33 push :
44 tags :
55 - v*.*.*
6+
67jobs :
78 create-release :
89 name : create-release
@@ -105,12 +106,11 @@ jobs:
105106 apt-get install -y ruby
106107 gem install deb-s3
107108 echo "$(ruby -r rubygems -e 'puts Gem.user_dir')/bin" >> $GITHUB_PATH
108- name : Upload DEB to APT repository
109+ name : Upload DEB to APT repository
109110 run : |
110111 COMPONENT=$([[ "${{ github.ref_name }}" == *"-"* ]] && echo "pre-release" || echo "release") # if tag contain "-" assume it's pre-release.
111112
112113 deb-s3 upload -l --bucket=apt.defguard.net --access-key-id=${{ secrets.AWS_ACCESS_KEY_APT }} --secret-access-key=${{ secrets.AWS_SECRET_KEY_APT }} --s3-region=eu-north-1 --no-fail-if-exists --codename=bookworm --component="$COMPONENT" src-tauri/target/release/bundle/deb/defguard-client_${{ env.VERSION }}_${{ matrix.deb_arch }}.deb
113-
114114
115115build-linux :
116116 needs :
@@ -208,7 +208,6 @@ jobs:
208208name : Upload DEB to APT repository # Add this to ubuntu 22.04 job (on merge dev -> main) with --codename=bookworm
209209 run : |
210210 COMPONENT=$([[ "${{ github.ref_name }}" == *"-"* ]] && echo "pre-release" || echo "release") # if tag contain "-" assume it's pre-release.
211-
212211 deb-s3 upload -l --bucket=apt.defguard.net --access-key-id=${{ secrets.AWS_ACCESS_KEY_APT }} --secret-access-key=${{ secrets.AWS_SECRET_KEY_APT }} --s3-region=eu-north-1 --no-fail-if-exists --codename=trixie --component="$COMPONENT" src-tauri/target/release/bundle/deb/defguard-client_${{ env.VERSION }}_${{ matrix.deb_arch }}.deb
213212name : Rename client binary
214213 run : mv src-tauri/target/release/defguard-client defguard-client-linux-${{ matrix.binary_arch }}-${{ github.ref_name }}
@@ -301,8 +300,6 @@ jobs:
301300 - self-hosted
302301 - Linux
303302 - X64
304- strategy :
305- fail-fast : false
306303 steps :
307304 - name : Sign APT repository
308305 run : |
@@ -314,15 +311,15 @@ jobs:
314311
315312 for DIST in trixie bookworm; do
316313 aws s3 cp s3://apt.defguard.net/dists/${DIST}/Release .
317-
314+
318315 curl -X POST "${{ secrets.DEFGUARD_SIGNING_URL }}?signature_type=both" \
319316 -H "Authorization: Bearer ${{ secrets.DEFGUARD_SIGNING_API_KEY }}" \
320317 -F "file=@Release" \
321318 -o response.json
322-
319+
323320 cat response.json | jq -r '.files["Release.gpg"].content' | base64 --decode > Release.gpg
324321 cat response.json | jq -r '.files.Release.content' | base64 --decode > InRelease
325-
322+
326323 aws s3 cp Release.gpg s3://apt.defguard.net/dists/${DIST}/ --acl public-read
327324 aws s3 cp InRelease s3://apt.defguard.net/dists/${DIST}/ --acl public-read
328325
@@ -398,83 +395,6 @@ jobs:
398395 cat PKGBUILD
399396 cat .SRCINFO
400397
401- build-macos :
402- needs :
403- - create-release
404- strategy :
405- fail-fast : false
406- matrix :
407- target : [aarch64-apple-darwin, x86_64-apple-darwin]
408- runs-on :
409- - self-hosted
410- - macOS
411- env :
412- APPLE_SIGNING_IDENTITY_APPLICATION : " Developer ID Application: defguard sp. z o.o. (82GZ7KN29J)"
413- APPLE_SIGNING_IDENTITY_INSTALLER : " Developer ID Installer: defguard sp. z o.o. (82GZ7KN29J)"
414- APPLE_ID : " kamil@defguard.net"
415- APPLE_TEAM_ID : " 82GZ7KN29J"
416- steps :
417- - uses : actions/checkout@v5
418- with :
419- submodules : " recursive"
420- - name : Write release version
421- run : |
422- VERSION=$(echo ${GITHUB_REF_NAME#v} | cut -d '-' -f1)
423- echo Version: $VERSION
424- echo "VERSION=$VERSION" >> ${GITHUB_ENV}
425- uses : actions/setup-node@v4
426- with :
427- node-version : " 22"
428- - uses : pnpm/action-setup@v4
429- with :
430- version : 10
431- run_install : false
432- - name : Get pnpm store directory
433- shell : bash
434- run : echo "STORE_PATH=$(pnpm store path --silent)" >> ${GITHUB_ENV}
435- - uses : actions/cache@v4
436- name : Setup pnpm cache
437- with :
438- path : ${{ env.STORE_PATH }}
439- key : ${{ runner.os }}-pnpm-build-store-${{ hashFiles('**/pnpm-lock.yaml') }}
440- restore-keys : |
441- ${{ runner.os }}-pnpm-build-store-
442- name : Install deps
443- run : pnpm install --frozen-lockfile
444- - uses : dtolnay/rust-toolchain@stable
445- - name : Install protobuf compiler
446- run : brew install protobuf
447- - name : Install ARM target
448- run : rustup target add aarch64-apple-darwin
449- - name : Unlock keychain
450- run : security -v unlock-keychain -p "${{ secrets.KEYCHAIN_PASSWORD }}" /Users/admin/Library/Keychains/login.keychain
451- - name : Build app
452- uses : tauri-apps/tauri-action@v0.5.23 # .24 seems broken, TODO: update when fixed
453- env :
454- GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
455- APPLE_SIGNING_IDENTITY : ${{ env.APPLE_SIGNING_IDENTITY_APPLICATION }}
456- APPLE_CERTIFICATE : ${{ secrets.APPLE_CERTIFICATE }}
457- APPLE_CERTIFICATE_PASSWORD : ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
458- APPLE_ID : ${{ env.APPLE_ID }}
459- APPLE_PASSWORD : ${{ secrets.NOTARYTOOL_APP_SPECIFIC_PASSWORD }}
460- APPLE_TEAM_ID : ${{ env.APPLE_TEAM_ID }}
461- with :
462- args : --target ${{ matrix.target }} -v
463- - name : Build installation package
464- run : |
465- bash build-macos-package.sh src-tauri/target/${{ matrix.target }} src-tauri/resources-macos/scripts '${{ env.APPLE_SIGNING_IDENTITY_INSTALLER }}' /Users/admin/Library/Keychains/login.keychain
466- xcrun notarytool submit --wait --apple-id ${{ env.APPLE_ID }} --password ${{ secrets.NOTARYTOOL_APP_SPECIFIC_PASSWORD }} --team-id ${{ env.APPLE_TEAM_ID }} src-tauri/target/${{ matrix.target }}/product-signed/defguard.pkg
467- xcrun stapler staple src-tauri/target/${{ matrix.target }}/product-signed/defguard.pkg
468- name : Upload installation package
469- uses : actions/upload-release-asset@v1
470- env :
471- GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
472- with :
473- upload_url : ${{ needs.create-release.outputs.upload_url }}
474- asset_path : src-tauri/target/${{ matrix.target }}/product-signed/defguard.pkg
475- asset_name : defguard-${{ matrix.target }}-${{ env.VERSION }}.pkg
476- asset_content_type : application/octet-stream
477-
478398# Builds Windows MSI and uploads it as artifact
479399 build-windows :
480400 needs :
0 commit comments