ui(proxy-stats): align retry stats chart colors with app theme; relea… #149
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| jobs: | |
| build: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - os: macos-latest | |
| platform: mac | |
| # Windows images have fully rolled to VS2026 (windows-2025 no longer ships VS2022). | |
| # Old node-gyp 11.x doesn't recognize VS2026 → "Could not find any Visual Studio | |
| # installation". Fix: force node-gyp ^12.1.0 via package.json overrides (12.1+ | |
| # supports VS2026; @electron/rebuild's bundled ^11.2 can't reach it, so an override | |
| # is required). Keep the image pinned to windows-2025 to avoid windows-latest | |
| # introducing new variables. | |
| - os: windows-2025 | |
| platform: win | |
| - os: ubuntu-latest | |
| platform: linux | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: 'npm' | |
| - run: npm ci --no-fund --no-audit | |
| - run: npm run build | |
| - name: Build Electron (mac) | |
| if: matrix.platform == 'mac' | |
| # Apple notarization (notarytool) returns HTTP 403 when the Developer Agreement has | |
| # expired or is unsigned — unrelated to code. Tolerate the failure: mark only this step | |
| # as failed and skip the mac artifact, but do not block the entire release pipeline — | |
| # win/linux artifacts, GitHub Release, and Homebrew bump proceed as normal. Once the | |
| # agreement is re-signed at developer.apple.com, mac notarization and upload resume | |
| # automatically. | |
| continue-on-error: true | |
| timeout-minutes: 60 | |
| run: npx electron-builder --mac --publish never | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| CSC_LINK: ${{ secrets.CSC_LINK }} | |
| CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }} | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| APPLE_TEAM_ID: MUNC45J2DU | |
| - name: Build Electron (win) | |
| if: matrix.platform == 'win' | |
| run: npx electron-builder --win --publish never | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Uncomment when Windows signing certificate is available: | |
| # CSC_LINK: ${{ secrets.WIN_CSC_LINK }} | |
| # CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }} | |
| - name: Build Electron (linux) | |
| if: matrix.platform == 'linux' | |
| run: npx electron-builder --linux --publish never | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Upload artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: release-${{ matrix.platform }} | |
| path: | | |
| electron-dist/*.dmg | |
| electron-dist/*.zip | |
| electron-dist/*.exe | |
| electron-dist/*.AppImage | |
| if-no-files-found: ignore | |
| publish: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| steps: | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| path: artifacts | |
| merge-multiple: true | |
| - name: List artifacts | |
| run: find artifacts -type f | head -20 | |
| - name: Create GitHub Release | |
| # The downstream Homebrew bump is handled by the bump-homebrew job via reusable | |
| # workflow chained call (see below), within the same run — no dependency on the | |
| # release:published event. Use the default GITHUB_TOKEN to create the Release; no PAT needed. | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| files: artifacts/* | |
| generate_release_notes: true | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| # Publish to npm via Trusted Publishing (OIDC). Requires the npm package to be | |
| # configured with a Trusted Publisher for weiesky/cc-viewer (Settings → Access → | |
| # Trusted Publishing on npmjs.com). No token needed — OIDC provides an ephemeral | |
| # automation token automatically. | |
| npm-publish: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| permissions: | |
| id-token: write # required for OIDC token exchange with npm | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24 | |
| registry-url: 'https://registry.npmjs.org' | |
| # OIDC trusted publishing requires npm >= 11.5.1 — Node 20's bundled npm 10.x cannot do | |
| # the OIDC token exchange, so `npm publish` fails even with a correctly configured | |
| # Trusted Publisher on npmjs.com (this is what broke the v1.6.346/347 releases). | |
| - run: npm install -g npm@latest | |
| - run: npm ci --no-fund --no-audit | |
| - run: npm publish --provenance | |
| # prepublishOnly runs `npm run build` automatically. | |
| # Post-release automatic Homebrew tap formula bump (reusable workflow, uses HOMEBREW_TAP_TOKEN). | |
| bump-homebrew: | |
| needs: publish | |
| # Explicit needs.publish.result: a custom if would drop the implicit success() gate, | |
| # causing this job to run even when publish fails (bumping a non-existent release). | |
| if: ${{ needs.publish.result == 'success' && startsWith(github.ref, 'refs/tags/v') }} | |
| uses: ./.github/workflows/bump-homebrew.yml | |
| with: | |
| version: ${{ github.ref_name }} # vX.Y.Z; the callee strips the leading 'v' | |
| # Minimal permissions: only pass HOMEBREW_TAP_TOKEN explicitly (the only secret the | |
| # callee needs); avoid secrets: inherit which would dump all caller secrets | |
| # (CSC_*/APPLE_* etc.) into the child workflow. | |
| secrets: | |
| HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }} |