mirror of
https://github.com/Novaloop-AG/healthchat-web.git
synced 2026-10-31 08:15:07 +00:00
425 lines
23 KiB
YAML
425 lines
23 KiB
YAML
name: Build HealthChat Desktop
|
|
|
|
# Builds the HealthChat desktop (Electron) app for macOS and Windows: the fork's
|
|
# element-web webapp with the HealthChat plugin (healthchat-module.js + healthchat-elements.js)
|
|
# injected, packaged via the element-desktop build pipeline and published to the GitHub Release.
|
|
#
|
|
# This is the desktop counterpart of build-healthchat.yaml (web). On a `healthchat-v*` tag it
|
|
# runs alongside the web build; it first builds the element-plugin from healthchat-workspace,
|
|
# builds the fork webapp with the plugin injected, then feeds it into build_desktop_prepare.yaml
|
|
# (via `webapp-artifact`) and the per-platform build_desktop_{macos,windows}.yaml reusables.
|
|
#
|
|
# Notes:
|
|
# - This workflow RELEASES but does not DEPLOY. It stages the update feed + public installers
|
|
# to the versioned archive at packages.healthchat.ch/desktop-releases/<version>/ and links
|
|
# the public installer URLs in the Release notes (nothing binary is attached to the GitHub
|
|
# Release); the live auto-update feed at packages.healthchat.ch/desktop/ is only touched by
|
|
# the manually dispatched deploy-healthchat-desktop.yaml. So cutting a tag never pushes an
|
|
# update to already-installed apps until a human decides to ship it.
|
|
# - The reusable build workflows are pointed at THIS fork (repository/ref inputs) so the Electron
|
|
# shell, icons (apps/desktop/build/icon.*) and the healthchat:// deep-link handler
|
|
# (apps/desktop/src/protocol.ts) are all fork-branded. Branding values come from
|
|
# apps/desktop/element.io/healthchat/{build.json,config.json} (-> variant.json).
|
|
# - macOS notarisation and Windows code-signing require the `Desktop Apple` / `Desktop eSigner`
|
|
# GitHub environments (secrets/vars) to be configured. Without them the builds still run but
|
|
# produce unsigned/untrusted output. See apps/desktop/element.io/healthchat/README.
|
|
# - The desktop app version comes from apps/desktop/package.json (electron-builder); the per-job
|
|
# `version` input only feeds the macOS update manifest and is mangled into a nightly
|
|
# string by Windows squirrel, so it cannot set the app version. To keep the installers / About
|
|
# dialog in sync with the tag, apps/desktop/package.json must be bumped to the release version
|
|
# in the release commit. The "Assert desktop app version matches release" step below enforces
|
|
# this: the build fails fast if package.json drifts from the tag's MAJOR.MINOR.PATCH (any
|
|
# -rc1/-hotfix1 suffix is ignored, since squirrel requires a clean numeric version).
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "healthchat-v*"
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: "Version (e.g. 1.4.0). Drives the web bundle version and must match apps/desktop/package.json (MAJOR.MINOR.PATCH), which sets the desktop app version."
|
|
required: true
|
|
type: string
|
|
workspace_ref:
|
|
description: "healthchat-workspace ref (defaults to .healthchat-workspace-version)."
|
|
required: false
|
|
type: string
|
|
|
|
permissions: {}
|
|
|
|
concurrency:
|
|
group: build-healthchat-desktop-${{ github.event.inputs.version || github.ref_name }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
webapp:
|
|
name: Build webapp + plugin
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Resolve version
|
|
id: version
|
|
env:
|
|
INPUT_VERSION: ${{ github.event.inputs.version }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
|
|
VERSION="${GITHUB_REF_NAME#healthchat-v}"
|
|
elif [[ -n "${INPUT_VERSION:-}" ]]; then
|
|
VERSION="${INPUT_VERSION}"
|
|
else
|
|
echo "::error::No version available (not a tag push and no version input)"
|
|
exit 1
|
|
fi
|
|
if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
|
|
echo "::error::Invalid version '$VERSION'"
|
|
exit 1
|
|
fi
|
|
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
|
|
|
|
# electron-builder bakes apps/desktop/package.json's version into the installers and the
|
|
# About dialog (the per-platform `version` input cannot override it). Fail fast if that
|
|
# file wasn't bumped to this release, so the desktop apps always match the tag. The
|
|
# comparison is on MAJOR.MINOR.PATCH only: tags may carry -rc1/-hotfix1 suffixes, but
|
|
# Windows squirrel needs package.json to stay a clean numeric version.
|
|
- name: Assert desktop app version matches release
|
|
env:
|
|
VERSION: ${{ steps.version.outputs.version }}
|
|
run: |
|
|
set -euo pipefail
|
|
BASE=$(printf '%s' "$VERSION" | grep -oE '^[0-9]+\.[0-9]+\.[0-9]+')
|
|
PKG=$(jq -r .version apps/desktop/package.json)
|
|
if [[ "$PKG" != "$BASE" ]]; then
|
|
echo "::error::apps/desktop/package.json version ($PKG) does not match release $BASE (tag: $VERSION). Bump apps/desktop/package.json to $BASE in the release commit so the desktop installers and About dialog match the tag."
|
|
exit 1
|
|
fi
|
|
echo "Desktop app version $PKG matches release $BASE"
|
|
|
|
- name: Resolve workspace ref
|
|
id: workspace
|
|
env:
|
|
OVERRIDE: ${{ github.event.inputs.workspace_ref }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ -n "$OVERRIDE" ]]; then
|
|
REF="$OVERRIDE"
|
|
elif [[ -f .healthchat-workspace-version ]]; then
|
|
REF=$(head -n1 .healthchat-workspace-version | tr -d '[:space:]')
|
|
[[ -n "$REF" ]] || { echo "::error::.healthchat-workspace-version is empty"; exit 1; }
|
|
else
|
|
echo "::error::.healthchat-workspace-version missing and no workspace_ref override provided"
|
|
exit 1
|
|
fi
|
|
echo "ref=$REF" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Checkout healthchat-workspace
|
|
uses: actions/checkout@v4
|
|
with:
|
|
repository: Novaloop-AG/healthchat-workspace
|
|
path: healthchat-workspace
|
|
token: ${{ secrets.HEALTHCHAT_WORKSPACE_TOKEN }}
|
|
ref: ${{ steps.workspace.outputs.ref }}
|
|
persist-credentials: false
|
|
|
|
# v6.0.8 reads the pnpm version from devEngines.packageManager in package.json
|
|
# (this repo has no top-level "packageManager" field, which older majors require).
|
|
- uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: "pnpm"
|
|
|
|
- name: Install monorepo deps
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Build element-plugin
|
|
run: |
|
|
cd healthchat-workspace/element-plugin
|
|
npm ci
|
|
npm run build
|
|
cd module
|
|
npm ci
|
|
npm run build
|
|
|
|
- name: Stage plugin artifacts
|
|
run: |
|
|
mkdir -p plugin-dist/elements
|
|
cp healthchat-workspace/element-plugin/module/dist/healthchat-module.js plugin-dist/healthchat-module.js
|
|
cp healthchat-workspace/element-plugin/dist/elements/browser/main.js plugin-dist/elements/healthchat-elements.js
|
|
|
|
- name: Build webapp with plugin injected
|
|
env:
|
|
VERSION: ${{ steps.version.outputs.version }}
|
|
run: ./apps/desktop/scripts/build-healthchat-webapp.sh
|
|
|
|
- uses: actions/upload-artifact@v4
|
|
with:
|
|
name: healthchat-webapp
|
|
retention-days: 1
|
|
path: apps/desktop/webapp
|
|
|
|
prepare:
|
|
name: Prepare desktop asar
|
|
needs: webapp
|
|
permissions:
|
|
contents: read
|
|
uses: ./.github/workflows/build_desktop_prepare.yaml
|
|
with:
|
|
repository: ${{ github.repository }}
|
|
ref: ${{ github.sha }}
|
|
config: element.io/healthchat
|
|
webapp-artifact: healthchat-webapp
|
|
# 'develop' skips the upstream "[Release] Fetch release" / Debian changelog step,
|
|
# which would look for a non-existent v<package.json-version> release in this fork.
|
|
version: develop
|
|
nightly: false
|
|
deploy: false
|
|
|
|
macos:
|
|
name: macOS
|
|
needs: prepare
|
|
permissions:
|
|
contents: read
|
|
uses: ./.github/workflows/build_desktop_macos.yaml
|
|
secrets: inherit # zizmor: ignore[secrets-inherit]
|
|
with:
|
|
repository: ${{ github.repository }}
|
|
ref: ${{ github.sha }}
|
|
sign: true
|
|
test: false
|
|
targets: "dmg zip"
|
|
# Generates dist/releases.json (the Squirrel.Mac feed manifest). The reusable appends
|
|
# `/update/macos/<zip>` to this, so the in-manifest URL becomes
|
|
# https://packages.healthchat.ch/desktop/update/macos/<zip>, matching where the
|
|
# `release` job publishes the feed. Keep in sync with update_base_url in
|
|
# element.io/healthchat/config.json (.../desktop/update/).
|
|
base-url: https://packages.healthchat.ch/desktop
|
|
|
|
windows:
|
|
name: Windows ${{ matrix.arch }}
|
|
needs: prepare
|
|
permissions:
|
|
contents: read
|
|
strategy:
|
|
matrix:
|
|
arch: [x64, arm64]
|
|
uses: ./.github/workflows/build_desktop_windows.yaml
|
|
# element-desktop's Windows reusable signs via SSL.com eSigner CKA, whose secret names
|
|
# differ from the org-level CodeSignTool secrets shared with the other Novaloop apps
|
|
# (CKA needs no credential_id). Map them here. A trusted signature also requires the
|
|
# repo/org variable ESIGNER_MODE=prod (otherwise the reusable falls back to the untrusted
|
|
# sandbox demo cert).
|
|
secrets:
|
|
ESIGNER_USER_NAME: ${{ secrets.ESIGNER_USERNAME }}
|
|
ESIGNER_USER_PASSWORD: ${{ secrets.ESIGNER_PASSWORD }}
|
|
ESIGNER_USER_TOTP: ${{ secrets.ESIGNER_TOTP_SECRET }}
|
|
with:
|
|
repository: ${{ github.repository }}
|
|
ref: ${{ github.sha }}
|
|
arch: ${{ matrix.arch }}
|
|
sign: true
|
|
test: false
|
|
targets: "squirrel msi"
|
|
|
|
release:
|
|
name: Stage feed archive + Release notes
|
|
needs: [macos, windows]
|
|
# Runs on tag pushes AND manual dispatches: the archive upload is idempotent per version
|
|
# (mirror --delete into desktop-releases/<version>/), and re-running it via dispatch is
|
|
# the recovery path for a version whose archive is missing. The GitHub Release steps
|
|
# below stay tag-only, so a dispatch can never touch release history.
|
|
if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
# Needed so the staging step can read HEALTHCHAT_CHANGES.md to extract release notes.
|
|
# Lands at the workspace root; download-artifact below writes to dist-artifacts/, no conflict.
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Resolve version
|
|
id: relversion
|
|
env:
|
|
INPUT_VERSION: ${{ github.event.inputs.version }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
|
|
VERSION="${GITHUB_REF_NAME#healthchat-v}"
|
|
else
|
|
VERSION="${INPUT_VERSION:?No version input on workflow_dispatch}"
|
|
fi
|
|
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Download all build artifacts
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
|
with:
|
|
path: dist-artifacts
|
|
|
|
# Installers are NOT attached to the Release: they ship inside the staged feed and are
|
|
# served from packages.healthchat.ch after the deploy — the Release body links to them
|
|
# there (see "Link public downloads in the Release notes" below). Attaching them here
|
|
# would duplicate ~1 GiB per release and the x64/arm64 Setup.exe share a filename, so
|
|
# they'd clobber each other as flat Release assets anyway.
|
|
- name: Ensure GitHub Release exists
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
GH_REPO: ${{ github.repository }}
|
|
TAG: ${{ github.ref_name }}
|
|
run: |
|
|
set -euo pipefail
|
|
# The web workflow (build-healthchat.yaml) also creates this release for the same tag.
|
|
# Create-if-missing (without touching existing notes) so the two workflows race
|
|
# safely regardless of ordering.
|
|
gh release view "$TAG" >/dev/null 2>&1 || \
|
|
gh release create "$TAG" --title "$TAG" --notes "HealthChat $TAG"
|
|
|
|
# The GitHub Release is private (internal fork), so it can't serve end users or the
|
|
# Squirrel auto-updater. Those are served from packages.healthchat.ch/desktop/, which is
|
|
# published by the SEPARATE, MANUALLY DISPATCHED "Deploy HealthChat Desktop" workflow
|
|
# (deploy-healthchat-desktop.yaml) — releasing never touches the live update feed.
|
|
# This job only *stages* that feed and uploads it to the versioned archive at
|
|
# packages.healthchat.ch/desktop-releases/<version>/ (the archive persists, so the
|
|
# deploy workflow can publish any staged version without rebuilding or re-signing).
|
|
- name: Stage update feed + public installers
|
|
env:
|
|
VERSION: ${{ steps.relversion.outputs.version }}
|
|
run: |
|
|
set -euo pipefail
|
|
# --- Release notes: extract this version's section from HEALTHCHAT_CHANGES.md ---
|
|
# Same extraction as build-healthchat.yaml (web). Surfaced to desktop users in the
|
|
# auto-update "See changes" dialog: macOS reads it from releases.json's `notes`
|
|
# field natively, Windows fetches notes.txt (Squirrel.Windows can't carry notes
|
|
# through the update-downloaded event — only releaseName is available).
|
|
NOTES=$(awk -v ver="$VERSION" '
|
|
/^## Changes in / {
|
|
if (found) { exit }
|
|
if ($0 ~ "## Changes in " ver "( |$|\\()") { found = 1; next }
|
|
}
|
|
found { print }
|
|
' HEALTHCHAT_CHANGES.md | sed '/^[[:space:]]*$/{N;/^\n$/D;}')
|
|
if [[ -z "$NOTES" ]]; then
|
|
NOTES="HealthChat ${VERSION} — automated build from ${GITHUB_REF_NAME}."
|
|
echo "::warning::No HEALTHCHAT_CHANGES.md section found for $VERSION — using fallback"
|
|
fi
|
|
printf '%s\n' "$NOTES" > notes.txt
|
|
echo "--- release notes ---"; cat notes.txt
|
|
|
|
# --- macOS update feed: releases.json (Squirrel.Mac manifest) + signed *-mac.zip payload ---
|
|
mkdir -p feed/update/macos feed/install/macos
|
|
test -f dist-artifacts/macos/releases.json || {
|
|
echo "::error::dist-artifacts/macos/releases.json missing (did the macos job get base-url?)"; exit 1; }
|
|
cp -v dist-artifacts/macos/releases.json feed/update/macos/
|
|
# Splice the notes into the manifest: Squirrel.Mac maps updateTo.notes -> the
|
|
# update-downloaded event's releaseNotes, which the renderer already renders.
|
|
jq --rawfile notes notes.txt '.releases[0].updateTo.notes = $notes' \
|
|
feed/update/macos/releases.json > feed/update/macos/releases.json.tmp
|
|
mv feed/update/macos/releases.json.tmp feed/update/macos/releases.json
|
|
find dist-artifacts/macos -type f -iname '*-mac.zip' -exec cp -v {} feed/update/macos/ \;
|
|
# --- macOS installer: versioned .dmg + a stable "latest" copy ---
|
|
find dist-artifacts/macos -type f -iname '*.dmg' -exec cp -v {} feed/install/macos/ \;
|
|
dmg=$(find feed/install/macos -type f -iname '*.dmg' | head -n1)
|
|
test -n "$dmg" && cp -v "$dmg" feed/install/macos/HealthChat.dmg
|
|
# --- Windows: per-arch Squirrel feed (RELEASES + full nupkg) + installers (Setup.exe, msi) ---
|
|
for arch in x64 arm64; do
|
|
src="dist-artifacts/win-$arch"
|
|
[ -d "$src" ] || { echo "::error::$src missing"; exit 1; }
|
|
mkdir -p "feed/update/win32/$arch" "feed/install/win32/$arch"
|
|
# Side-channel for release notes: the desktop main process fetches this and
|
|
# populates releaseNotes itself, since Squirrel.Windows can't deliver them.
|
|
cp -v notes.txt "feed/update/win32/$arch/notes.txt"
|
|
find "$src" -type f -iname 'RELEASES' -exec cp -v {} "feed/update/win32/$arch/" \;
|
|
find "$src" -type f -iname '*-full.nupkg' -exec cp -v {} "feed/update/win32/$arch/" \;
|
|
find "$src" -type f -iname '* Setup*.exe' -exec cp -v {} "feed/install/win32/$arch/" \;
|
|
find "$src" -type f -iname '*.msi' -exec cp -v {} "feed/install/win32/$arch/" \;
|
|
setup=$(find "feed/install/win32/$arch" -type f -iname '* Setup*.exe' | head -n1)
|
|
test -n "$setup" && cp -v "$setup" "feed/install/win32/$arch/HealthChat-Setup.exe"
|
|
done
|
|
echo "--- staged feed tree ---"
|
|
find feed -type f | sort
|
|
|
|
# Upload the staged feed to the versioned archive instead of publishing it. "Deploy
|
|
# HealthChat Desktop" (deploy-healthchat-desktop.yaml) mirrors this archive to the
|
|
# live feed when a human decides to ship. The archive directories persist on the
|
|
# server, so any staged version stays redeployable without rebuilding or re-signing.
|
|
# (The feed used to be attached to the GitHub Release as a tarball, but the
|
|
# compressed feed outgrew GitHub's 2 GiB per-asset cap at 1.6.0.)
|
|
- name: Publish staged feed to the versioned archive
|
|
env:
|
|
FTP_SERVER: ${{ secrets.FTP_SERVER }}
|
|
FTP_USERNAME: ${{ secrets.FTP_USERNAME }}
|
|
# Passed to lftp via LFTP_PASSWORD (--env-password) so it never appears on the
|
|
# command line / process list.
|
|
LFTP_PASSWORD: ${{ secrets.FTP_PASSWORD }}
|
|
VERSION: ${{ steps.relversion.outputs.version }}
|
|
run: |
|
|
set -euo pipefail
|
|
: "${FTP_SERVER:?FTP_SERVER secret not set}"
|
|
: "${FTP_USERNAME:?FTP_USERNAME secret not set}"
|
|
: "${LFTP_PASSWORD:?FTP_PASSWORD secret not set}"
|
|
sudo apt-get update && sudo apt-get install -y lftp
|
|
# The archive dir is owned by this version's build: --delete makes re-runs
|
|
# idempotent (a rebuild fully replaces the staged tree). The live feed under
|
|
# /public_html/packages/desktop is never touched here.
|
|
lftp -u "$FTP_USERNAME" --env-password "$FTP_SERVER" <<LFTP
|
|
set cmd:fail-exit true
|
|
set ftp:ssl-force true
|
|
set ftp:ssl-protect-data true
|
|
set ssl:verify-certificate true
|
|
mkdir -pf /public_html/packages/desktop-releases/$VERSION
|
|
mirror -R --delete --parallel=4 --verbose feed/ /public_html/packages/desktop-releases/$VERSION/
|
|
bye
|
|
LFTP
|
|
echo "::notice::Feed staged at https://packages.healthchat.ch/desktop-releases/$VERSION/ — the live feed is UNCHANGED. Run 'Deploy HealthChat Desktop' to publish it."
|
|
|
|
# The Release carries no installer binaries (see "Ensure GitHub Release exists"), so
|
|
# point readers at the public download URLs instead. The links are derived from the
|
|
# staged feed/install tree, so they stay correct if electron-builder ever renames the
|
|
# artifacts. They resolve once "Deploy HealthChat Desktop" has published this version.
|
|
- name: Link public downloads in the Release notes
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
GH_REPO: ${{ github.repository }}
|
|
TAG: ${{ github.ref_name }}
|
|
run: |
|
|
set -euo pipefail
|
|
BASE="https://packages.healthchat.ch/desktop"
|
|
BODY=$(gh release view "$TAG" --json body --jq .body)
|
|
if [[ "$BODY" == *"## Downloads"* ]]; then
|
|
echo "Release notes already carry a Downloads section — leaving them untouched."
|
|
exit 0
|
|
fi
|
|
{
|
|
printf '%s\n\n' "$BODY"
|
|
echo "## Downloads"
|
|
echo ""
|
|
echo "Public installers, live once this version is deployed via \"Deploy HealthChat Desktop\":"
|
|
echo ""
|
|
for f in feed/install/macos/* feed/install/win32/x64/* feed/install/win32/arm64/*; do
|
|
name=$(basename "$f")
|
|
# Skip the stable "latest" aliases — they track whatever is deployed, not this version.
|
|
case "$name" in HealthChat.dmg|HealthChat-Setup.exe) continue ;; esac
|
|
dir=$(dirname "${f#feed/}")
|
|
case "$dir" in
|
|
*/macos) platform="macOS" ;;
|
|
*/x64) platform="Windows x64" ;;
|
|
*/arm64) platform="Windows arm64" ;;
|
|
*) platform="$dir" ;;
|
|
esac
|
|
enc=$(jq -rn --arg s "$name" '$s|@uri')
|
|
echo "- [$name]($BASE/$dir/$enc) — $platform"
|
|
done
|
|
} > release-body.md
|
|
gh release edit "$TAG" --notes-file release-body.md
|
|
echo "::notice::Release notes now link the public installers under $BASE/install/."
|