLY_VERSION: ${{ needs.identity.outputs.version }}
+        run: |
+          node scripts/desktop-nightly.mjs add-attestation \
+            "$GITHUB_WORKSPACE/.nightly-stage" \
+            "$NIGHTLY_VERSION" \
+            "$ATTESTATION_BUNDLE"
+
+      - name: Ensure the exact versioned Nightly tag
+        env:
+          GH_TOKEN: ${{ github.token }}
+          NIGHTLY_VERSION: ${{ needs.identity.outputs.version }}
+          SOURCE_COMMIT: ${{ needs.identity.outputs.source_commit }}
+        run: |
+          gh auth setup-git
+          node scripts/product-release-tag.mjs ensure "v$NIGHTLY_VERSION" "$SOURCE_COMMIT"
+
+      - name: Prepare and verify the draft GitHub Prerelease
+        env:
+          GH_TOKEN: ${{ github.token }}
+          NIGHTLY_VERSION: ${{ needs.identity.outputs.version }}
+          SOURCE_COMMIT: ${{ needs.identity.outputs.source_commit }}
+        run: |
+          node scripts/desktop-nightly-release.mjs prepare \
+            "$GITHUB_WORKSPACE/.nightly-stage/release" \
+            "$NIGHTLY_VERSION" \
+            "$SOURCE_COMMIT" \
+            "$GITHUB_REPOSITORY"
+
+      - name: Publish the complete GitHub Prerelease
+        env:
+          GH_TOKEN: ${{ github.token }}
+          NIGHTLY_VERSION: ${{ needs.identity.outputs.version }}
+          SOURCE_COMMIT: ${{ needs.identity.outputs.source_commit }}
+        run: |
+          node scripts/desktop-nightly-release.mjs publish \
+            "$GITHUB_WORKSPACE/.nightly-stage/release" \
+            "$NIGHTLY_VERSION" \
+            "$SOURCE_COMMIT" \
+            "$GITHUB_REPOSITORY"