Use clang-18 from apt.llvm.org for the wasm build on 22.04 runners #42
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release App Artifacts | |
| on: | |
| push: | |
| tags: [v*] | |
| jobs: | |
| build-artifacts: | |
| if: github.repository == 'mountain-loop/yaak' | |
| permissions: | |
| contents: write | |
| name: Build | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - platform: "macos-latest" # for Arm-based Macs (M1 and above). | |
| args: '--target aarch64-apple-darwin --config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}''' | |
| yaak_arch: "arm64" | |
| os: "macos" | |
| runtime: "wry" | |
| targets: "aarch64-apple-darwin" | |
| - platform: "macos-latest" # for Intel-based Macs. | |
| args: '--target x86_64-apple-darwin --config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}''' | |
| yaak_arch: "x64" | |
| os: "macos" | |
| runtime: "wry" | |
| targets: "x86_64-apple-darwin" | |
| - platform: "ubuntu-22.04" | |
| args: '--config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}''' | |
| yaak_arch: "x64" | |
| os: "ubuntu" | |
| runtime: "wry" | |
| targets: "" | |
| - platform: "ubuntu-22.04-arm" | |
| args: '--config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}''' | |
| yaak_arch: "arm64" | |
| os: "ubuntu" | |
| runtime: "wry" | |
| targets: "" | |
| - platform: "ubuntu-22.04" | |
| args: >- | |
| --bundles deb | |
| --config ./tauri.release.conf.json | |
| --config '{"productName":"yaak-cef","mainBinaryName":"yaak-cef","identifier":"app.yaak.desktop.cef","build":{"features":["license","cef"]},"bundle":{"createUpdaterArtifacts":false}}' | |
| yaak_arch: "x64" | |
| os: "ubuntu" | |
| runtime: "cef" | |
| targets: "" | |
| - platform: "ubuntu-22.04-arm" | |
| args: >- | |
| --bundles deb | |
| --config ./tauri.release.conf.json | |
| --config '{"productName":"yaak-cef","mainBinaryName":"yaak-cef","identifier":"app.yaak.desktop.cef","build":{"features":["license","cef"]},"bundle":{"createUpdaterArtifacts":false}}' | |
| yaak_arch: "arm64" | |
| os: "ubuntu" | |
| runtime: "cef" | |
| targets: "" | |
| - platform: "windows-latest" | |
| args: '--config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}''' | |
| yaak_arch: "x64" | |
| os: "windows" | |
| runtime: "wry" | |
| targets: "" | |
| # Windows ARM64 | |
| - platform: "windows-latest" | |
| args: '--target aarch64-pc-windows-msvc --config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}''' | |
| yaak_arch: "arm64" | |
| os: "windows" | |
| runtime: "wry" | |
| targets: "aarch64-pc-windows-msvc" | |
| runs-on: ${{ matrix.platform }} | |
| timeout-minutes: 60 | |
| steps: | |
| - name: Checkout yaakapp/app | |
| uses: actions/checkout@v4 | |
| - name: Setup Vite+ | |
| uses: voidzero-dev/setup-vp@v1 | |
| with: | |
| node-version: "24" | |
| cache: true | |
| - name: install Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: ${{ matrix.targets }} | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| shared-key: ci | |
| cache-on-failure: true | |
| - name: Cache CEF (Linux only) | |
| if: matrix.os == 'ubuntu' && matrix.runtime == 'cef' | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.cache/tauri-cef | |
| key: cef-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Cargo.lock') }} | |
| - name: install dependencies (Linux only) | |
| if: matrix.os == 'ubuntu' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y cmake ninja-build libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev libnss3 patchelf xdg-utils | |
| # crates/yaak-web compiles SQLite to wasm via sqlite-wasm-rs, whose C shim | |
| # uses C23 [[noreturn]] and expects a freestanding wasm32 target. Ubuntu | |
| # 22.04 ships only clang <=15: 14 rejects the attribute, and 15 falls | |
| # through to host glibc headers ("bits/libc-header-start.h" not found). | |
| # clang-18 handles it (it is what ubuntu-24.04 uses). Install it from | |
| # apt.llvm.org since 22.04's repos stop at 15. Only the wasm build uses | |
| # this compiler, so the shipped binary keeps 22.04's glibc floor. | |
| wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh | |
| chmod +x /tmp/llvm.sh | |
| sudo /tmp/llvm.sh 18 | |
| echo "CC_wasm32_unknown_unknown=/usr/bin/clang-18" >> "$GITHUB_ENV" | |
| echo "AR_wasm32_unknown_unknown=/usr/bin/llvm-ar-18" >> "$GITHUB_ENV" | |
| - name: Install Protoc for plugin-runtime | |
| uses: arduino/setup-protoc@v3 | |
| with: | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install trusted-signing-cli (Windows only) | |
| if: matrix.os == 'windows' | |
| shell: pwsh | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| $dir = "$env:USERPROFILE\trusted-signing" | |
| New-Item -ItemType Directory -Force -Path $dir | Out-Null | |
| $url = "https://github.com/Levminer/trusted-signing-cli/releases/download/0.8.0/trusted-signing-cli.exe" | |
| $exe = Join-Path $dir "trusted-signing-cli.exe" | |
| Invoke-WebRequest -Uri $url -OutFile $exe | |
| echo $dir >> $env:GITHUB_PATH | |
| & $exe --version | |
| - run: vp install | |
| - run: npm run bootstrap | |
| env: | |
| YAAK_TARGET_ARCH: ${{ matrix.yaak_arch }} | |
| - run: npm run lint | |
| - name: Run JS Tests | |
| run: vp test | |
| - name: Run Rust Tests | |
| run: cargo test --all --exclude yaak-cli --features yaak-app-client/wry | |
| - name: Set version | |
| run: npm run replace-version | |
| env: | |
| YAAK_VERSION: ${{ github.ref_name }} | |
| - name: Sign vendored binaries (macOS only) | |
| if: matrix.os == 'macos' | |
| env: | |
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }} | |
| KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} | |
| run: | | |
| # Create keychain | |
| KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db | |
| security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| security set-keychain-settings -lut 21600 $KEYCHAIN_PATH | |
| security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| # Import certificate | |
| echo "$APPLE_CERTIFICATE" | base64 --decode > certificate.p12 | |
| security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH | |
| security list-keychain -d user -s $KEYCHAIN_PATH | |
| # Sign vendored binaries with hardened runtime and their specific entitlements | |
| codesign --force --options runtime --entitlements crates-tauri/yaak-app-client/macos/entitlements.yaakprotoc.plist --sign "$APPLE_SIGNING_IDENTITY" crates-tauri/yaak-app-client/vendored/protoc/yaakprotoc || true | |
| codesign --force --options runtime --entitlements crates-tauri/yaak-app-client/macos/entitlements.yaaknode.plist --sign "$APPLE_SIGNING_IDENTITY" crates-tauri/yaak-app-client/vendored/node/yaaknode || true | |
| - uses: tauri-apps/tauri-action@v0 | |
| env: | |
| YAAK_TARGET_ARCH: ${{ matrix.yaak_arch }} | |
| ENABLE_CODE_SIGNING: ${{ secrets.APPLE_CERTIFICATE }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }} | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }} | |
| # Apple signing stuff | |
| APPLE_CERTIFICATE: ${{ matrix.os == 'macos' && secrets.APPLE_CERTIFICATE }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ matrix.os == 'macos' && secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| APPLE_ID: ${{ matrix.os == 'macos' && secrets.APPLE_ID }} | |
| APPLE_PASSWORD: ${{ matrix.os == 'macos' && secrets.APPLE_PASSWORD }} | |
| APPLE_SIGNING_IDENTITY: ${{ matrix.os == 'macos' && secrets.APPLE_SIGNING_IDENTITY }} | |
| APPLE_TEAM_ID: ${{ matrix.os == 'macos' && secrets.APPLE_TEAM_ID }} | |
| # Windows signing stuff | |
| AZURE_CLIENT_ID: ${{ matrix.os == 'windows' && secrets.AZURE_CLIENT_ID }} | |
| AZURE_CLIENT_SECRET: ${{ matrix.os == 'windows' && secrets.AZURE_CLIENT_SECRET }} | |
| AZURE_TENANT_ID: ${{ matrix.os == 'windows' && secrets.AZURE_TENANT_ID }} | |
| with: | |
| tauriScript: "node ../../node_modules/@tauri-apps/cli/tauri.js" | |
| tagName: "v__VERSION__" | |
| releaseName: "Release __VERSION__" | |
| releaseBody: "<!-- generated-by-yaak-releases -->" | |
| releaseDraft: true | |
| prerelease: true | |
| projectPath: ./crates-tauri/yaak-app-client | |
| args: "${{ matrix.args }}" | |
| - name: Build and upload CEF tarball from deb (Linux only) | |
| if: matrix.os == 'ubuntu' && matrix.runtime == 'cef' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -euo pipefail | |
| deb=$(find target/release/bundle/deb -maxdepth 1 -type f -name '*.deb' | head -n 1) | |
| version="${GITHUB_REF_NAME#v}" | |
| extract_dir="target/release/bundle/deb/yaak-cef-linux-${{ matrix.yaak_arch }}" | |
| tarball="target/release/bundle/deb/yaak-cef_${version}_linux_${{ matrix.yaak_arch }}.tar.gz" | |
| rm -rf "$extract_dir" | |
| mkdir -p "$extract_dir" | |
| dpkg-deb -x "$deb" "$extract_dir" | |
| tar -C "$extract_dir" -czf "$tarball" . | |
| gh release upload "${{ github.ref_name }}" "$tarball" --clobber | |
| # Build a per-machine NSIS installer for enterprise deployment (PDQ, SCCM, Intune) | |
| - name: Build and upload machine-wide installer (Windows only) | |
| if: matrix.os == 'windows' | |
| shell: pwsh | |
| env: | |
| YAAK_TARGET_ARCH: ${{ matrix.yaak_arch }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }} | |
| AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }} | |
| AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }} | |
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }} | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }} | |
| run: | | |
| Get-ChildItem -Recurse -Path target -File -Filter "*.exe.sig" | Remove-Item -Force | |
| Push-Location crates-tauri/yaak-app-client | |
| npx tauri bundle ${{ matrix.args }} --bundles nsis --config '{"bundle":{"createUpdaterArtifacts":true,"windows":{"nsis":{"installMode":"perMachine"}}}}' | |
| Pop-Location | |
| $setup = Get-ChildItem -Recurse -Path target -Filter "*setup*.exe" | Select-Object -First 1 | |
| $setupSig = "$($setup.FullName).sig" | |
| $dest = $setup.FullName -replace '-setup\.exe$', '-setup-machine.exe' | |
| $destSig = "$dest.sig" | |
| Copy-Item $setup.FullName $dest | |
| Copy-Item $setupSig $destSig | |
| gh release upload "${{ github.ref_name }}" "$dest" --clobber | |
| gh release upload "${{ github.ref_name }}" "$destSig" --clobber |