KnowNote/.github/workflows/release.yml at develop · tesla-ES/KnowNote · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
name: Release

on:
  push:
    tags:
      - 'v*.*.*'

jobs:
  release:
    runs-on: ${{ matrix.os }}

    strategy:
      matrix:
        os: [macos-latest, windows-latest]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '24'

      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10

      - name: Install dependencies
        run: pnpm install

      - name: Build application
        run: pnpm build

      # macOS 代码签名（可选）
      - name: Import Code Signing Certificate (macOS)
        if: matrix.os == 'macos-latest'
        env:
          CERTIFICATE_P12: ${{ secrets.MACOS_CERTIFICATE }}
          CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
        run: |
          if [ -n "$CERTIFICATE_P12" ]; then
            echo "$CERTIFICATE_P12" | base64 --decode > certificate.p12
            security create-keychain -p actions build.keychain
            security default-keychain -s build.keychain
            security unlock-keychain -p actions build.keychain
            security import certificate.p12 -k build.keychain -P "$CERTIFICATE_PASSWORD" -T /usr/bin/codesign
            security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k actions build.keychain
          fi

      # Windows 代码签名（可选）
      - name: Code Sign (Windows)
        if: matrix.os == 'windows-latest'
        env:
          CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
          CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
        run: |
          if ($env:CERTIFICATE) {
            echo "Windows 代码签名已配置"
          }

      # 构建和发布
      - name: Build & Release (macOS)
        if: matrix.os == 'macos-latest'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: pnpm build:mac --publish always

      - name: Build & Release (Windows)
        if: matrix.os == 'windows-latest'
        timeout-minutes: 30
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: pnpm build:win --publish always