switchify-pc/.github/workflows/ci.yml at c02ede8f55f448cd76f7712fcbdb6f54b7fa5fc2 · switchifyapp/switchify-pc · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
name: CI

on:
  pull_request:
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  dependency-audit:
    name: Dependency audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: package-lock.json
      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: 1.97.1
      - run: npm ci
      - run: npm audit --audit-level=high
      - name: Install pinned cargo-audit
        run: cargo install cargo-audit --version 0.22.2 --locked
      - name: Audit Rust lockfiles
        run: |
          cargo audit --file src-tauri/Cargo.lock
          cargo audit --file src-tauri/startup-launcher/Cargo.lock
          cargo audit --file tools/updater-signature-verifier/Cargo.lock

  frontend:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
      - name: Reject retired product identity
        run: |
          retired_identity="pre""view"
          if git grep -n -i "$retired_identity" -- ':!src-tauri/Cargo.lock'; then
            exit 1
          fi
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: package-lock.json
      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: 1.97.1
      - run: npm ci
      - name: Validate release updater configuration
        shell: bash
        run: |
          set -euo pipefail
          npx tauri signer generate --ci --password validation-only --write-keys "$RUNNER_TEMP/updater.key"
          SWITCHIFY_UPDATER_PUBLIC_KEY="$(cat "$RUNNER_TEMP/updater.key.pub")" node scripts/render-updater-config.mjs "$RUNNER_TEMP/tauri.release.json"
          node -e 'const c=require(process.argv[1]); if (!c.bundle.createUpdaterArtifacts || c.plugins.updater.endpoints.length !== 1 || !c.plugins.updater.pubkey) process.exit(1)' "$RUNNER_TEMP/tauri.release.json"
          cargo build --locked --manifest-path tools/updater-signature-verifier/Cargo.toml
          verifier="$GITHUB_WORKSPACE/tools/updater-signature-verifier/target/debug/switchify-updater-signature-verifier"
          mkdir -p "$RUNNER_TEMP/artifacts/macos-release" "$RUNNER_TEMP/artifacts/windows-release"
          mac_artifact="$RUNNER_TEMP/artifacts/macos-release/Switchify.PC.app.tar.gz"
          windows_artifact="$RUNNER_TEMP/artifacts/windows-release/Switchify.PC_1.0.0_x64-setup.exe"
          node -e 'require("fs").writeFileSync(process.argv[1], require("zlib").gzipSync("archive fixture"))' "$mac_artifact"
          node -e 'const b=Buffer.alloc(128); b.write("MZ"); b.writeUInt32LE(64, 0x3c); b.write("PE\0\0", 64); require("fs").writeFileSync(process.argv[1], b)' "$windows_artifact"
          npx tauri signer sign --private-key-path "$RUNNER_TEMP/updater.key" --password validation-only "$mac_artifact"
          npx tauri signer sign --private-key-path "$RUNNER_TEMP/updater.key" --password validation-only "$windows_artifact"
          export SWITCHIFY_UPDATER_PUBLIC_KEY="$(cat "$RUNNER_TEMP/updater.key.pub")"
          node scripts/create-update-feed.mjs "$RUNNER_TEMP/artifacts" 1.0.0-beta.1 v1.0.0-beta.1 "$RUNNER_TEMP/latest.json" "$verifier"
          node -e 'const f=require(process.argv[1]); if (!f.platforms["darwin-aarch64"].signature || !f.platforms["windows-x86_64"].signature) process.exit(1)' "$RUNNER_TEMP/latest.json"
          if node scripts/create-update-feed.mjs "$RUNNER_TEMP/artifacts" 1.0.0-beta.1 v1.0.0-beta.2 "$RUNNER_TEMP/invalid.json" "$verifier"; then
            echo 'Mismatched update tag was accepted.' >&2
            exit 1
          fi
          printf 'not-a-tauri-signature' > "$mac_artifact.sig"
          if node scripts/create-update-feed.mjs "$RUNNER_TEMP/artifacts" 1.0.0-beta.1 v1.0.0-beta.1 "$RUNNER_TEMP/invalid.json" "$verifier"; then
            echo 'Invalid updater signature was accepted.' >&2
            exit 1
          fi
          printf 'not an updater archive' > "$mac_artifact"
          npx tauri signer sign --private-key-path "$RUNNER_TEMP/updater.key" --password validation-only "$mac_artifact"
          if node scripts/create-update-feed.mjs "$RUNNER_TEMP/artifacts" 1.0.0-beta.1 v1.0.0-beta.1 "$RUNNER_TEMP/invalid.json" "$verifier"; then
            echo 'Wrong-format updater payload was accepted.' >&2
            exit 1
          fi
      - run: npm run lint
      - run: npm test
      - run: npm run build

  native:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            bundles: nsis
          - os: macos-14
            bundles: app,dmg
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: package-lock.json
      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: 1.97.1
          components: rustfmt, clippy
      - run: npm ci
      - run: cargo fmt --manifest-path src-tauri/Cargo.toml --check
      - run: cargo clippy --locked --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings
      - run: cargo test --locked --manifest-path src-tauri/Cargo.toml
      - run: cargo fmt --manifest-path tools/updater-signature-verifier/Cargo.toml --check
      - run: cargo clippy --locked --manifest-path tools/updater-signature-verifier/Cargo.toml --all-targets -- -D warnings
      - run: cargo test --locked --manifest-path tools/updater-signature-verifier/Cargo.toml
      - if: runner.os == 'Windows'
        run: cargo fmt --manifest-path src-tauri/startup-launcher/Cargo.toml --check
      - if: runner.os == 'Windows'
        run: cargo clippy --locked --manifest-path src-tauri/startup-launcher/Cargo.toml --all-targets -- -D warnings
      - if: runner.os == 'Windows'
        run: cargo test --locked --manifest-path src-tauri/startup-launcher/Cargo.toml
      - if: runner.os == 'macOS'
        run: npm run tauri build -- --bundles ${{ matrix.bundles }} --no-sign
      - if: runner.os == 'Windows'
        run: pwsh ./scripts/Build-WindowsUiAccess.ps1 -SkipSign
      - if: runner.os == 'Windows'
        run: |
          $env:SWITCHIFY_ALLOW_UNSIGNED_UIACCESS_PACKAGE = '1'
          pwsh ./scripts/Verify-WindowsUiAccessPackage.ps1