ci: link desktop installers instead of attaching them

This commit is contained in:
2026-07-29 23:19:35 +02:00
parent 8530b1f09a
commit 09e66dba47
3 changed files with 72 additions and 37 deletions
+49 -21
View File
@@ -10,10 +10,11 @@ name: Build HealthChat Desktop
# (via `webapp-artifact`) and the per-platform build_desktop_{macos,windows}.yaml reusables.
#
# Notes:
# - This workflow RELEASES but does not DEPLOY. It attaches the installers and a staged update-feed
# tarball to the GitHub Release; the live auto-update feed at packages.healthchat.ch/desktop/ is
# only touched by the manually dispatched deploy-healthchat-desktop.yaml. So cutting a tag never
# pushes an update to already-installed apps until a human decides to ship it.
# - This workflow RELEASES but does not DEPLOY. It attaches a staged update-feed tarball (split
# into <2 GiB parts) to the GitHub Release and links the public installer URLs in the Release
# notes; the live auto-update feed at packages.healthchat.ch/desktop/ is only touched by the
# manually dispatched deploy-healthchat-desktop.yaml. So cutting a tag never pushes an update
# to already-installed apps until a human decides to ship it.
# - The reusable build workflows are pointed at THIS fork (repository/ref inputs) so the Electron
# shell, icons (apps/desktop/build/icon.*) and the healthchat:// deep-link handler
# (apps/desktop/src/protocol.ts) are all fork-branded. Branding values come from
@@ -246,19 +247,12 @@ jobs:
with:
path: dist-artifacts
- name: Collect installers
run: |
set -euo pipefail
mkdir -p release-files
# macOS: .dmg installer + .zip (Squirrel.Mac update payload)
find dist-artifacts -type f \( -iname '*.dmg' -o -iname '*-mac.zip' \) -exec cp -v {} release-files/ \;
# Windows: per-machine MSI + Squirrel "Setup" installer
find dist-artifacts -type f \( -iname '*.msi' -o -iname '* Setup*.exe' \) -exec cp -v {} release-files/ \;
echo "--- release files ---"
ls -la release-files
test -n "$(ls -A release-files)" || { echo "::error::No installer files collected"; exit 1; }
- name: Upload to GitHub Release
# Installers are NOT attached to the Release: they ship inside the feed tarball and are
# served from packages.healthchat.ch after the deploy — the Release body links to them
# there (see "Link public downloads in the Release notes" below). Attaching them here
# would duplicate ~1 GiB per release and the x64/arm64 Setup.exe share a filename, so
# they'd clobber each other as flat Release assets anyway.
- name: Ensure GitHub Release exists
env:
GH_TOKEN: ${{ github.token }}
GH_REPO: ${{ github.repository }}
@@ -266,11 +260,10 @@ jobs:
run: |
set -euo pipefail
# The web workflow (build-healthchat.yaml) also creates this release for the same tag.
# Create-if-missing (without touching existing notes) then upload --clobber so the two
# workflows race safely regardless of ordering.
# Create-if-missing (without touching existing notes) so the two workflows race
# safely regardless of ordering.
gh release view "$TAG" >/dev/null 2>&1 || \
gh release create "$TAG" --title "$TAG" --notes "HealthChat desktop installers for $TAG"
gh release upload "$TAG" release-files/* --clobber
gh release create "$TAG" --title "$TAG" --notes "HealthChat $TAG"
# The GitHub Release above is private (internal fork), so it can't serve end users or the
# Squirrel auto-updater. Those are served from packages.healthchat.ch/desktop/, which is
@@ -356,3 +349,38 @@ jobs:
ls -lh "${TARBALL}".part*
gh release upload "$TAG" "${TARBALL}".part* --clobber
echo "::notice::Update feed attached as ${TARBALL}.part*. The live feed at packages.healthchat.ch is UNCHANGED — run the 'Deploy HealthChat Desktop' workflow to publish it."
# The Release carries no installer binaries (see "Ensure GitHub Release exists"), so
# point readers at the public download URLs instead. The links are derived from the
# staged feed/install tree, so they stay correct if electron-builder ever renames the
# artifacts. They resolve once "Deploy HealthChat Desktop" has published this version.
- name: Link public downloads in the Release notes
env:
GH_TOKEN: ${{ github.token }}
GH_REPO: ${{ github.repository }}
TAG: ${{ github.ref_name }}
run: |
set -euo pipefail
BASE="https://packages.healthchat.ch/desktop"
BODY=$(gh release view "$TAG" --json body --jq .body)
if [[ "$BODY" == *"## Downloads"* ]]; then
echo "Release notes already carry a Downloads section — leaving them untouched."
exit 0
fi
{
printf '%s\n\n' "$BODY"
echo "## Downloads"
echo ""
echo "Public installers, live once this version is deployed via \"Deploy HealthChat Desktop\":"
echo ""
for f in feed/install/macos/* feed/install/win32/x64/* feed/install/win32/arm64/*; do
name=$(basename "$f")
# Skip the stable "latest" aliases — they track whatever is deployed, not this version.
case "$name" in HealthChat.dmg|HealthChat-Setup.exe) continue ;; esac
dir=$(dirname "${f#feed/}")
enc=$(jq -rn --arg s "$name" '$s|@uri')
echo "- [$name]($BASE/$dir/$enc)"
done
} > release-body.md
gh release edit "$TAG" --notes-file release-body.md
echo "::notice::Release notes now link the public installers under $BASE/install/."