Bundle NSS modules in CEF AppImages #26
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release App Artifacts | |
| on: | |
| push: | |
| tags: [v*] | |
| jobs: | |
| build-artifacts: | |
| permissions: | |
| contents: write | |
| name: Build | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - platform: "macos-latest" # for Arm-based Macs (M1 and above). | |
| args: '--target aarch64-apple-darwin --config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}''' | |
| yaak_arch: "arm64" | |
| os: "macos" | |
| runtime: "wry" | |
| targets: "aarch64-apple-darwin" | |
| - platform: "macos-latest" # for Intel-based Macs. | |
| args: '--target x86_64-apple-darwin --config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}''' | |
| yaak_arch: "x64" | |
| os: "macos" | |
| runtime: "wry" | |
| targets: "x86_64-apple-darwin" | |
| - platform: "ubuntu-22.04" | |
| args: '--config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}''' | |
| yaak_arch: "x64" | |
| os: "ubuntu" | |
| runtime: "wry" | |
| targets: "" | |
| - platform: "ubuntu-22.04-arm" | |
| args: '--config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}''' | |
| yaak_arch: "arm64" | |
| os: "ubuntu" | |
| runtime: "wry" | |
| targets: "" | |
| - platform: "ubuntu-22.04" | |
| args: >- | |
| --bundles appimage | |
| --config ./tauri.release.conf.json | |
| --config '{"productName":"yaak-cef","mainBinaryName":"yaak-cef","identifier":"app.yaak.desktop.cef","build":{"features":["license","cef"]},"bundle":{"createUpdaterArtifacts":false,"linux":{"appimage":{"files":{"/usr/lib/libfreebl3.chk":"/usr/lib/x86_64-linux-gnu/libfreebl3.chk","/usr/lib/libfreebl3.so":"/usr/lib/x86_64-linux-gnu/libfreebl3.so","/usr/lib/libfreeblpriv3.chk":"/usr/lib/x86_64-linux-gnu/libfreeblpriv3.chk","/usr/lib/libfreeblpriv3.so":"/usr/lib/x86_64-linux-gnu/libfreeblpriv3.so","/usr/lib/libsoftokn3.chk":"/usr/lib/x86_64-linux-gnu/nss/libsoftokn3.chk","/usr/lib/libsoftokn3.so":"/usr/lib/x86_64-linux-gnu/nss/libsoftokn3.so","/usr/lib/nss/libfreebl3.chk":"/usr/lib/x86_64-linux-gnu/nss/libfreebl3.chk","/usr/lib/nss/libfreebl3.so":"/usr/lib/x86_64-linux-gnu/nss/libfreebl3.so","/usr/lib/nss/libfreeblpriv3.chk":"/usr/lib/x86_64-linux-gnu/nss/libfreeblpriv3.chk","/usr/lib/nss/libfreeblpriv3.so":"/usr/lib/x86_64-linux-gnu/nss/libfreeblpriv3.so","/usr/lib/nss/libnssckbi.so":"/usr/lib/x86_64-linux-gnu/nss/libnssckbi.so","/usr/lib/nss/libnssdbm3.chk":"/usr/lib/x86_64-linux-gnu/nss/libnssdbm3.chk","/usr/lib/nss/libnssdbm3.so":"/usr/lib/x86_64-linux-gnu/nss/libnssdbm3.so","/usr/lib/nss/libsoftokn3.chk":"/usr/lib/x86_64-linux-gnu/nss/libsoftokn3.chk","/usr/lib/nss/libsoftokn3.so":"/usr/lib/x86_64-linux-gnu/nss/libsoftokn3.so"}}}}}' | |
| yaak_arch: "x64" | |
| os: "ubuntu" | |
| runtime: "cef" | |
| targets: "" | |
| - platform: "ubuntu-22.04-arm" | |
| args: >- | |
| --bundles appimage | |
| --config ./tauri.release.conf.json | |
| --config '{"productName":"yaak-cef","mainBinaryName":"yaak-cef","identifier":"app.yaak.desktop.cef","build":{"features":["license","cef"]},"bundle":{"createUpdaterArtifacts":false,"linux":{"appimage":{"files":{"/usr/lib/libfreebl3.chk":"/usr/lib/aarch64-linux-gnu/libfreebl3.chk","/usr/lib/libfreebl3.so":"/usr/lib/aarch64-linux-gnu/libfreebl3.so","/usr/lib/libfreeblpriv3.chk":"/usr/lib/aarch64-linux-gnu/libfreeblpriv3.chk","/usr/lib/libfreeblpriv3.so":"/usr/lib/aarch64-linux-gnu/libfreeblpriv3.so","/usr/lib/libsoftokn3.chk":"/usr/lib/aarch64-linux-gnu/nss/libsoftokn3.chk","/usr/lib/libsoftokn3.so":"/usr/lib/aarch64-linux-gnu/nss/libsoftokn3.so","/usr/lib/nss/libfreebl3.chk":"/usr/lib/aarch64-linux-gnu/nss/libfreebl3.chk","/usr/lib/nss/libfreebl3.so":"/usr/lib/aarch64-linux-gnu/nss/libfreebl3.so","/usr/lib/nss/libfreeblpriv3.chk":"/usr/lib/aarch64-linux-gnu/nss/libfreeblpriv3.chk","/usr/lib/nss/libfreeblpriv3.so":"/usr/lib/aarch64-linux-gnu/nss/libfreeblpriv3.so","/usr/lib/nss/libnssckbi.so":"/usr/lib/aarch64-linux-gnu/nss/libnssckbi.so","/usr/lib/nss/libnssdbm3.chk":"/usr/lib/aarch64-linux-gnu/nss/libnssdbm3.chk","/usr/lib/nss/libnssdbm3.so":"/usr/lib/aarch64-linux-gnu/nss/libnssdbm3.so","/usr/lib/nss/libsoftokn3.chk":"/usr/lib/aarch64-linux-gnu/nss/libsoftokn3.chk","/usr/lib/nss/libsoftokn3.so":"/usr/lib/aarch64-linux-gnu/nss/libsoftokn3.so"}}}}}' | |
| yaak_arch: "arm64" | |
| os: "ubuntu" | |
| runtime: "cef" | |
| targets: "" | |
| - platform: "windows-latest" | |
| args: '--config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}''' | |
| yaak_arch: "x64" | |
| os: "windows" | |
| runtime: "wry" | |
| targets: "" | |
| # Windows ARM64 | |
| - platform: "windows-latest" | |
| args: '--target aarch64-pc-windows-msvc --config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}''' | |
| yaak_arch: "arm64" | |
| os: "windows" | |
| runtime: "wry" | |
| targets: "aarch64-pc-windows-msvc" | |
| runs-on: ${{ matrix.platform }} | |
| timeout-minutes: 40 | |
| steps: | |
| - name: Checkout yaakapp/app | |
| uses: actions/checkout@v4 | |
| - name: Setup Vite+ | |
| uses: voidzero-dev/setup-vp@v1 | |
| with: | |
| node-version: "24" | |
| cache: true | |
| - name: install Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: ${{ matrix.targets }} | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| shared-key: ci | |
| cache-on-failure: true | |
| - name: Cache CEF (Linux only) | |
| if: matrix.os == 'ubuntu' && matrix.runtime == 'cef' | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.cache/tauri-cef | |
| key: cef-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Cargo.lock') }} | |
| - name: install dependencies (Linux only) | |
| if: matrix.os == 'ubuntu' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y cmake ninja-build libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev libnss3 patchelf xdg-utils | |
| - name: Install Protoc for plugin-runtime | |
| uses: arduino/setup-protoc@v3 | |
| with: | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install trusted-signing-cli (Windows only) | |
| if: matrix.os == 'windows' | |
| shell: pwsh | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| $dir = "$env:USERPROFILE\trusted-signing" | |
| New-Item -ItemType Directory -Force -Path $dir | Out-Null | |
| $url = "https://github.com/Levminer/trusted-signing-cli/releases/download/0.8.0/trusted-signing-cli.exe" | |
| $exe = Join-Path $dir "trusted-signing-cli.exe" | |
| Invoke-WebRequest -Uri $url -OutFile $exe | |
| echo $dir >> $env:GITHUB_PATH | |
| & $exe --version | |
| - run: vp install | |
| - run: npm run bootstrap | |
| env: | |
| YAAK_TARGET_ARCH: ${{ matrix.yaak_arch }} | |
| - run: npm run lint | |
| - name: Run JS Tests | |
| run: vp test | |
| - name: Run Rust Tests | |
| run: cargo test --all --exclude yaak-cli --features yaak-app-client/wry | |
| - name: Set version | |
| run: npm run replace-version | |
| env: | |
| YAAK_VERSION: ${{ github.ref_name }} | |
| - name: Sign vendored binaries (macOS only) | |
| if: matrix.os == 'macos' | |
| env: | |
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }} | |
| KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} | |
| run: | | |
| # Create keychain | |
| KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db | |
| security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| security set-keychain-settings -lut 21600 $KEYCHAIN_PATH | |
| security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| # Import certificate | |
| echo "$APPLE_CERTIFICATE" | base64 --decode > certificate.p12 | |
| security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH | |
| security list-keychain -d user -s $KEYCHAIN_PATH | |
| # Sign vendored binaries with hardened runtime and their specific entitlements | |
| codesign --force --options runtime --entitlements crates-tauri/yaak-app-client/macos/entitlements.yaakprotoc.plist --sign "$APPLE_SIGNING_IDENTITY" crates-tauri/yaak-app-client/vendored/protoc/yaakprotoc || true | |
| codesign --force --options runtime --entitlements crates-tauri/yaak-app-client/macos/entitlements.yaaknode.plist --sign "$APPLE_SIGNING_IDENTITY" crates-tauri/yaak-app-client/vendored/node/yaaknode || true | |
| - uses: tauri-apps/tauri-action@v0 | |
| env: | |
| YAAK_TARGET_ARCH: ${{ matrix.yaak_arch }} | |
| ENABLE_CODE_SIGNING: ${{ secrets.APPLE_CERTIFICATE }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }} | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }} | |
| # Apple signing stuff | |
| APPLE_CERTIFICATE: ${{ matrix.os == 'macos' && secrets.APPLE_CERTIFICATE }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ matrix.os == 'macos' && secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| APPLE_ID: ${{ matrix.os == 'macos' && secrets.APPLE_ID }} | |
| APPLE_PASSWORD: ${{ matrix.os == 'macos' && secrets.APPLE_PASSWORD }} | |
| APPLE_SIGNING_IDENTITY: ${{ matrix.os == 'macos' && secrets.APPLE_SIGNING_IDENTITY }} | |
| APPLE_TEAM_ID: ${{ matrix.os == 'macos' && secrets.APPLE_TEAM_ID }} | |
| # Windows signing stuff | |
| AZURE_CLIENT_ID: ${{ matrix.os == 'windows' && secrets.AZURE_CLIENT_ID }} | |
| AZURE_CLIENT_SECRET: ${{ matrix.os == 'windows' && secrets.AZURE_CLIENT_SECRET }} | |
| AZURE_TENANT_ID: ${{ matrix.os == 'windows' && secrets.AZURE_TENANT_ID }} | |
| with: | |
| tauriScript: "node ../../node_modules/@tauri-apps/cli/tauri.js" | |
| tagName: "v__VERSION__" | |
| releaseName: "Release __VERSION__" | |
| releaseBody: "[Changelog __VERSION__](https://yaak.app/blog/__VERSION__)" | |
| releaseDraft: true | |
| prerelease: true | |
| projectPath: ./crates-tauri/yaak-app-client | |
| args: "${{ matrix.args }}" | |
| # Build a per-machine NSIS installer for enterprise deployment (PDQ, SCCM, Intune) | |
| - name: Build and upload machine-wide installer (Windows only) | |
| if: matrix.os == 'windows' | |
| shell: pwsh | |
| env: | |
| YAAK_TARGET_ARCH: ${{ matrix.yaak_arch }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }} | |
| AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }} | |
| AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }} | |
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }} | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }} | |
| run: | | |
| Get-ChildItem -Recurse -Path target -File -Filter "*.exe.sig" | Remove-Item -Force | |
| Push-Location crates-tauri/yaak-app-client | |
| npx tauri bundle ${{ matrix.args }} --bundles nsis --config '{"bundle":{"createUpdaterArtifacts":true,"windows":{"nsis":{"installMode":"perMachine"}}}}' | |
| Pop-Location | |
| $setup = Get-ChildItem -Recurse -Path target -Filter "*setup*.exe" | Select-Object -First 1 | |
| $setupSig = "$($setup.FullName).sig" | |
| $dest = $setup.FullName -replace '-setup\.exe$', '-setup-machine.exe' | |
| $destSig = "$dest.sig" | |
| Copy-Item $setup.FullName $dest | |
| Copy-Item $setupSig $destSig | |
| gh release upload "${{ github.ref_name }}" "$dest" --clobber | |
| gh release upload "${{ github.ref_name }}" "$destSig" --clobber |