feat(license): separate app-entry and per-pack activation codes #7
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Bundle Hot Update Checks | |
| on: | |
| pull_request: | |
| paths: | |
| - ".github/workflows/bundle-hot-*.yml" | |
| - ".github/workflows/electron-release.yml" | |
| - "apps/workspace/bundle-update.json" | |
| - "apps/workspace/electron/**" | |
| - "apps/workspace/scripts/**" | |
| - "apps/workspace/src/**" | |
| - "apps/workspace/package.json" | |
| - "pnpm-lock.yaml" | |
| - "Taskfile.yml" | |
| - "scripts/build-server-target.mjs" | |
| - "scripts/sync-workspace-dist.mjs" | |
| - "docs/hot-update-architecture.md" | |
| - "packages/vendor/**" | |
| - "services/server/**" | |
| push: | |
| branches: | |
| - dev | |
| paths: | |
| - ".github/workflows/bundle-hot-*.yml" | |
| - ".github/workflows/electron-release.yml" | |
| - "apps/workspace/bundle-update.json" | |
| - "apps/workspace/electron/**" | |
| - "apps/workspace/scripts/**" | |
| - "apps/workspace/src/**" | |
| - "apps/workspace/package.json" | |
| - "pnpm-lock.yaml" | |
| - "Taskfile.yml" | |
| - "scripts/build-server-target.mjs" | |
| - "scripts/sync-workspace-dist.mjs" | |
| - "docs/hot-update-architecture.md" | |
| - "packages/vendor/**" | |
| - "services/server/**" | |
| permissions: | |
| contents: read | |
| env: | |
| HUSKY: "0" | |
| NODE_VERSION: "24" | |
| PNPM_VERSION: "11.9.0" | |
| jobs: | |
| checks: | |
| name: Bundle safety and reproducibility | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| fetch-depth: 0 | |
| - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6 | |
| with: | |
| version: ${{ env.PNPM_VERSION }} | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: pnpm | |
| cache-dependency-path: pnpm-lock.yaml | |
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 | |
| with: | |
| go-version-file: go.work | |
| cache-dependency-path: | | |
| go.work.sum | |
| **/go.sum | |
| - uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2 | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Format and lint hot-update sources | |
| working-directory: apps/workspace | |
| run: | | |
| pnpm exec oxfmt --check electron/src scripts/package-bundle-update.ts scripts/hot-update-local-test.ts scripts/stage-electron-app.ts scripts/check-bundle-version-bumps.mjs | |
| pnpm exec oxlint electron/src scripts/package-bundle-update.ts scripts/hot-update-local-test.ts scripts/stage-electron-app.ts scripts/check-bundle-version-bumps.mjs | |
| - name: Require schema and workspace-layout version bumps | |
| env: | |
| BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }} | |
| run: node apps/workspace/scripts/check-bundle-version-bumps.mjs "$BASE_SHA" | |
| - name: Compile Electron and run state-machine tests | |
| run: | | |
| pnpm --dir apps/workspace electron:compile | |
| pnpm --dir apps/workspace exec vitest run electron/src | |
| - name: Build renderer | |
| env: | |
| VITE_ELECTRON_BUILD: "1" | |
| VITE_MEDIAGO_EDITION: community | |
| VITE_MEDIAGO_SERVER_PORT: "48273" | |
| run: pnpm --dir apps/workspace build | |
| - name: Package determinism smoke test | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| private_key="$(node -e 'const {generateKeyPairSync}=require("node:crypto"); const {privateKey}=generateKeyPairSync("ed25519"); process.stdout.write(privateKey.export({format:"der",type:"pkcs8"}).toString("base64"))')" | |
| export RENDERER_UPDATE_PRIVATE_KEY="$private_key" | |
| export RENDERER_UPDATE_EXPECTED_PUBLIC_KEY="$(PRIVATE_KEY="$private_key" node -e 'const {createPrivateKey,createPublicKey}=require("node:crypto"); const key=createPrivateKey({key:Buffer.from(process.env.PRIVATE_KEY,"base64"),format:"der",type:"pkcs8"}); process.stdout.write(createPublicKey(key).export({format:"der",type:"spki"}).toString("base64"))')" | |
| export RENDERER_UPDATE_CHANNEL="beta" | |
| export RENDERER_UPDATE_EDITION="community" | |
| export MEDIAGO_BUNDLE_SCHEMA_VERSION="$(node -p 'JSON.parse(require("node:fs").readFileSync("apps/workspace/bundle-update.json", "utf8")).schemaVersion')" | |
| export MEDIAGO_BUNDLE_WORKSPACE_LAYOUT_VERSION="$(node -p 'JSON.parse(require("node:fs").readFileSync("apps/workspace/bundle-update.json", "utf8")).workspaceLayoutVersion')" | |
| export MEDIAGO_SERVER_BINARY_DARWIN_ARM64="/bin/true" | |
| export MEDIAGO_SERVER_BINARY_WINDOWS_X64="/bin/true" | |
| node apps/workspace/scripts/package-bundle-update.ts | |
| find apps/workspace/release/bundle -type f -print0 | sort -z | xargs -0 sha256sum > "$RUNNER_TEMP/first.sha256" | |
| node apps/workspace/scripts/package-bundle-update.ts | |
| find apps/workspace/release/bundle -type f -print0 | sort -z | xargs -0 sha256sum > "$RUNNER_TEMP/second.sha256" | |
| diff -u "$RUNNER_TEMP/first.sha256" "$RUNNER_TEMP/second.sha256" | |
| - name: Go server race tests | |
| working-directory: services/server | |
| run: task test |