Unbreak the Windows release build #6
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Build OpenView release binaries for desktop + Android APK. | |
| # | |
| # Triggers: | |
| # - Git tags matching v* (e.g. v3.0.0) → create a GitHub Release | |
| # - workflow_dispatch → manual build; upload workflow artifacts only | |
| # | |
| # Artifacts: | |
| # OpenView-linux-x64.zip | |
| # OpenView-windows-x64.zip | |
| # OpenView-macos-arm64.zip (ad-hoc signed — see the macOS job) | |
| # SHA256SUMS.txt | |
| # | |
| # Desktop only. Mobile ships through the App Store and Google Play, and the | |
| # Android APK / iOS pipeline is tracked separately — do not add a mobile job | |
| # here without also sorting out release signing (see docs/mobile-deployment.md). | |
| name: Release builds | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: false | |
| env: | |
| # Releases pin an exact Flutter version so a rebuild of a tag is reproducible | |
| # and a bad upstream stable can never silently break a release. | |
| FLUTTER_VERSION: 3.44.6 | |
| jobs: | |
| # ── Guard: tag must match the pubspec version ────────────────────────── | |
| # Cheap job that fails in ~10s rather than after four platform builds. | |
| version: | |
| name: Check version | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| - name: Tag matches pubspec version | |
| if: startsWith(github.ref, 'refs/tags/') | |
| run: | | |
| tag="${GITHUB_REF_NAME#v}" # v3.0.0 → 3.0.0 | |
| pubspec=$(grep -m1 '^version:' pubspec.yaml | awk '{print $2}') | |
| echo "tag=$tag pubspec=$pubspec" | |
| if [ "$tag" != "${pubspec%%+*}" ]; then | |
| echo "::error::Tag $GITHUB_REF_NAME does not match pubspec version $pubspec." \ | |
| "Bump pubspec.yaml or retag." | |
| exit 1 | |
| fi | |
| # ── Linux desktop ────────────────────────────────────────────────────── | |
| linux: | |
| name: Linux x64 | |
| needs: version | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| - name: Setup Flutter | |
| uses: subosito/flutter-action@v2 | |
| with: | |
| flutter-version: ${{ env.FLUTTER_VERSION }} | |
| channel: stable | |
| cache: true | |
| - name: Install system packages | |
| run: | | |
| sudo apt-get update -y | |
| sudo apt-get install -y \ | |
| clang cmake ninja-build pkg-config \ | |
| libgtk-3-dev liblzma-dev libstdc++-12-dev \ | |
| libudev-dev | |
| - name: Flutter config & deps | |
| run: | | |
| flutter config --enable-linux-desktop | |
| flutter pub get | |
| - name: Build Linux release | |
| run: flutter build linux --release | |
| - name: Package | |
| run: | | |
| cd build/linux/x64/release/bundle | |
| zip -r "$GITHUB_WORKSPACE/OpenView-linux-x64.zip" . | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: OpenView-linux-x64 | |
| path: OpenView-linux-x64.zip | |
| if-no-files-found: error | |
| # ── Windows desktop ──────────────────────────────────────────────────── | |
| windows: | |
| name: Windows x64 | |
| needs: version | |
| runs-on: windows-latest | |
| timeout-minutes: 60 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| - name: Setup Flutter | |
| uses: subosito/flutter-action@v2 | |
| with: | |
| flutter-version: ${{ env.FLUTTER_VERSION }} | |
| channel: stable | |
| cache: true | |
| - name: Flutter config & deps | |
| run: | | |
| flutter config --enable-windows-desktop | |
| flutter pub get | |
| - name: Build Windows release | |
| env: | |
| # MSVC 14.51 (VS 18, on windows-latest) makes <experimental/coroutine> | |
| # a hard error — STL1011 — and permission_handler_windows still | |
| # includes it. cl.exe picks up extra flags from the CL env var, so we | |
| # can silence it here instead of patching the plugin. Remove once | |
| # permission_handler_windows moves to <coroutine>. | |
| CL: /D_SILENCE_EXPERIMENTAL_COROUTINE_DEPRECATION_WARNINGS | |
| run: flutter build windows --release | |
| - name: Package | |
| shell: pwsh | |
| run: | | |
| Compress-Archive -Path build/windows/x64/runner/Release/* ` | |
| -DestinationPath OpenView-windows-x64.zip -Force | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: OpenView-windows-x64 | |
| path: OpenView-windows-x64.zip | |
| if-no-files-found: error | |
| # ── macOS desktop ────────────────────────────────────────────────────── | |
| # The Xcode project uses Automatic signing with a DEVELOPMENT_TEAM, so a plain | |
| # `flutter build macos` on a runner fails ("No signing certificate 'Mac | |
| # Development' found"). We therefore configure with Flutter and build with | |
| # xcodebuild, overriding the signing settings on the command line (command-line | |
| # settings outrank the ones baked into project.pbxproj). | |
| # | |
| # The app is ad-hoc signed: it runs, but it is not notarized, so Gatekeeper | |
| # shows "Apple cannot check it for malicious software" on first launch and the | |
| # user must right-click → Open (or clear the quarantine bit). Developer ID | |
| # signing + notarization is a follow-up — the AC_CERTIFICATE / APPLE_* secrets | |
| # for it already exist in this repo. | |
| macos: | |
| name: macOS arm64 | |
| needs: version | |
| runs-on: macos-latest | |
| timeout-minutes: 90 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| - name: Setup Flutter | |
| uses: subosito/flutter-action@v2 | |
| with: | |
| flutter-version: ${{ env.FLUTTER_VERSION }} | |
| channel: stable | |
| cache: true | |
| - name: Install build tools (libserialport) | |
| run: brew install automake libtool | |
| - name: Flutter config & deps | |
| run: | | |
| flutter config --enable-macos-desktop | |
| flutter pub get | |
| - name: Build macOS release | |
| run: | | |
| # Generate the ephemeral xcconfig / plugin registrant without building. | |
| flutter build macos --release --config-only | |
| xcodebuild \ | |
| -workspace macos/Runner.xcworkspace \ | |
| -scheme Runner \ | |
| -configuration Release \ | |
| -derivedDataPath "$RUNNER_TEMP/dd" \ | |
| CODE_SIGN_STYLE=Manual \ | |
| CODE_SIGN_IDENTITY=- \ | |
| PROVISIONING_PROFILE_SPECIFIER= \ | |
| build | |
| - name: Package | |
| run: | | |
| app="$RUNNER_TEMP/dd/Build/Products/Release/OpenView.app" | |
| if [ ! -d "$app" ]; then | |
| echo "::error::OpenView.app not found at $app" | |
| find "$RUNNER_TEMP/dd/Build/Products" -maxdepth 3 -name '*.app' || true | |
| exit 1 | |
| fi | |
| codesign --verify --strict --verbose=2 "$app" | |
| # ditto (not zip) preserves app-bundle metadata and symlinks. | |
| ditto -c -k --sequesterRsrc --keepParent "$app" OpenView-macos-arm64.zip | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: OpenView-macos-arm64 | |
| path: OpenView-macos-arm64.zip | |
| if-no-files-found: error | |
| # ── Publish GitHub Release (tags only) ───────────────────────────────── | |
| publish: | |
| name: Publish GitHub Release | |
| needs: [linux, windows, macos] | |
| if: startsWith(github.ref, 'refs/tags/') | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: release | |
| merge-multiple: true | |
| - name: Checksums | |
| working-directory: release | |
| run: | | |
| sha256sum ./*.zip | sed 's|\./||' | tee SHA256SUMS.txt | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| generate_release_notes: true | |
| fail_on_unmatched_files: true | |
| files: | | |
| release/OpenView-linux-x64.zip | |
| release/OpenView-windows-x64.zip | |
| release/OpenView-macos-arm64.zip | |
| release/SHA256SUMS.txt | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |