universo-platform-2d

1
name: Release Desktop App
2

3
on:
4
  workflow_dispatch:
5
    inputs:
6
      build-type:
7
        description: 'Build Type'
8
        type: choice
9
        required: true
10
        default: canary
11
        options:
12
          - canary
13
          - beta
14
          - stable
15
      is-draft:
16
        description: 'Draft Release?'
17
        type: boolean
18
        required: true
19
        default: true
20
      is-pre-release:
21
        description: 'Pre Release? (labeled as "PreRelease")'
22
        type: boolean
23
        required: true
24
        default: true
25

26
permissions:
27
  actions: write
28
  contents: write
29
  security-events: write
30
  id-token: write
31
  attestations: write
32

33
env:
34
  BUILD_TYPE: ${{ github.event.inputs.build-type }}
35
  DEBUG: napi:*
36
  APP_NAME: affine
37
  MACOSX_DEPLOYMENT_TARGET: '10.13'
38

39
jobs:
40
  before-make:
41
    runs-on: ubuntu-latest
42
    environment: ${{ github.event.inputs.build-type }}
43
    outputs:
44
      RELEASE_VERSION: ${{ steps.version.outputs.APP_VERSION }}
45
    steps:
46
      - uses: actions/checkout@v4
47
      - name: Setup Version
48
        id: version
49
        uses: ./.github/actions/setup-version
50
      - name: Setup Node.js
51
        uses: ./.github/actions/setup-node
52
      - name: Setup @sentry/cli
53
        uses: ./.github/actions/setup-sentry
54
      - name: generate-assets
55
        run: yarn workspace @affine/electron generate-assets
56
        env:
57
          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
58
          SENTRY_PROJECT: 'affine'
59
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
60
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
61
          SENTRY_RELEASE: ${{ steps.version.outputs.APP_VERSION }}
62
          RELEASE_VERSION: ${{ steps.version.outputs.APP_VERSION }}
63
          SKIP_NX_CACHE: 'true'
64
          MIXPANEL_TOKEN: ${{ secrets.MIXPANEL_TOKEN }}
65

66
      - name: Upload web artifact
67
        uses: actions/upload-artifact@v4
68
        with:
69
          name: web
70
          path: packages/frontend/apps/electron/resources/web-static
71

72
  make-distribution:
73
    strategy:
74
      matrix:
75
        spec:
76
          - runner: macos-14
77
            platform: darwin
78
            arch: x64
79
            target: x86_64-apple-darwin
80
          - runner: macos-14
81
            platform: darwin
82
            arch: arm64
83
            target: aarch64-apple-darwin
84
          - runner: ubuntu-latest
85
            platform: linux
86
            arch: x64
87
            target: x86_64-unknown-linux-gnu
88
    runs-on: ${{ matrix.spec.runner }}
89
    needs: before-make
90
    env:
91
      APPLE_ID: ${{ secrets.APPLE_ID }}
92
      APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
93
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
94
      SKIP_GENERATE_ASSETS: 1
95
      SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
96
      SENTRY_PROJECT: 'affine'
97
      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
98
      SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
99
      MIXPANEL_TOKEN: ${{ secrets.MIXPANEL_TOKEN }}
100
    steps:
101
      - uses: actions/checkout@v4
102
      - name: Setup Version
103
        id: version
104
        uses: ./.github/actions/setup-version
105
      - name: Setup Node.js
106
        timeout-minutes: 10
107
        uses: ./.github/actions/setup-node
108
        with:
109
          extra-flags: workspaces focus @affine/electron @affine/monorepo
110
          hard-link-nm: false
111
          nmHoistingLimits: workspaces
112
          enableScripts: false
113
      - name: Build AFFiNE native
114
        uses: ./.github/actions/build-rust
115
        with:
116
          target: ${{ matrix.spec.target }}
117
          package: '@affine/native'
118
          nx_token: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
119
      - uses: actions/download-artifact@v4
120
        with:
121
          name: web
122
          path: packages/frontend/apps/electron/resources/web-static
123

124
      - name: Build Desktop Layers
125
        run: yarn workspace @affine/electron build
126

127
      - name: Signing By Apple Developer ID
128
        if: ${{ matrix.spec.platform == 'darwin' }}
129
        uses: apple-actions/import-codesign-certs@v3
130
        with:
131
          p12-file-base64: ${{ secrets.CERTIFICATES_P12 }}
132
          p12-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }}
133

134
      - name: Install additional dependencies on Linux
135
        if: ${{ matrix.spec.platform == 'linux' }}
136
        run: |
137
          sudo add-apt-repository universe
138
          sudo apt install -y libfuse2 elfutils flatpak flatpak-builder
139
          flatpak remote-add --user --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
140
          flatpak update
141
          # some flatpak deps need git protocol.file.allow
142
          git config --global protocol.file.allow always
143

144
      - name: make
145
        run: yarn workspace @affine/electron make --platform=${{ matrix.spec.platform }} --arch=${{ matrix.spec.arch }}
146
        env:
147
          SKIP_WEB_BUILD: 1
148
          HOIST_NODE_MODULES: 1
149
          DEBUG: '*'
150

151
      - name: signing DMG
152
        if: ${{ matrix.spec.platform == 'darwin' }}
153
        run: |
154
          codesign --force --sign "Developer ID Application: TOEVERYTHING PTE. LTD." packages/frontend/apps/electron/out/${{ env.BUILD_TYPE }}/make/AFFiNE.dmg
155

156
      - name: Save artifacts (mac)
157
        if: ${{ matrix.spec.platform == 'darwin' }}
158
        run: |
159
          mkdir -p builds
160
          mv packages/frontend/apps/electron/out/*/make/*.dmg ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-macos-${{ matrix.spec.arch }}.dmg
161
          mv packages/frontend/apps/electron/out/*/make/zip/darwin/${{ matrix.spec.arch }}/*.zip ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-macos-${{ matrix.spec.arch }}.zip
162
      - name: Save artifacts (linux)
163
        if: ${{ matrix.spec.platform == 'linux' }}
164
        run: |
165
          mkdir -p builds
166
          mv packages/frontend/apps/electron/out/*/make/zip/linux/x64/*.zip ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-linux-x64.zip
167
          mv packages/frontend/apps/electron/out/*/make/*.AppImage ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-linux-x64.appimage
168
          mv packages/frontend/apps/electron/out/*/make/deb/x64/*.deb ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-linux-x64.deb
169
          mv packages/frontend/apps/electron/out/*/make/flatpak/*/*.flatpak ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-linux-x64.flatpak
170

171
      - uses: actions/attest-build-provenance@v1
172
        if: ${{ matrix.spec.platform == 'darwin' }}
173
        with:
174
          subject-path: |
175
            ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-macos-${{ matrix.spec.arch }}.zip
176
            ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-macos-${{ matrix.spec.arch }}.dmg
177

178
      - uses: actions/attest-build-provenance@v1
179
        if: ${{ matrix.spec.platform == 'linux' }}
180
        with:
181
          subject-path: |
182
            ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-linux-x64.zip
183
            ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-linux-x64.appimage
184
            ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-linux-x64.deb
185
      - name: Upload Artifact
186
        uses: actions/upload-artifact@v4
187
        with:
188
          name: affine-${{ matrix.spec.platform }}-${{ matrix.spec.arch }}-builds
189
          path: builds
190

191
  package-distribution-windows:
192
    strategy:
193
      matrix:
194
        spec:
195
          - runner: windows-latest
196
            platform: win32
197
            arch: x64
198
            target: x86_64-pc-windows-msvc
199
    runs-on: ${{ matrix.spec.runner }}
200
    needs: before-make
201
    outputs:
202
      FILES_TO_BE_SIGNED: ${{ steps.get_files_to_be_signed.outputs.FILES_TO_BE_SIGNED }}
203
    env:
204
      SKIP_GENERATE_ASSETS: 1
205
      SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
206
      SENTRY_PROJECT: 'affine'
207
      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
208
      SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
209
      MIXPANEL_TOKEN: ${{ secrets.MIXPANEL_TOKEN }}
210
    steps:
211
      - uses: actions/checkout@v4
212
      - name: Setup Version
213
        id: version
214
        uses: ./.github/actions/setup-version
215
      - name: Setup Node.js
216
        timeout-minutes: 10
217
        uses: ./.github/actions/setup-node
218
        with:
219
          extra-flags: workspaces focus @affine/electron @affine/monorepo
220
          hard-link-nm: false
221
          nmHoistingLimits: workspaces
222
      - name: Build AFFiNE native
223
        uses: ./.github/actions/build-rust
224
        with:
225
          target: ${{ matrix.spec.target }}
226
          package: '@affine/native'
227
          nx_token: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
228
      - uses: actions/download-artifact@v4
229
        with:
230
          name: web
231
          path: packages/frontend/apps/electron/resources/web-static
232

233
      - name: Build Desktop Layers
234
        run: yarn workspace @affine/electron build
235

236
      - name: package
237
        run: yarn workspace @affine/electron package --platform=${{ matrix.spec.platform }} --arch=${{ matrix.spec.arch }}
238
        env:
239
          SKIP_WEB_BUILD: 1
240
          HOIST_NODE_MODULES: 1
241

242
      - name: get all files to be signed
243
        id: get_files_to_be_signed
244
        run: |
245
          Set-Variable -Name FILES_TO_BE_SIGNED -Value ((Get-ChildItem -Path packages/frontend/apps/electron/out -Recurse -File | Where-Object { $_.Extension -in @(".exe", ".node", ".dll", ".msi") } | ForEach-Object { '"' + $_.FullName.Replace((Get-Location).Path + '\packages\frontend\apps\electron\out\', '') + '"' }) -join ' ')
246
          "FILES_TO_BE_SIGNED=$FILES_TO_BE_SIGNED" >> $env:GITHUB_OUTPUT
247
          echo $FILES_TO_BE_SIGNED
248

249
      - name: Zip artifacts for faster upload
250
        run: Compress-Archive -CompressionLevel Fastest -Path packages/frontend/apps/electron/out/* -DestinationPath archive.zip
251

252
      - name: Save packaged artifacts for signing
253
        uses: actions/upload-artifact@v4
254
        with:
255
          name: packaged-${{ matrix.spec.platform }}-${{ matrix.spec.arch }}
256
          path: |
257
            archive.zip
258
            !**/*.map
259

260
  sign-packaged-artifacts-windows:
261
    needs: package-distribution-windows
262
    uses: ./.github/workflows/windows-signer.yml
263
    with:
264
      files: ${{ needs.package-distribution-windows.outputs.FILES_TO_BE_SIGNED }}
265
      artifact-name: packaged-win32-x64
266

267
  make-windows-installer:
268
    needs: sign-packaged-artifacts-windows
269
    strategy:
270
      matrix:
271
        spec:
272
          - runner: windows-latest
273
            platform: win32
274
            arch: x64
275
            target: x86_64-pc-windows-msvc
276
    runs-on: ${{ matrix.spec.runner }}
277
    outputs:
278
      FILES_TO_BE_SIGNED: ${{ steps.get_files_to_be_signed.outputs.FILES_TO_BE_SIGNED }}
279
    steps:
280
      - uses: actions/checkout@v4
281
      - name: Setup Version
282
        id: version
283
        uses: ./.github/actions/setup-version
284
      - name: Setup Node.js
285
        timeout-minutes: 10
286
        uses: ./.github/actions/setup-node
287
        with:
288
          extra-flags: workspaces focus @affine/electron @affine/monorepo
289
          hard-link-nm: false
290
          nmHoistingLimits: workspaces
291
      - name: Download and overwrite packaged artifacts
292
        uses: actions/download-artifact@v4
293
        with:
294
          name: signed-packaged-${{ matrix.spec.platform }}-${{ matrix.spec.arch }}
295
          path: .
296
      - name: unzip file
297
        run: Expand-Archive -Path signed.zip -DestinationPath packages/frontend/apps/electron/out
298

299
      - name: Make squirrel.windows installer
300
        run: yarn workspace @affine/electron make-squirrel --platform=${{ matrix.spec.platform }} --arch=${{ matrix.spec.arch }}
301

302
      - name: Make nsis.windows installer
303
        run: yarn workspace @affine/electron make-nsis --platform=${{ matrix.spec.platform }} --arch=${{ matrix.spec.arch }}
304

305
      - name: Zip artifacts for faster upload
306
        run: Compress-Archive -CompressionLevel Fastest -Path packages/frontend/apps/electron/out/${{ env.BUILD_TYPE }}/make/* -DestinationPath archive.zip
307

308
      - name: get all files to be signed
309
        id: get_files_to_be_signed
310
        run: |
311
          Set-Variable -Name FILES_TO_BE_SIGNED -Value ((Get-ChildItem -Path packages/frontend/apps/electron/out/${{ env.BUILD_TYPE }}/make -Recurse -File | Where-Object { $_.Extension -in @(".exe", ".node", ".dll", ".msi") } | ForEach-Object { '"' + $_.FullName.Replace((Get-Location).Path + '\packages\frontend\apps\electron\out\${{ env.BUILD_TYPE }}\make\', '') + '"' }) -join ' ')
312
          "FILES_TO_BE_SIGNED=$FILES_TO_BE_SIGNED" >> $env:GITHUB_OUTPUT
313
          echo $FILES_TO_BE_SIGNED
314

315
      - name: Save installer for signing
316
        uses: actions/upload-artifact@v4
317
        with:
318
          name: installer-${{ matrix.spec.platform }}-${{ matrix.spec.arch }}
319
          path: archive.zip
320

321
  sign-installer-artifacts-windows:
322
    needs: make-windows-installer
323
    uses: ./.github/workflows/windows-signer.yml
324
    with:
325
      files: ${{ needs.make-windows-installer.outputs.FILES_TO_BE_SIGNED }}
326
      artifact-name: installer-win32-x64
327

328
  finalize-installer-windows:
329
    needs: [sign-installer-artifacts-windows, before-make]
330
    strategy:
331
      matrix:
332
        spec:
333
          - runner: windows-latest
334
            platform: win32
335
            arch: x64
336
            target: x86_64-pc-windows-msvc
337
    runs-on: ${{ matrix.spec.runner }}
338
    steps:
339
      - name: Download and overwrite installer artifacts
340
        uses: actions/download-artifact@v4
341
        with:
342
          name: signed-installer-${{ matrix.spec.platform }}-${{ matrix.spec.arch }}
343
          path: .
344
      - name: unzip file
345
        run: Expand-Archive -Path signed.zip -DestinationPath packages/frontend/apps/electron/out/${{ env.BUILD_TYPE }}/make
346

347
      - name: Save artifacts
348
        run: |
349
          mkdir -p builds
350
          mv packages/frontend/apps/electron/out/*/make/zip/win32/x64/AFFiNE*-win32-x64-*.zip ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-windows-x64.zip
351
          mv packages/frontend/apps/electron/out/*/make/squirrel.windows/x64/*.exe ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-windows-x64.exe
352
          mv packages/frontend/apps/electron/out/*/make/nsis.windows/x64/*.exe ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-windows-x64.nsis.exe
353

354
      - uses: actions/attest-build-provenance@v1
355
        with:
356
          subject-path: |
357
            ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-windows-x64.zip
358
            ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-windows-x64.exe
359
            ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-windows-x64.nsis.exe
360

361
      - name: Upload Artifact
362
        uses: actions/upload-artifact@v4
363
        with:
364
          name: affine-${{ matrix.spec.platform }}-${{ matrix.spec.arch }}-builds
365
          path: builds
366

367
  release:
368
    needs: [before-make, make-distribution, finalize-installer-windows]
369
    runs-on: ubuntu-latest
370

371
    steps:
372
      - uses: actions/checkout@v4
373
      - uses: actions/download-artifact@v4
374
        with:
375
          name: web
376
          path: web-static
377
      - name: Zip web-static
378
        run: zip -r web-static.zip web-static
379
      - name: Download Artifacts (macos-x64)
380
        uses: actions/download-artifact@v4
381
        with:
382
          name: affine-darwin-x64-builds
383
          path: ./
384
      - name: Download Artifacts (macos-arm64)
385
        uses: actions/download-artifact@v4
386
        with:
387
          name: affine-darwin-arm64-builds
388
          path: ./
389
      - name: Download Artifacts (windows-x64)
390
        uses: actions/download-artifact@v4
391
        with:
392
          name: affine-win32-x64-builds
393
          path: ./
394
      - name: Download Artifacts (linux-x64)
395
        uses: actions/download-artifact@v4
396
        with:
397
          name: affine-linux-x64-builds
398
          path: ./
399
      - uses: actions/setup-node@v4
400
        with:
401
          node-version: 20
402
      - name: Generate Release yml
403
        run: |
404
          node ./packages/frontend/apps/electron/scripts/generate-yml.js
405
        env:
406
          RELEASE_VERSION: ${{ needs.before-make.outputs.RELEASE_VERSION }}
407
      - name: Create Release Draft
408
        if: ${{ github.ref_type == 'tag' }}
409
        uses: softprops/action-gh-release@v2
410
        with:
411
          name: ${{ needs.before-make.outputs.RELEASE_VERSION }}
412
          body: ''
413
          draft: ${{ github.event.inputs.is-draft }}
414
          prerelease: ${{ github.event.inputs.is-pre-release }}
415
          files: |
416
            ./VERSION
417
            ./*.zip
418
            ./*.dmg
419
            ./*.exe
420
            ./*.appimage
421
            ./*.deb
422
            ./*.flatpak
423
            ./*.apk
424
            ./*.yml
425
      - name: Create Nightly Release Draft
426
        if: ${{ github.ref_type == 'branch' }}
427
        uses: softprops/action-gh-release@v2
428
        env:
429
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
430
        with:
431
          # Temporarily, treat release from branch as nightly release, artifact saved to AFFiNE-Releases.
432
          # Need to improve internal build and nightly release logic.
433
          repository: 'toeverything/AFFiNE-Releases'
434
          name: ${{ needs.before-make.outputs.RELEASE_VERSION }}
435
          tag_name: ${{ needs.before-make.outputs.RELEASE_VERSION }}
436
          body: ''
437
          draft: false
438
          prerelease: true
439
          files: |
440
            ./VERSION
441
            ./*.zip
442
            ./*.dmg
443
            ./*.exe
444
            ./*.appimage
445
            ./*.deb
446
            ./*.apk
447
            ./*.flatpak
448
            ./*.yml
449