mirror of
https://github.com/Novaloop-AG/healthchat-web.git
synced 2026-11-03 06:01:45 +00:00
joel.poyet
cf917c1ed5
Remove the Linux desktop build from the release pipeline. It could never succeed in this fork: the upstream Linux reusable pulls a build-env Docker image keyed by the building commit's SHA from the upstream element-hq registry, where the fork's SHA does not exist, so every tagged build failed with `manifest unknown`. Desktop releases now ship macOS and Windows only. - Drop the linux job + its release artifacts from build-healthchat-desktop.yaml - Bump apps/desktop/package.json to 1.1.2 - Update releasing-healthchat skill + desktop README docs
258 lines
12 KiB
YAML
258 lines
12 KiB
YAML
name: Build HealthChat Desktop
|
|
|
|
# Builds the HealthChat desktop (Electron) app for macOS and Windows: the fork's
|
|
# element-web webapp with the HealthChat plugin (healthchat-module.js + healthchat-elements.js)
|
|
# injected, packaged via the element-desktop build pipeline and published to the GitHub Release.
|
|
#
|
|
# This is the desktop counterpart of build-healthchat.yaml (web). On a `healthchat-v*` tag it
|
|
# runs alongside the web build; it first builds the element-plugin from healthchat-workspace,
|
|
# builds the fork webapp with the plugin injected, then feeds it into build_desktop_prepare.yaml
|
|
# (via `webapp-artifact`) and the per-platform build_desktop_{macos,windows}.yaml reusables.
|
|
#
|
|
# Notes:
|
|
# - The reusable build workflows are pointed at THIS fork (repository/ref inputs) so the Electron
|
|
# shell, icons (apps/desktop/build/icon.*) and the healthchat:// deep-link handler
|
|
# (apps/desktop/src/protocol.ts) are all fork-branded. Branding values come from
|
|
# apps/desktop/element.io/healthchat/{build.json,config.json} (-> variant.json).
|
|
# - macOS notarisation and Windows code-signing require the `Desktop Apple` / `Desktop eSigner`
|
|
# GitHub environments (secrets/vars) to be configured. Without them the builds still run but
|
|
# produce unsigned/untrusted output. See apps/desktop/element.io/healthchat/README.
|
|
# - The desktop app version comes from apps/desktop/package.json (electron-builder); the per-job
|
|
# `version` input only feeds the macOS update manifest and is mangled into a nightly
|
|
# string by Windows squirrel, so it cannot set the app version. To keep the installers / About
|
|
# dialog in sync with the tag, apps/desktop/package.json must be bumped to the release version
|
|
# in the release commit. The "Assert desktop app version matches release" step below enforces
|
|
# this: the build fails fast if package.json drifts from the tag's MAJOR.MINOR.PATCH (any
|
|
# -rc1/-hotfix1 suffix is ignored, since squirrel requires a clean numeric version).
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "healthchat-v*"
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: "Version (e.g. 1.4.0). Drives the web bundle version and must match apps/desktop/package.json (MAJOR.MINOR.PATCH), which sets the desktop app version."
|
|
required: true
|
|
type: string
|
|
workspace_ref:
|
|
description: "healthchat-workspace ref (defaults to .healthchat-workspace-version)."
|
|
required: false
|
|
type: string
|
|
|
|
permissions: {}
|
|
|
|
concurrency:
|
|
group: build-healthchat-desktop-${{ github.event.inputs.version || github.ref_name }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
webapp:
|
|
name: Build webapp + plugin
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Resolve version
|
|
id: version
|
|
env:
|
|
INPUT_VERSION: ${{ github.event.inputs.version }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
|
|
VERSION="${GITHUB_REF_NAME#healthchat-v}"
|
|
elif [[ -n "${INPUT_VERSION:-}" ]]; then
|
|
VERSION="${INPUT_VERSION}"
|
|
else
|
|
echo "::error::No version available (not a tag push and no version input)"
|
|
exit 1
|
|
fi
|
|
if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
|
|
echo "::error::Invalid version '$VERSION'"
|
|
exit 1
|
|
fi
|
|
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
|
|
|
|
# electron-builder bakes apps/desktop/package.json's version into the installers and the
|
|
# About dialog (the per-platform `version` input cannot override it). Fail fast if that
|
|
# file wasn't bumped to this release, so the desktop apps always match the tag. The
|
|
# comparison is on MAJOR.MINOR.PATCH only: tags may carry -rc1/-hotfix1 suffixes, but
|
|
# Windows squirrel needs package.json to stay a clean numeric version.
|
|
- name: Assert desktop app version matches release
|
|
env:
|
|
VERSION: ${{ steps.version.outputs.version }}
|
|
run: |
|
|
set -euo pipefail
|
|
BASE=$(printf '%s' "$VERSION" | grep -oE '^[0-9]+\.[0-9]+\.[0-9]+')
|
|
PKG=$(jq -r .version apps/desktop/package.json)
|
|
if [[ "$PKG" != "$BASE" ]]; then
|
|
echo "::error::apps/desktop/package.json version ($PKG) does not match release $BASE (tag: $VERSION). Bump apps/desktop/package.json to $BASE in the release commit so the desktop installers and About dialog match the tag."
|
|
exit 1
|
|
fi
|
|
echo "Desktop app version $PKG matches release $BASE"
|
|
|
|
- name: Resolve workspace ref
|
|
id: workspace
|
|
env:
|
|
OVERRIDE: ${{ github.event.inputs.workspace_ref }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ -n "$OVERRIDE" ]]; then
|
|
REF="$OVERRIDE"
|
|
elif [[ -f .healthchat-workspace-version ]]; then
|
|
REF=$(head -n1 .healthchat-workspace-version | tr -d '[:space:]')
|
|
[[ -n "$REF" ]] || { echo "::error::.healthchat-workspace-version is empty"; exit 1; }
|
|
else
|
|
echo "::error::.healthchat-workspace-version missing and no workspace_ref override provided"
|
|
exit 1
|
|
fi
|
|
echo "ref=$REF" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Checkout healthchat-workspace
|
|
uses: actions/checkout@v4
|
|
with:
|
|
repository: Novaloop-AG/healthchat-workspace
|
|
path: healthchat-workspace
|
|
token: ${{ secrets.HEALTHCHAT_WORKSPACE_TOKEN }}
|
|
ref: ${{ steps.workspace.outputs.ref }}
|
|
persist-credentials: false
|
|
|
|
# v6.0.8 reads the pnpm version from devEngines.packageManager in package.json
|
|
# (this repo has no top-level "packageManager" field, which older majors require).
|
|
- uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: "pnpm"
|
|
|
|
- name: Install monorepo deps
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Build element-plugin
|
|
run: |
|
|
cd healthchat-workspace/element-plugin
|
|
npm ci
|
|
npm run build
|
|
cd module
|
|
npm ci
|
|
npm run build
|
|
|
|
- name: Stage plugin artifacts
|
|
run: |
|
|
mkdir -p plugin-dist/elements
|
|
cp healthchat-workspace/element-plugin/module/dist/healthchat-module.js plugin-dist/healthchat-module.js
|
|
cp healthchat-workspace/element-plugin/dist/elements/browser/main.js plugin-dist/elements/healthchat-elements.js
|
|
|
|
- name: Build webapp with plugin injected
|
|
env:
|
|
VERSION: ${{ steps.version.outputs.version }}
|
|
run: ./apps/desktop/scripts/build-healthchat-webapp.sh
|
|
|
|
- uses: actions/upload-artifact@v4
|
|
with:
|
|
name: healthchat-webapp
|
|
retention-days: 1
|
|
path: apps/desktop/webapp
|
|
|
|
prepare:
|
|
name: Prepare desktop asar
|
|
needs: webapp
|
|
permissions:
|
|
contents: read
|
|
uses: ./.github/workflows/build_desktop_prepare.yaml
|
|
with:
|
|
repository: ${{ github.repository }}
|
|
ref: ${{ github.sha }}
|
|
config: element.io/healthchat
|
|
webapp-artifact: healthchat-webapp
|
|
# 'develop' skips the upstream "[Release] Fetch release" / Debian changelog step,
|
|
# which would look for a non-existent v<package.json-version> release in this fork.
|
|
version: develop
|
|
nightly: false
|
|
deploy: false
|
|
|
|
macos:
|
|
name: macOS
|
|
needs: prepare
|
|
permissions:
|
|
contents: read
|
|
uses: ./.github/workflows/build_desktop_macos.yaml
|
|
secrets: inherit # zizmor: ignore[secrets-inherit]
|
|
with:
|
|
repository: ${{ github.repository }}
|
|
ref: ${{ github.sha }}
|
|
sign: true
|
|
test: false
|
|
targets: "dmg zip"
|
|
|
|
windows:
|
|
name: Windows ${{ matrix.arch }}
|
|
needs: prepare
|
|
permissions:
|
|
contents: read
|
|
strategy:
|
|
matrix:
|
|
arch: [x64, arm64]
|
|
uses: ./.github/workflows/build_desktop_windows.yaml
|
|
# element-desktop's Windows reusable signs via SSL.com eSigner CKA, whose secret names
|
|
# differ from the org-level CodeSignTool secrets shared with the other Novaloop apps
|
|
# (CKA needs no credential_id). Map them here. A trusted signature also requires the
|
|
# repo/org variable ESIGNER_MODE=prod (otherwise the reusable falls back to the untrusted
|
|
# sandbox demo cert).
|
|
secrets:
|
|
ESIGNER_USER_NAME: ${{ secrets.ESIGNER_USERNAME }}
|
|
ESIGNER_USER_PASSWORD: ${{ secrets.ESIGNER_PASSWORD }}
|
|
ESIGNER_USER_TOTP: ${{ secrets.ESIGNER_TOTP_SECRET }}
|
|
with:
|
|
repository: ${{ github.repository }}
|
|
ref: ${{ github.sha }}
|
|
arch: ${{ matrix.arch }}
|
|
sign: true
|
|
test: false
|
|
targets: "squirrel msi"
|
|
|
|
release:
|
|
name: Publish to GitHub Release
|
|
needs: [macos, windows]
|
|
# Only publish on a real tag push; manual workflow_dispatch runs build but do not publish.
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- name: Download all build artifacts
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
|
with:
|
|
path: dist-artifacts
|
|
|
|
- name: Collect installers
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir -p release-files
|
|
# macOS: .dmg installer + .zip (Squirrel.Mac update payload)
|
|
find dist-artifacts -type f \( -iname '*.dmg' -o -iname '*-mac.zip' \) -exec cp -v {} release-files/ \;
|
|
# Windows: per-machine MSI + Squirrel "Setup" installer
|
|
find dist-artifacts -type f \( -iname '*.msi' -o -iname '* Setup*.exe' \) -exec cp -v {} release-files/ \;
|
|
echo "--- release files ---"
|
|
ls -la release-files
|
|
test -n "$(ls -A release-files)" || { echo "::error::No installer files collected"; exit 1; }
|
|
|
|
- name: Upload to GitHub Release
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
GH_REPO: ${{ github.repository }}
|
|
TAG: ${{ github.ref_name }}
|
|
run: |
|
|
set -euo pipefail
|
|
# The web workflow (build-healthchat.yaml) also creates this release for the same tag.
|
|
# Create-if-missing (without touching existing notes) then upload --clobber so the two
|
|
# workflows race safely regardless of ordering.
|
|
gh release view "$TAG" >/dev/null 2>&1 || \
|
|
gh release create "$TAG" --title "$TAG" --notes "HealthChat desktop installers for $TAG"
|
|
gh release upload "$TAG" release-files/* --clobber
|