fix: serve SPA subpaths without auth block, set cookie via direct res… #31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: zexi-electron | |
| on: | |
| push: | |
| branches: | |
| - zexi/dev | |
| workflow_dispatch: | |
| concurrency: ${{ github.workflow }}-${{ github.ref }} | |
| permissions: | |
| contents: write | |
| jobs: | |
| build-electron: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| settings: | |
| - name: mac-arm64 | |
| host: macos-26 | |
| target: aarch64-apple-darwin | |
| platform_flag: --mac --arm64 | |
| bun_install_flags: --os=darwin --cpu=arm64 | |
| - name: windows-x64 | |
| host: windows-2025 | |
| target: x86_64-pc-windows-msvc | |
| platform_flag: --win | |
| bun_install_flags: "" | |
| runs-on: ${{ matrix.settings.host }} | |
| env: | |
| OPENCODE_CHANNEL: prod | |
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }} | |
| APPLE_API_KEY_PATH: ${{ secrets.APPLE_API_KEY_PATH }} | |
| APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }} | |
| AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }} | |
| AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }} | |
| AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | |
| AZURE_TRUSTED_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }} | |
| AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE: ${{ secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE }} | |
| AZURE_TRUSTED_SIGNING_ENDPOINT: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: apple-actions/import-codesign-certs@v2 | |
| if: runner.os == 'macOS' && env.APPLE_CERTIFICATE != '' && env.APPLE_CERTIFICATE_PASSWORD != '' | |
| with: | |
| keychain: build | |
| p12-file-base64: ${{ env.APPLE_CERTIFICATE }} | |
| p12-password: ${{ env.APPLE_CERTIFICATE_PASSWORD }} | |
| - name: Setup Apple API Key | |
| if: runner.os == 'macOS' && env.APPLE_API_KEY_PATH != '' | |
| shell: bash | |
| run: echo "${{ env.APPLE_API_KEY_PATH }}" > "$RUNNER_TEMP/apple-api-key.p8" | |
| - uses: ./.github/actions/setup-bun | |
| with: | |
| install-flags: ${{ matrix.settings.bun_install_flags }} | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "24" | |
| - name: Azure login | |
| if: runner.os == 'Windows' && env.AZURE_CLIENT_ID != '' && env.AZURE_TENANT_ID != '' && env.AZURE_SUBSCRIPTION_ID != '' | |
| uses: azure/login@v2 | |
| with: | |
| client-id: ${{ env.AZURE_CLIENT_ID }} | |
| tenant-id: ${{ env.AZURE_TENANT_ID }} | |
| subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }} | |
| - name: Prepare | |
| working-directory: packages/desktop | |
| env: | |
| RUST_TARGET: ${{ matrix.settings.target }} | |
| run: bun ./scripts/prepare.ts | |
| - name: Build | |
| working-directory: packages/desktop | |
| run: bun run build | |
| - name: Package macOS (signed) | |
| if: runner.os == 'macOS' && env.APPLE_CERTIFICATE != '' && env.APPLE_CERTIFICATE_PASSWORD != '' | |
| working-directory: packages/desktop | |
| timeout-minutes: 90 | |
| env: | |
| CSC_LINK: ${{ env.APPLE_CERTIFICATE }} | |
| CSC_KEY_PASSWORD: ${{ env.APPLE_CERTIFICATE_PASSWORD }} | |
| APPLE_API_KEY: ${{ runner.temp }}/apple-api-key.p8 | |
| APPLE_API_KEY_ID: ${{ env.APPLE_API_KEY }} | |
| APPLE_API_ISSUER: ${{ env.APPLE_API_ISSUER }} | |
| run: npx electron-builder ${{ matrix.settings.platform_flag }} --publish never --config electron-builder.config.ts | |
| - name: Package macOS (unsigned) | |
| if: runner.os == 'macOS' && (env.APPLE_CERTIFICATE == '' || env.APPLE_CERTIFICATE_PASSWORD == '') | |
| working-directory: packages/desktop | |
| timeout-minutes: 90 | |
| env: | |
| CSC_IDENTITY_AUTO_DISCOVERY: "false" | |
| run: npx electron-builder ${{ matrix.settings.platform_flag }} --publish never --config electron-builder.config.ts | |
| - name: Package Windows | |
| if: runner.os == 'Windows' | |
| working-directory: packages/desktop | |
| timeout-minutes: 90 | |
| shell: pwsh | |
| run: | | |
| $attempts = 3 | |
| for ($attempt = 1; $attempt -le $attempts; $attempt++) { | |
| npx electron-builder ${{ matrix.settings.platform_flag }} --publish never --config electron-builder.config.ts | |
| if ($LASTEXITCODE -eq 0) { | |
| exit 0 | |
| } | |
| if ($attempt -eq $attempts) { | |
| exit $LASTEXITCODE | |
| } | |
| Write-Host "Windows packaging failed on attempt $attempt. Retrying in 20 seconds..." | |
| Start-Sleep -Seconds 20 | |
| } | |
| - name: Verify signed Windows artifacts | |
| if: runner.os == 'Windows' | |
| shell: pwsh | |
| run: | | |
| $files = @() | |
| $files += Get-ChildItem "${{ github.workspace }}\packages\desktop\dist\*.exe" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName | |
| $files += Get-ChildItem "${{ github.workspace }}\packages\desktop\dist\*unpacked\*.exe" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName | |
| $files += Get-ChildItem "${{ github.workspace }}\packages\desktop\dist\*unpacked\resources\opencode-cli.exe" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName | |
| foreach ($file in $files | Select-Object -Unique) { | |
| $sig = Get-AuthenticodeSignature $file | |
| Write-Host "$file => $($sig.Status)" | |
| } | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: opencode-electron-${{ matrix.settings.name }} | |
| path: | | |
| packages/desktop/dist/* | |
| !packages/desktop/dist/*unpacked | |
| !packages/desktop/dist/mac-arm64 | |
| publish-release: | |
| needs: build-electron | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| path: release-artifacts | |
| - name: Create or update release | |
| id: meta | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| GH_REPO: ${{ github.repository }} | |
| GITHUB_SHA: ${{ github.sha }} | |
| TARGET_REF: ${{ github.sha }} | |
| run: | | |
| short_sha="${GITHUB_SHA::7}" | |
| stamp="$(date -u +%Y%m%d-%H%M)" | |
| release_tag="zexi-electron-${stamp}-${short_sha}" | |
| release_name="zexi electron build ${stamp} ${short_sha}" | |
| echo "release_tag=${release_tag}" >> "$GITHUB_OUTPUT" | |
| gh release view "$release_tag" --repo "$GH_REPO" >/dev/null 2>&1 || gh release create "$release_tag" --repo "$GH_REPO" --target "$TARGET_REF" --title "$release_name" --notes "" | |
| - name: Upload release assets | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| GH_REPO: ${{ github.repository }} | |
| RELEASE_TAG: ${{ steps.meta.outputs.release_tag }} | |
| run: | | |
| find release-artifacts -type f \ | |
| \( \ | |
| -name '*.dmg' -o \ | |
| -name '*.zip' -o \ | |
| -name '*.exe' -o \ | |
| -name 'latest*.yml' -o \ | |
| -name '*.blockmap' \ | |
| \) \ | |
| -print0 | xargs -0 gh release upload "$RELEASE_TAG" --repo "$GH_REPO" --clobber | |
| - name: Prune old zexi releases | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| GH_REPO: ${{ github.repository }} | |
| run: | | |
| gh api "repos/$GH_REPO/releases" --paginate --jq '.[] | select(.tag_name | startswith("zexi-electron-")) | [.created_at, .tag_name] | @tsv' \ | |
| | sort -r \ | |
| | awk 'NR > 3 { print $2 }' \ | |
| | while read -r tag; do | |
| [ -n "$tag" ] || continue | |
| gh release delete "$tag" --repo "$GH_REPO" --yes | |
| done |