diff --git a/.github/workflows/macos-arm64-build.yml b/.github/workflows/macos-arm64-build.yml deleted file mode 100644 index 6282aa895..000000000 --- a/.github/workflows/macos-arm64-build.yml +++ /dev/null @@ -1,138 +0,0 @@ -name: macOS ARM64 Build - -on: - workflow_dispatch: - -permissions: - contents: read - -concurrency: - group: macos-arm64-build-${{ github.ref }} - cancel-in-progress: true - -jobs: - build-signed-macos-arm64: - name: Build signed macOS ARM64 bundle - runs-on: macos-latest - environment: Production - env: - TARGET: aarch64-apple-darwin - steps: - - name: Checkout code - uses: actions/checkout@v4 - with: - fetch-depth: 1 - submodules: true - - - name: Set Xcode version - uses: maxim-lobanov/setup-xcode@v1 - with: - xcode-version: latest-stable - - - name: Setup Node.js 24.x - uses: actions/setup-node@v4 - with: - node-version: 24.x - cache: yarn - - - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@1.93.0 - with: - targets: aarch64-apple-darwin - - - name: Install dependencies - run: yarn install --frozen-lockfile - - - name: Validate signing prerequisites - shell: bash - env: - UPDATER_PUBLIC_KEY: ${{ secrets.UPDATER_PUBLIC_KEY || vars.UPDATER_PUBLIC_KEY }} - TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY || secrets.UPDATER_PRIVATE_KEY }} - APPLE_CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }} - APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} - APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }} - APPLE_ID: ${{ secrets.APPLE_ID }} - APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }} - APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} - run: | - for var in UPDATER_PUBLIC_KEY TAURI_SIGNING_PRIVATE_KEY APPLE_CERTIFICATE_BASE64 APPLE_CERTIFICATE_PASSWORD APPLE_SIGNING_IDENTITY APPLE_ID APPLE_PASSWORD APPLE_TEAM_ID; do - if [ -z "${!var}" ]; then - echo "Missing required secret/variable: $var" - exit 1 - fi - done - - - name: Define Tauri configuration overrides - id: config-overrides - uses: actions/github-script@v7 - env: - BASE_URL: ${{ vars.BASE_URL }} - UPDATER_PUBLIC_KEY: ${{ secrets.UPDATER_PUBLIC_KEY || vars.UPDATER_PUBLIC_KEY }} - UPDATER_ENDPOINT: ${{ vars.UPDATER_ENDPOINT }} - UPDATER_REPO: tinyhumansai/openhuman - WITH_UPDATER: "true" - with: - script: | - const workspacePath = process.env.GITHUB_WORKSPACE.replace(/\\/g, '/'); - const prefix = workspacePath.startsWith('/') ? 'file://' : 'file:///'; - const moduleUrl = `${prefix}${workspacePath}/scripts/prepareTauriConfig.js`; - const { default: prepareTauriConfig } = await import(moduleUrl); - const config = prepareTauriConfig(); - core.setOutput('json', JSON.stringify(config)); - - - name: Build frontend - run: yarn workspace openhuman-app build - env: - NODE_ENV: production - VITE_BACKEND_URL: ${{ vars.VITE_BACKEND_URL }} - VITE_SENTRY_DSN: ${{ vars.VITE_SENTRY_DSN }} - VITE_DEBUG: ${{ vars.VITE_DEBUG }} - - - name: Build sidecar core binary - run: cargo build --manifest-path Cargo.toml --release --target "$TARGET" --bin openhuman - - - name: Stage sidecar for Tauri bundler - shell: bash - run: | - mkdir -p app/src-tauri/binaries - cp "target/$TARGET/release/openhuman" "app/src-tauri/binaries/openhuman-$TARGET" - chmod +x "app/src-tauri/binaries/openhuman-$TARGET" - - - name: Build signed app and dmg - working-directory: app - env: - APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE_BASE64 }} - APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} - APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }} - APPLE_ID: ${{ secrets.APPLE_ID }} - APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }} - APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} - TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY || secrets.UPDATER_PRIVATE_KEY }} - TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD || secrets.UPDATER_PRIVATE_KEY_PASSWORD }} - MACOSX_DEPLOYMENT_TARGET: "10.15" - run: | - yarn tauri build -c '${{ steps.config-overrides.outputs.json }}' --target "$TARGET" --bundles app,dmg -- --bin OpenHuman - - - name: Verify macOS app bundle sidecar layout - shell: bash - run: | - APP_PATH="target/$TARGET/release/bundle/macos/OpenHuman.app" - echo "Inspecting bundle at: $APP_PATH" - ls -la "$APP_PATH/Contents/MacOS" - ls -la "$APP_PATH/Contents/Resources" | grep openhuman || true - if [ -f "$APP_PATH/Contents/MacOS/openhuman" ]; then - echo "Unexpected standalone core binary found in MacOS dir" - exit 1 - fi - if ! ls "$APP_PATH/Contents/Resources"/openhuman-* >/dev/null 2>&1; then - echo "Sidecar core binary missing from app resources" - exit 1 - fi - - - name: Upload signed macOS artifacts - uses: actions/upload-artifact@v4 - with: - name: macos-arm64-signed-bundles - path: | - target/${{ env.TARGET }}/release/bundle/macos/*.app - target/${{ env.TARGET }}/release/bundle/dmg/*.dmg diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1a1e1d1a9..650734717 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -451,14 +451,10 @@ jobs: WITH_UPDATER: "true" with: projectPath: app - # Tools discovery now uses a JS mock registry (no Rust discovery - # binary target), so there is no extra helper executable for Tauri - # to copy/sign inside release app bundles. - # Restrict Cargo bin selection for the Tauri bundle build so only - # the desktop UI app binary is packaged. - # Yarn v1 strips one "--" layer when invoking scripts, hence the - # double-separator when forwarding flags to Cargo. - args: -c ${{ steps.config-overrides.outputs.json }} ${{ matrix.settings.args }} -- -- --bin OpenHuman + # OpenHuman is the only declared Tauri bin, so no extra Cargo bin + # forwarding is required here. Keep args minimal so --target is + # interpreted consistently by tauri-action artifact discovery. + args: -c ${{ steps.config-overrides.outputs.json }} ${{ matrix.settings.args }} includeDebug: false includeRelease: true releaseId: ${{ needs.create-release.outputs.release_id }}