mirror of
https://github.com/Novaloop-AG/healthchat-web.git
synced 2026-10-31 08:15:07 +00:00
joel.poyet
ade1dff201
The Electron auto-updater (Squirrel.Mac / Squirrel.Windows) was already implemented but switched off for HealthChat because the variant config omitted update_base_url, and CI published only installers (no update feed), to a private GitHub Release that can't serve end users or the updater. - config.json: set update_base_url to https://healthchat.ch/packages/desktop/update/ so electron-main starts the updater. - build-healthchat-desktop.yaml: pass base-url to the macOS job so releases.json is generated; extend the release job to stage the update feed + public installers and mirror them to healthchat.ch over FTPS (lftp, no-delete to preserve prior nupkgs; password via LFTP_PASSWORD). - Document the feed/install layout, FTP secrets, and the two caveats (first install is manual; Windows auto-update needs the Setup.exe path, not .msi) in the healthchat README and the releasing-healthchat skill. Requires repo secrets FTP_SERVER / FTP_USERNAME / FTP_PASSWORD.
325 lines
16 KiB
YAML
325 lines
16 KiB
YAML
name: Build HealthChat Desktop
|
|
|
|
# Builds the HealthChat desktop (Electron) app for macOS and Windows: the fork's
|
|
# element-web webapp with the HealthChat plugin (healthchat-module.js + healthchat-elements.js)
|
|
# injected, packaged via the element-desktop build pipeline and published to the GitHub Release.
|
|
#
|
|
# This is the desktop counterpart of build-healthchat.yaml (web). On a `healthchat-v*` tag it
|
|
# runs alongside the web build; it first builds the element-plugin from healthchat-workspace,
|
|
# builds the fork webapp with the plugin injected, then feeds it into build_desktop_prepare.yaml
|
|
# (via `webapp-artifact`) and the per-platform build_desktop_{macos,windows}.yaml reusables.
|
|
#
|
|
# Notes:
|
|
# - The reusable build workflows are pointed at THIS fork (repository/ref inputs) so the Electron
|
|
# shell, icons (apps/desktop/build/icon.*) and the healthchat:// deep-link handler
|
|
# (apps/desktop/src/protocol.ts) are all fork-branded. Branding values come from
|
|
# apps/desktop/element.io/healthchat/{build.json,config.json} (-> variant.json).
|
|
# - macOS notarisation and Windows code-signing require the `Desktop Apple` / `Desktop eSigner`
|
|
# GitHub environments (secrets/vars) to be configured. Without them the builds still run but
|
|
# produce unsigned/untrusted output. See apps/desktop/element.io/healthchat/README.
|
|
# - The desktop app version comes from apps/desktop/package.json (electron-builder); the per-job
|
|
# `version` input only feeds the macOS update manifest and is mangled into a nightly
|
|
# string by Windows squirrel, so it cannot set the app version. To keep the installers / About
|
|
# dialog in sync with the tag, apps/desktop/package.json must be bumped to the release version
|
|
# in the release commit. The "Assert desktop app version matches release" step below enforces
|
|
# this: the build fails fast if package.json drifts from the tag's MAJOR.MINOR.PATCH (any
|
|
# -rc1/-hotfix1 suffix is ignored, since squirrel requires a clean numeric version).
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "healthchat-v*"
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: "Version (e.g. 1.4.0). Drives the web bundle version and must match apps/desktop/package.json (MAJOR.MINOR.PATCH), which sets the desktop app version."
|
|
required: true
|
|
type: string
|
|
workspace_ref:
|
|
description: "healthchat-workspace ref (defaults to .healthchat-workspace-version)."
|
|
required: false
|
|
type: string
|
|
|
|
permissions: {}
|
|
|
|
concurrency:
|
|
group: build-healthchat-desktop-${{ github.event.inputs.version || github.ref_name }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
webapp:
|
|
name: Build webapp + plugin
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Resolve version
|
|
id: version
|
|
env:
|
|
INPUT_VERSION: ${{ github.event.inputs.version }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
|
|
VERSION="${GITHUB_REF_NAME#healthchat-v}"
|
|
elif [[ -n "${INPUT_VERSION:-}" ]]; then
|
|
VERSION="${INPUT_VERSION}"
|
|
else
|
|
echo "::error::No version available (not a tag push and no version input)"
|
|
exit 1
|
|
fi
|
|
if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
|
|
echo "::error::Invalid version '$VERSION'"
|
|
exit 1
|
|
fi
|
|
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
|
|
|
|
# electron-builder bakes apps/desktop/package.json's version into the installers and the
|
|
# About dialog (the per-platform `version` input cannot override it). Fail fast if that
|
|
# file wasn't bumped to this release, so the desktop apps always match the tag. The
|
|
# comparison is on MAJOR.MINOR.PATCH only: tags may carry -rc1/-hotfix1 suffixes, but
|
|
# Windows squirrel needs package.json to stay a clean numeric version.
|
|
- name: Assert desktop app version matches release
|
|
env:
|
|
VERSION: ${{ steps.version.outputs.version }}
|
|
run: |
|
|
set -euo pipefail
|
|
BASE=$(printf '%s' "$VERSION" | grep -oE '^[0-9]+\.[0-9]+\.[0-9]+')
|
|
PKG=$(jq -r .version apps/desktop/package.json)
|
|
if [[ "$PKG" != "$BASE" ]]; then
|
|
echo "::error::apps/desktop/package.json version ($PKG) does not match release $BASE (tag: $VERSION). Bump apps/desktop/package.json to $BASE in the release commit so the desktop installers and About dialog match the tag."
|
|
exit 1
|
|
fi
|
|
echo "Desktop app version $PKG matches release $BASE"
|
|
|
|
- name: Resolve workspace ref
|
|
id: workspace
|
|
env:
|
|
OVERRIDE: ${{ github.event.inputs.workspace_ref }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ -n "$OVERRIDE" ]]; then
|
|
REF="$OVERRIDE"
|
|
elif [[ -f .healthchat-workspace-version ]]; then
|
|
REF=$(head -n1 .healthchat-workspace-version | tr -d '[:space:]')
|
|
[[ -n "$REF" ]] || { echo "::error::.healthchat-workspace-version is empty"; exit 1; }
|
|
else
|
|
echo "::error::.healthchat-workspace-version missing and no workspace_ref override provided"
|
|
exit 1
|
|
fi
|
|
echo "ref=$REF" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Checkout healthchat-workspace
|
|
uses: actions/checkout@v4
|
|
with:
|
|
repository: Novaloop-AG/healthchat-workspace
|
|
path: healthchat-workspace
|
|
token: ${{ secrets.HEALTHCHAT_WORKSPACE_TOKEN }}
|
|
ref: ${{ steps.workspace.outputs.ref }}
|
|
persist-credentials: false
|
|
|
|
# v6.0.8 reads the pnpm version from devEngines.packageManager in package.json
|
|
# (this repo has no top-level "packageManager" field, which older majors require).
|
|
- uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: "pnpm"
|
|
|
|
- name: Install monorepo deps
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Build element-plugin
|
|
run: |
|
|
cd healthchat-workspace/element-plugin
|
|
npm ci
|
|
npm run build
|
|
cd module
|
|
npm ci
|
|
npm run build
|
|
|
|
- name: Stage plugin artifacts
|
|
run: |
|
|
mkdir -p plugin-dist/elements
|
|
cp healthchat-workspace/element-plugin/module/dist/healthchat-module.js plugin-dist/healthchat-module.js
|
|
cp healthchat-workspace/element-plugin/dist/elements/browser/main.js plugin-dist/elements/healthchat-elements.js
|
|
|
|
- name: Build webapp with plugin injected
|
|
env:
|
|
VERSION: ${{ steps.version.outputs.version }}
|
|
run: ./apps/desktop/scripts/build-healthchat-webapp.sh
|
|
|
|
- uses: actions/upload-artifact@v4
|
|
with:
|
|
name: healthchat-webapp
|
|
retention-days: 1
|
|
path: apps/desktop/webapp
|
|
|
|
prepare:
|
|
name: Prepare desktop asar
|
|
needs: webapp
|
|
permissions:
|
|
contents: read
|
|
uses: ./.github/workflows/build_desktop_prepare.yaml
|
|
with:
|
|
repository: ${{ github.repository }}
|
|
ref: ${{ github.sha }}
|
|
config: element.io/healthchat
|
|
webapp-artifact: healthchat-webapp
|
|
# 'develop' skips the upstream "[Release] Fetch release" / Debian changelog step,
|
|
# which would look for a non-existent v<package.json-version> release in this fork.
|
|
version: develop
|
|
nightly: false
|
|
deploy: false
|
|
|
|
macos:
|
|
name: macOS
|
|
needs: prepare
|
|
permissions:
|
|
contents: read
|
|
uses: ./.github/workflows/build_desktop_macos.yaml
|
|
secrets: inherit # zizmor: ignore[secrets-inherit]
|
|
with:
|
|
repository: ${{ github.repository }}
|
|
ref: ${{ github.sha }}
|
|
sign: true
|
|
test: false
|
|
targets: "dmg zip"
|
|
# Generates dist/releases.json (the Squirrel.Mac feed manifest). The reusable appends
|
|
# `/update/macos/<zip>` to this, so the in-manifest URL becomes
|
|
# https://healthchat.ch/packages/desktop/update/macos/<zip>, matching where the
|
|
# `release` job publishes the feed. Keep in sync with update_base_url in
|
|
# element.io/healthchat/config.json (.../packages/desktop/update/).
|
|
base-url: https://healthchat.ch/packages/desktop
|
|
|
|
windows:
|
|
name: Windows ${{ matrix.arch }}
|
|
needs: prepare
|
|
permissions:
|
|
contents: read
|
|
strategy:
|
|
matrix:
|
|
arch: [x64, arm64]
|
|
uses: ./.github/workflows/build_desktop_windows.yaml
|
|
# element-desktop's Windows reusable signs via SSL.com eSigner CKA, whose secret names
|
|
# differ from the org-level CodeSignTool secrets shared with the other Novaloop apps
|
|
# (CKA needs no credential_id). Map them here. A trusted signature also requires the
|
|
# repo/org variable ESIGNER_MODE=prod (otherwise the reusable falls back to the untrusted
|
|
# sandbox demo cert).
|
|
secrets:
|
|
ESIGNER_USER_NAME: ${{ secrets.ESIGNER_USERNAME }}
|
|
ESIGNER_USER_PASSWORD: ${{ secrets.ESIGNER_PASSWORD }}
|
|
ESIGNER_USER_TOTP: ${{ secrets.ESIGNER_TOTP_SECRET }}
|
|
with:
|
|
repository: ${{ github.repository }}
|
|
ref: ${{ github.sha }}
|
|
arch: ${{ matrix.arch }}
|
|
sign: true
|
|
test: false
|
|
targets: "squirrel msi"
|
|
|
|
release:
|
|
name: Publish to GitHub Release
|
|
needs: [macos, windows]
|
|
# Only publish on a real tag push; manual workflow_dispatch runs build but do not publish.
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- name: Download all build artifacts
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
|
with:
|
|
path: dist-artifacts
|
|
|
|
- name: Collect installers
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir -p release-files
|
|
# macOS: .dmg installer + .zip (Squirrel.Mac update payload)
|
|
find dist-artifacts -type f \( -iname '*.dmg' -o -iname '*-mac.zip' \) -exec cp -v {} release-files/ \;
|
|
# Windows: per-machine MSI + Squirrel "Setup" installer
|
|
find dist-artifacts -type f \( -iname '*.msi' -o -iname '* Setup*.exe' \) -exec cp -v {} release-files/ \;
|
|
echo "--- release files ---"
|
|
ls -la release-files
|
|
test -n "$(ls -A release-files)" || { echo "::error::No installer files collected"; exit 1; }
|
|
|
|
- name: Upload to GitHub Release
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
GH_REPO: ${{ github.repository }}
|
|
TAG: ${{ github.ref_name }}
|
|
run: |
|
|
set -euo pipefail
|
|
# The web workflow (build-healthchat.yaml) also creates this release for the same tag.
|
|
# Create-if-missing (without touching existing notes) then upload --clobber so the two
|
|
# workflows race safely regardless of ordering.
|
|
gh release view "$TAG" >/dev/null 2>&1 || \
|
|
gh release create "$TAG" --title "$TAG" --notes "HealthChat desktop installers for $TAG"
|
|
gh release upload "$TAG" release-files/* --clobber
|
|
|
|
# The GitHub Release above is private (internal fork), so it can't serve end users or the
|
|
# Squirrel auto-updater. Mirror the update feed + public installers to healthchat.ch over
|
|
# FTPS so installed apps self-update (update_base_url -> .../packages/desktop/update/) and
|
|
# users can download from a public URL (.../packages/desktop/install/).
|
|
- name: Stage update feed + public installers
|
|
run: |
|
|
set -euo pipefail
|
|
# --- macOS update feed: releases.json (Squirrel.Mac manifest) + signed *-mac.zip payload ---
|
|
mkdir -p feed/update/macos feed/install/macos
|
|
test -f dist-artifacts/macos/releases.json || {
|
|
echo "::error::dist-artifacts/macos/releases.json missing (did the macos job get base-url?)"; exit 1; }
|
|
cp -v dist-artifacts/macos/releases.json feed/update/macos/
|
|
find dist-artifacts/macos -type f -iname '*-mac.zip' -exec cp -v {} feed/update/macos/ \;
|
|
# --- macOS installer: versioned .dmg + a stable "latest" copy ---
|
|
find dist-artifacts/macos -type f -iname '*.dmg' -exec cp -v {} feed/install/macos/ \;
|
|
dmg=$(find feed/install/macos -type f -iname '*.dmg' | head -n1)
|
|
test -n "$dmg" && cp -v "$dmg" feed/install/macos/HealthChat.dmg
|
|
# --- Windows: per-arch Squirrel feed (RELEASES + full nupkg) + installers (Setup.exe, msi) ---
|
|
for arch in x64 arm64; do
|
|
src="dist-artifacts/win-$arch"
|
|
[ -d "$src" ] || { echo "::error::$src missing"; exit 1; }
|
|
mkdir -p "feed/update/win32/$arch" "feed/install/win32/$arch"
|
|
find "$src" -type f -iname 'RELEASES' -exec cp -v {} "feed/update/win32/$arch/" \;
|
|
find "$src" -type f -iname '*-full.nupkg' -exec cp -v {} "feed/update/win32/$arch/" \;
|
|
find "$src" -type f -iname '* Setup*.exe' -exec cp -v {} "feed/install/win32/$arch/" \;
|
|
find "$src" -type f -iname '*.msi' -exec cp -v {} "feed/install/win32/$arch/" \;
|
|
setup=$(find "feed/install/win32/$arch" -type f -iname '* Setup*.exe' | head -n1)
|
|
test -n "$setup" && cp -v "$setup" "feed/install/win32/$arch/HealthChat-Setup.exe"
|
|
done
|
|
echo "--- staged feed tree ---"
|
|
find feed -type f | sort
|
|
|
|
- name: Install lftp
|
|
run: sudo apt-get update && sudo apt-get install -y lftp
|
|
|
|
- name: Publish to healthchat.ch over FTPS
|
|
env:
|
|
FTP_SERVER: ${{ secrets.FTP_SERVER }}
|
|
FTP_USERNAME: ${{ secrets.FTP_USERNAME }}
|
|
# Passed to lftp via LFTP_PASSWORD (--env-password) so it never appears on the
|
|
# command line / process list.
|
|
LFTP_PASSWORD: ${{ secrets.FTP_PASSWORD }}
|
|
run: |
|
|
set -euo pipefail
|
|
: "${FTP_SERVER:?FTP_SERVER secret not set}"
|
|
: "${FTP_USERNAME:?FTP_USERNAME secret not set}"
|
|
: "${LFTP_PASSWORD:?FTP_PASSWORD secret not set}"
|
|
# mirror -R (reverse) uploads the local tree; default is no-delete, so prior
|
|
# *.nupkg are preserved (Squirrel.Windows delta history) and only the staged files
|
|
# are written/overwritten. If the host's FTPS cert is untrusted, set
|
|
# ssl:verify-certificate to no.
|
|
lftp -u "$FTP_USERNAME" --env-password "$FTP_SERVER" <<'LFTP'
|
|
set cmd:fail-exit true
|
|
set ftp:ssl-force true
|
|
set ftp:ssl-protect-data true
|
|
set ssl:verify-certificate true
|
|
mkdir -pf /public_html/healthchat.ch/packages/desktop
|
|
mirror -R --parallel=4 --verbose feed/ /public_html/healthchat.ch/packages/desktop/
|
|
bye
|
|
LFTP
|