[pull] main from pingdotgg:main #146
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Desktop macOS Preview | |
| # Untrusted half of the macOS preview. This runs PR code (including fork PRs) | |
| # with a read-only token and no secrets, and only produces the JS bundle. The | |
| # trusted half, desktop-macos-preview-publish.yml, runs on workflow_run from | |
| # main, verifies the PR author is vouched, then packages, signs, notarizes, and | |
| # publishes the bundle without ever executing it. | |
| # | |
| # The label is a one-shot request for the commit it was applied to, not a | |
| # standing subscription: the trusted half removes it once this run completes, | |
| # and later pushes do not build until a maintainer applies it again. Each | |
| # signed preview is therefore an explicit per-commit decision. | |
| # | |
| # Closing the PR is handled by the publish workflow too, since deleting the | |
| # download needs a write token. | |
| on: | |
| pull_request: | |
| types: [labeled] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: desktop-macos-preview-${{ github.event.pull_request.number }} | |
| # Adding an unrelated label skips the job and must not cancel a build. | |
| cancel-in-progress: ${{ github.event.label.name == 'preview:mac' }} | |
| jobs: | |
| build: | |
| name: Build preview JS bundle | |
| if: github.event.label.name == 'preview:mac' | |
| runs-on: blacksmith-32vcpu-ubuntu-2404 | |
| timeout-minutes: 30 | |
| steps: | |
| # This repository is public, so Git needs no credentials. checkout's | |
| # credential cleanup runs submodule foreach even with submodules disabled, | |
| # which fails on the orphaned gitlinks in our vendored .repos tree. | |
| - name: Checkout | |
| shell: bash | |
| env: | |
| CHECKOUT_REF: ${{ github.event.pull_request.head.sha }} | |
| GIT_TERMINAL_PROMPT: "0" | |
| run: | | |
| set -euo pipefail | |
| git init . | |
| git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" | |
| git fetch --no-tags --depth=1 origin "$CHECKOUT_REF" | |
| git sparse-checkout set --no-cone '/*' '!/.repos/' | |
| git checkout --detach FETCH_HEAD | |
| - name: Setup Vite+ | |
| uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1 | |
| with: | |
| node-version-file: package.json | |
| cache: true | |
| run-install: false | |
| - name: Install bundle dependencies | |
| run: vp install --filter=t3... --filter=@t3tools/web... --filter=@t3tools/desktop... --filter=@t3tools/scripts... | |
| # The publish workflow derives the same version from this run's number, | |
| # so the version baked into the bundle matches the packaged app. | |
| - name: Set preview version and public configuration | |
| shell: bash | |
| env: | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| run: | | |
| set -euo pipefail | |
| base_version="$(node -p "require('./apps/desktop/package.json').version")" | |
| node scripts/update-release-package-versions.ts "${base_version}-pr.${PR_NUMBER}.${GITHUB_RUN_NUMBER}" | |
| # Public T3 Connect identifiers (Clerk publishable key, relay URL). | |
| cp .env.example .env | |
| - uses: ./.github/actions/setup-apt-mirrors | |
| - name: Install browser secret helper build libraries | |
| run: sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config | |
| - name: Build JS bundle | |
| run: vp run build:desktop | |
| # Same layout as release.yml's js-bundle so release-desktop.yml can | |
| # package it unchanged. | |
| - name: Upload JS bundle | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: js-bundle | |
| path: | | |
| apps/server/dist | |
| apps/desktop/dist-electron | |
| if-no-files-found: error | |
| retention-days: 1 |