mirror of
https://github.com/Novaloop-AG/healthchat-web.git
synced 2026-10-31 16:23:03 +00:00
joel.poyet
f6925dbd77
Extend the HealthChat desktop pipeline beyond Linux to produce fully branded, signed Windows (.exe/.msi) and macOS (.dmg/.zip) installers, published to the GitHub Release on the healthchat-v* tag alongside the web build. - Add HealthChat desktop icons (icon.png/ico + Apple Icon Composer bundle), derived from apps/web/res/vector-icons/1024.png - Point the reusable build workflows at this fork (new repository/ref inputs) so the Electron shell, icons and healthchat:// handler are fork-branded - Relax hardcoded Element*/element-desktop* filename asserts to be product-name-agnostic - Wire signed macOS + Windows jobs into build-healthchat-desktop.yaml, trigger it on healthchat-v* tags, and add a release job that uploads installers - Map the org-level eSigner secrets to the CKA names the reusable expects - Document signing setup (Apple env, eSigner mapping, ESIGNER_MODE=prod) in the desktop README and releasing-healthchat skill
246 lines
10 KiB
YAML
246 lines
10 KiB
YAML
name: Build HealthChat Desktop
|
|
|
|
# Builds the HealthChat desktop (Electron) app for Linux, macOS and Windows: the fork's
|
|
# element-web webapp with the HealthChat plugin (healthchat-module.js + healthchat-elements.js)
|
|
# injected, packaged via the element-desktop build pipeline and published to the GitHub Release.
|
|
#
|
|
# This is the desktop counterpart of build-healthchat.yaml (web). On a `healthchat-v*` tag it
|
|
# runs alongside the web build; it first builds the element-plugin from healthchat-workspace,
|
|
# builds the fork webapp with the plugin injected, then feeds it into build_desktop_prepare.yaml
|
|
# (via `webapp-artifact`) and the per-platform build_desktop_{linux,macos,windows}.yaml reusables.
|
|
#
|
|
# Notes:
|
|
# - The reusable build workflows are pointed at THIS fork (repository/ref inputs) so the Electron
|
|
# shell, icons (apps/desktop/build/icon.*) and the healthchat:// deep-link handler
|
|
# (apps/desktop/src/protocol.ts) are all fork-branded. Branding values come from
|
|
# apps/desktop/element.io/healthchat/{build.json,config.json} (-> variant.json).
|
|
# - macOS notarisation and Windows code-signing require the `Desktop Apple` / `Desktop eSigner`
|
|
# GitHub environments (secrets/vars) to be configured. Without them the builds still run but
|
|
# produce unsigned/untrusted output. See apps/desktop/element.io/healthchat/README.
|
|
# - The desktop app version comes from apps/desktop/package.json (electron-builder), NOT the tag
|
|
# (Windows squirrel rewrites any `version` override into a nightly string). Bump
|
|
# apps/desktop/package.json in the release commit if you want it to match the tag.
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "healthchat-v*"
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: "Version (e.g. 1.4.0). Used for the web bundle version; the desktop app version comes from apps/desktop/package.json."
|
|
required: true
|
|
type: string
|
|
workspace_ref:
|
|
description: "healthchat-workspace ref (defaults to .healthchat-workspace-version)."
|
|
required: false
|
|
type: string
|
|
|
|
permissions: {}
|
|
|
|
concurrency:
|
|
group: build-healthchat-desktop-${{ github.event.inputs.version || github.ref_name }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
webapp:
|
|
name: Build webapp + plugin
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Resolve version
|
|
id: version
|
|
env:
|
|
INPUT_VERSION: ${{ github.event.inputs.version }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
|
|
VERSION="${GITHUB_REF_NAME#healthchat-v}"
|
|
elif [[ -n "${INPUT_VERSION:-}" ]]; then
|
|
VERSION="${INPUT_VERSION}"
|
|
else
|
|
echo "::error::No version available (not a tag push and no version input)"
|
|
exit 1
|
|
fi
|
|
if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
|
|
echo "::error::Invalid version '$VERSION'"
|
|
exit 1
|
|
fi
|
|
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Resolve workspace ref
|
|
id: workspace
|
|
env:
|
|
OVERRIDE: ${{ github.event.inputs.workspace_ref }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ -n "$OVERRIDE" ]]; then
|
|
REF="$OVERRIDE"
|
|
elif [[ -f .healthchat-workspace-version ]]; then
|
|
REF=$(head -n1 .healthchat-workspace-version | tr -d '[:space:]')
|
|
[[ -n "$REF" ]] || { echo "::error::.healthchat-workspace-version is empty"; exit 1; }
|
|
else
|
|
echo "::error::.healthchat-workspace-version missing and no workspace_ref override provided"
|
|
exit 1
|
|
fi
|
|
echo "ref=$REF" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Checkout healthchat-workspace
|
|
uses: actions/checkout@v4
|
|
with:
|
|
repository: Novaloop-AG/healthchat-workspace
|
|
path: healthchat-workspace
|
|
token: ${{ secrets.HEALTHCHAT_WORKSPACE_TOKEN }}
|
|
ref: ${{ steps.workspace.outputs.ref }}
|
|
persist-credentials: false
|
|
|
|
- uses: pnpm/action-setup@v4
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: "pnpm"
|
|
|
|
- name: Install monorepo deps
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Build element-plugin
|
|
run: |
|
|
cd healthchat-workspace/element-plugin
|
|
npm ci
|
|
npm run build
|
|
cd module
|
|
npm ci
|
|
npm run build
|
|
|
|
- name: Stage plugin artifacts
|
|
run: |
|
|
mkdir -p plugin-dist/elements
|
|
cp healthchat-workspace/element-plugin/module/dist/healthchat-module.js plugin-dist/healthchat-module.js
|
|
cp healthchat-workspace/element-plugin/dist/elements/browser/main.js plugin-dist/elements/healthchat-elements.js
|
|
|
|
- name: Build webapp with plugin injected
|
|
env:
|
|
VERSION: ${{ steps.version.outputs.version }}
|
|
run: ./apps/desktop/scripts/build-healthchat-webapp.sh
|
|
|
|
- uses: actions/upload-artifact@v4
|
|
with:
|
|
name: healthchat-webapp
|
|
retention-days: 1
|
|
path: apps/desktop/webapp
|
|
|
|
prepare:
|
|
name: Prepare desktop asar
|
|
needs: webapp
|
|
permissions:
|
|
contents: read
|
|
uses: ./.github/workflows/build_desktop_prepare.yaml
|
|
with:
|
|
repository: ${{ github.repository }}
|
|
ref: ${{ github.sha }}
|
|
config: element.io/healthchat
|
|
webapp-artifact: healthchat-webapp
|
|
# 'develop' skips the upstream "[Release] Fetch release" / Debian changelog step,
|
|
# which would look for a non-existent v<package.json-version> release in this fork.
|
|
version: develop
|
|
nightly: false
|
|
deploy: false
|
|
|
|
linux:
|
|
name: Linux ${{ matrix.arch }}
|
|
needs: prepare
|
|
strategy:
|
|
matrix:
|
|
arch: [amd64, arm64]
|
|
uses: ./.github/workflows/build_desktop_linux.yaml
|
|
with:
|
|
repository: ${{ github.repository }}
|
|
ref: ${{ github.sha }}
|
|
arch: ${{ matrix.arch }}
|
|
sqlcipher: static
|
|
test: false
|
|
|
|
macos:
|
|
name: macOS
|
|
needs: prepare
|
|
uses: ./.github/workflows/build_desktop_macos.yaml
|
|
secrets: inherit # zizmor: ignore[secrets-inherit]
|
|
with:
|
|
repository: ${{ github.repository }}
|
|
ref: ${{ github.sha }}
|
|
sign: true
|
|
test: false
|
|
targets: "dmg zip"
|
|
|
|
windows:
|
|
name: Windows ${{ matrix.arch }}
|
|
needs: prepare
|
|
strategy:
|
|
matrix:
|
|
arch: [x64, arm64]
|
|
uses: ./.github/workflows/build_desktop_windows.yaml
|
|
# element-desktop's Windows reusable signs via SSL.com eSigner CKA, whose secret names
|
|
# differ from the org-level CodeSignTool secrets shared with the other Novaloop apps
|
|
# (CKA needs no credential_id). Map them here. A trusted signature also requires the
|
|
# repo/org variable ESIGNER_MODE=prod (otherwise the reusable falls back to the untrusted
|
|
# sandbox demo cert).
|
|
secrets:
|
|
ESIGNER_USER_NAME: ${{ secrets.ESIGNER_USERNAME }}
|
|
ESIGNER_USER_PASSWORD: ${{ secrets.ESIGNER_PASSWORD }}
|
|
ESIGNER_USER_TOTP: ${{ secrets.ESIGNER_TOTP_SECRET }}
|
|
with:
|
|
repository: ${{ github.repository }}
|
|
ref: ${{ github.sha }}
|
|
arch: ${{ matrix.arch }}
|
|
sign: true
|
|
test: false
|
|
targets: "squirrel msi"
|
|
|
|
release:
|
|
name: Publish to GitHub Release
|
|
needs: [linux, macos, windows]
|
|
# Only publish on a real tag push; manual workflow_dispatch runs build but do not publish.
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- name: Download all build artifacts
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
|
|
with:
|
|
path: dist-artifacts
|
|
|
|
- name: Collect installers
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir -p release-files
|
|
# macOS: .dmg installer + .zip (Squirrel.Mac update payload)
|
|
find dist-artifacts -type f \( -iname '*.dmg' -o -iname '*-mac.zip' \) -exec cp -v {} release-files/ \;
|
|
# Windows: per-machine MSI + Squirrel "Setup" installer
|
|
find dist-artifacts -type f \( -iname '*.msi' -o -iname '* Setup*.exe' \) -exec cp -v {} release-files/ \;
|
|
# Linux: portable tarball + Debian package
|
|
find dist-artifacts -type f \( -iname '*.tar.gz' -o -iname '*.deb' \) -exec cp -v {} release-files/ \;
|
|
echo "--- release files ---"
|
|
ls -la release-files
|
|
test -n "$(ls -A release-files)" || { echo "::error::No installer files collected"; exit 1; }
|
|
|
|
- name: Upload to GitHub Release
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
GH_REPO: ${{ github.repository }}
|
|
TAG: ${{ github.ref_name }}
|
|
run: |
|
|
set -euo pipefail
|
|
# The web workflow (build-healthchat.yaml) also creates this release for the same tag.
|
|
# Create-if-missing (without touching existing notes) then upload --clobber so the two
|
|
# workflows race safely regardless of ordering.
|
|
gh release view "$TAG" >/dev/null 2>&1 || \
|
|
gh release create "$TAG" --title "$TAG" --notes "HealthChat desktop installers for $TAG"
|
|
gh release upload "$TAG" release-files/* --clobber
|