# Licensed to the Apache Software Foundation (ASF) under one # or more contributor license agreements. See the NOTICE file # distributed with this work for additional information # regarding copyright ownership. The ASF licenses this file # to you under the Apache License, Version 2.0 (the # "License"); you may not use this file except in compliance # with the License. You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, # software distributed under the License is distributed on an # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY # KIND, either express or implied. See the License for the # specific language governing permissions and limitations # under the License. name: Desktop Nightly on: workflow_run: workflows: - npm publication types: - completed permissions: actions: read contents: read concurrency: group: desktop-nightly cancel-in-progress: false jobs: identity: if: >- vars.DESKTOP_NIGHTLY_ENABLED == 'true' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main' && github.event.workflow_run.display_title == 'npm nightly publication' runs-on: ubuntu-24.04 timeout-minutes: 10 outputs: source_commit: ${{ github.event.workflow_run.head_sha }} version: ${{ steps.identity.outputs.version }} steps: - name: Reject in-place workflow reruns if: github.run_attempt != 1 run: | echo "Desktop Nightly retries require a fresh npm Nightly dispatch" >&2 exit 1 - name: Check out the published Nightly source uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.workflow_run.head_sha }} persist-credentials: false - name: Require the successful Apache npm Nightly run env: UPSTREAM_REPOSITORY: ${{ github.event.workflow_run.head_repository.full_name }} run: | test "$GITHUB_REPOSITORY" = apache/maka test "$UPSTREAM_REPOSITORY" = apache/maka - name: Download the published Nightly version uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: product-nightly-version path: ${{ runner.temp }}/product-nightly-version github-token: ${{ github.token }} repository: ${{ github.repository }} run-id: ${{ github.event.workflow_run.id }} - name: Bind Desktop to the exact npm Nightly version id: identity env: VERSION_PATH: ${{ runner.temp }}/product-nightly-version/version.txt run: | node scripts/product-nightly.mjs inspect-version "$VERSION_PATH" "$GITHUB_OUTPUT" desktop: needs: identity strategy: fail-fast: false matrix: include: - platform: macos runner: macos-15 - platform: windows runner: windows-2025 runs-on: ${{ matrix.runner }} environment: nightly timeout-minutes: 75 defaults: run: shell: bash env: MAKA_DESKTOP_NIGHTLY_VERSION: ${{ needs.identity.outputs.version }} steps: - name: Reject in-place workflow reruns if: github.run_attempt != 1 run: | echo "Desktop Nightly retries require a fresh npm Nightly dispatch" >&2 exit 1 - name: Check out the exact Nightly source uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.identity.outputs.source_commit }} persist-credentials: false - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24' cache: npm - name: Install dependencies run: npm ci - name: Audit the shipped Desktop dependency closure run: | npm audit --omit=dev --audit-level=moderate node scripts/audit-shipped-dependencies.mjs - name: Update stable Rust for native Desktop artifacts run: rustup update stable --no-self-update - name: Write the App Store Connect API key if: matrix.platform == 'macos' env: APPLE_API_KEY_CONTENT: ${{ secrets.APPLE_API_KEY }} APPLE_API_KEY_PATH: ${{ runner.temp }}/AuthKey_Maka.p8 run: | umask 077 printf '%s' "$APPLE_API_KEY_CONTENT" > "$APPLE_API_KEY_PATH" - name: Package the signed and notarized macOS Nightly if: matrix.platform == 'macos' env: CSC_LINK: ${{ secrets.CSC_LINK }} CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }} APPLE_API_KEY: ${{ runner.temp }}/AuthKey_Maka.p8 APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }} run: npm run package:macos-arm64 - name: Notarize and verify the macOS Nightly if: matrix.platform == 'macos' env: APPLE_API_KEY: ${{ runner.temp }}/AuthKey_Maka.p8 APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }} DMG_PATH: apps/desktop/release/Maka-${{ needs.identity.outputs.version }}-mac-arm64.dmg run: | xcrun notarytool submit "$DMG_PATH" \ --key "$APPLE_API_KEY" \ --key-id "$APPLE_API_KEY_ID" \ --issuer "$APPLE_API_ISSUER" \ --wait xcrun stapler staple "$DMG_PATH" npm run verify:macos-arm64 -- "$DMG_PATH" - name: Package the Windows Nightly if: matrix.platform == 'windows' run: npm run package:windows-x64 - name: Verify the Windows Nightly if: matrix.platform == 'windows' run: >- npm run verify:windows-x64 -- "apps/desktop/release/Maka-${{ needs.identity.outputs.version }}-win-x64.exe" - name: Stage the exact Nightly artifacts env: NIGHTLY_VERSION: ${{ needs.identity.outputs.version }} STAGE_DIRECTORY: ${{ runner.temp }}/desktop-nightly run: | mkdir -p "$STAGE_DIRECTORY" if [[ "${{ matrix.platform }}" = macos ]]; then cp -- \ "apps/desktop/release/Maka-$NIGHTLY_VERSION-mac-arm64.dmg" \ "apps/desktop/release/Maka-$NIGHTLY_VERSION-mac-arm64.zip" \ "apps/desktop/release/Maka-$NIGHTLY_VERSION-mac-arm64.zip.blockmap" \ apps/desktop/release/dev-mac.yml \ "$STAGE_DIRECTORY/" else cp -- \ "apps/desktop/release/Maka-$NIGHTLY_VERSION-win-x64.exe" \ "apps/desktop/release/Maka-$NIGHTLY_VERSION-win-x64.exe.blockmap" \ "apps/desktop/release/Maka-$NIGHTLY_VERSION-win-x64.zip" \ apps/desktop/release/dev.yml \ "$STAGE_DIRECTORY/" fi - name: Preserve the verified Nightly artifacts uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: desktop-nightly-${{ matrix.platform }} path: ${{ runner.temp }}/desktop-nightly if-no-files-found: error compression-level: 0 retention-days: 30 publish: needs: [identity, desktop] runs-on: ubuntu-24.04 environment: nightly timeout-minutes: 20 permissions: artifact-metadata: write attestations: write contents: write id-token: write steps: - name: Reject in-place workflow reruns if: github.run_attempt != 1 run: | echo "Desktop Nightly retries require a fresh npm Nightly dispatch" >&2 exit 1 - name: Check out the Nightly publisher uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.identity.outputs.source_commit }} persist-credentials: false - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24' cache: npm - name: Install publisher dependencies run: npm ci --ignore-scripts - name: Download both verified Desktop builds uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: desktop-nightly-* path: ${{ github.workspace }}/.nightly-input merge-multiple: true - name: Stage the exact GitHub Release assets env: NIGHTLY_VERSION: ${{ needs.identity.outputs.version }} run: | node scripts/desktop-nightly.mjs stage \ "$GITHUB_WORKSPACE/.nightly-input" \ "$GITHUB_WORKSPACE/.nightly-stage" \ "$NIGHTLY_VERSION" - name: Attest every GitHub Nightly asset subject id: attest uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 with: subject-path: ${{ github.workspace }}/.nightly-stage/release/* - name: Verify the issued Nightly provenance env: ATTESTATION_BUNDLE: ${{ steps.attest.outputs.bundle-path }} CERTIFICATE_IDENTITY: https://github.com/${{ github.repository }}/.github/workflows/desktop-nightly.yml@refs/heads/main GH_TOKEN: ${{ github.token }} run: | verified=0 while IFS= read -r -d '' artifact; do gh attestation verify "$artifact" \ --bundle "$ATTESTATION_BUNDLE" \ --repo "$GITHUB_REPOSITORY" \ --cert-identity "$CERTIFICATE_IDENTITY" \ --cert-oidc-issuer https://token.actions.githubusercontent.com verified=$((verified + 1)) done < <(find "$GITHUB_WORKSPACE/.nightly-stage/release" -maxdepth 1 -type f -print0) if (( verified != 8 )); then echo "Expected 8 verified Desktop Nightly subjects, found $verified" >&2 exit 1 fi - name: Add the one offline provenance bundle env: ATTESTATION_BUNDLE: ${{ steps.attest.outputs.bundle-path }} NIGHTLY_VERSION: ${{ needs.identity.outputs.version }} run: | node scripts/desktop-nightly.mjs add-attestation \ "$GITHUB_WORKSPACE/.nightly-stage" \ "$NIGHTLY_VERSION" \ "$ATTESTATION_BUNDLE" - name: Ensure the exact versioned Nightly tag env: GH_TOKEN: ${{ github.token }} NIGHTLY_VERSION: ${{ needs.identity.outputs.version }} SOURCE_COMMIT: ${{ needs.identity.outputs.source_commit }} run: | gh auth setup-git node scripts/product-release-tag.mjs ensure "v$NIGHTLY_VERSION" "$SOURCE_COMMIT" - name: Prepare and verify the draft GitHub Prerelease env: GH_TOKEN: ${{ github.token }} NIGHTLY_VERSION: ${{ needs.identity.outputs.version }} SOURCE_COMMIT: ${{ needs.identity.outputs.source_commit }} run: | node scripts/desktop-nightly-release.mjs prepare \ "$GITHUB_WORKSPACE/.nightly-stage/release" \ "$NIGHTLY_VERSION" \ "$SOURCE_COMMIT" \ "$GITHUB_REPOSITORY" - name: Publish the complete GitHub Prerelease env: GH_TOKEN: ${{ github.token }} NIGHTLY_VERSION: ${{ needs.identity.outputs.version }} SOURCE_COMMIT: ${{ needs.identity.outputs.source_commit }} run: | node scripts/desktop-nightly-release.mjs publish \ "$GITHUB_WORKSPACE/.nightly-stage/release" \ "$NIGHTLY_VERSION" \ "$SOURCE_COMMIT" \ "$GITHUB_REPOSITORY"