45 lines
1.5 KiB
YAML
45 lines
1.5 KiB
YAML
name: TallyNote release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*.*.*"
|
|
|
|
# A tag is the immutable input to a release. Publishing is kept in one job so
|
|
# SHA256SUMS covers every archive exactly once and the Gitea Release API never
|
|
# receives duplicate checksum assets from parallel architecture jobs.
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
linux-x64:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout tag
|
|
uses: actions/checkout@v4
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 24
|
|
- name: Enable pnpm
|
|
run: corepack enable && corepack prepare pnpm@9.0.6 --activate
|
|
- name: Verify tag and test gate
|
|
run: |
|
|
set -euo pipefail
|
|
test "$(node -p 'require("./package.json").version')" = "${GITHUB_REF_NAME#v}"
|
|
pnpm install --frozen-lockfile
|
|
pnpm check
|
|
pnpm test
|
|
- name: Build Linux release
|
|
run: pnpm release:build "${GITHUB_REF_NAME#v}" ./release
|
|
- name: Create and publish signed Gitea Release
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
TALLYNOTE_RELEASE_SIGNING_KEY: ${{ secrets.TALLYNOTE_RELEASE_SIGNING_KEY }}
|
|
run: ./scripts/publish-gitea-release.sh "$GITHUB_REF_NAME" ./release
|
|
|
|
# Linux x86 (i386/i686) is intentionally not published: Node.js 24 and the
|
|
# better-sqlite3/argon2/sharp native modules have no maintained 32-bit build.
|
|
# Add an ARM64 job only on a runner with native ARM64 support, then let the
|
|
# publisher aggregate all archives before signing one SHA256SUMS file.
|