mr.zeroandClaude Opus 5
7026e0cc6a
Woodpecker hands every step a forge credential for cloning — an access token of the repository's owner — and a one-off diagnostic in the check step confirmed it is there. scripts/ci-upload.sh now uses it when no `gitea_token` secret is set, so publishing a release needs nothing configured. Gitea takes such a credential as `token …` or `Bearer …` depending on how Woodpecker was set up, so the script probes which of the two `/user` accepts rather than assuming, and says which one it used. The secret mapping is gone from the step as well: referencing a secret that does not exist is a failure mode of its own, and the fallback is the normal path now. Adding a `gitea_token` secret and mapping it back in is how you publish as somebody else. Documents the release flow the pipeline now implements: push a vX.Y.Z tag, the pipeline builds Linux and Windows and creates the release with them in it, and `make release` from a Mac pushes the macOS package onto the same release. Either half can go first. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
70 lines
2.6 KiB
YAML
70 lines
2.6 KiB
YAML
# The pipeline lives in the repository rather than in the update server's
|
|
# `/build/config` extension. That extension serves game-platform pipelines, which
|
|
# build a cartridge and publish it into the site's catalog; this one builds a desktop
|
|
# application and publishes it to a Gitea release. Different product, different target.
|
|
#
|
|
# What CI can and cannot do here: Linux and Windows packages are built in containers —
|
|
# Windows through Wine — while the **macOS package stays a local build**, because
|
|
# Apple's toolchain and its signing exist only on a Mac. A release therefore gets its
|
|
# Linux and Windows assets from this pipeline and its macOS assets from `make release`.
|
|
when:
|
|
- event: [push, manual]
|
|
branch: master
|
|
- event: tag
|
|
|
|
variables:
|
|
# The official electron-builder images: Node with the packaging tools, and the same
|
|
# image plus Wine, which is what lets a Windows installer be built on Linux.
|
|
- &node_image 'electronuserland/builder:22'
|
|
- &wine_image 'electronuserland/builder:22-wine'
|
|
|
|
steps:
|
|
- name: check
|
|
image: *node_image
|
|
commands:
|
|
- node --version
|
|
- npm ci
|
|
- npm run typecheck
|
|
- npm run lint
|
|
# The window test wants a display and a store on the machine; that check belongs
|
|
# where there is one. The bridge check is worth running here: it exercises the
|
|
# registry and the message bundles.
|
|
- |
|
|
if command -v python3 >/dev/null 2>&1; then
|
|
npm run smoke
|
|
else
|
|
echo "no python3 in the image — the smoke test needs it, skipping"
|
|
fi
|
|
|
|
# A quarter of a gigabyte of packages is not worth building on every push, so the
|
|
# two builds run when a release is being cut — or when asked for by hand.
|
|
- name: linux
|
|
image: *node_image
|
|
commands:
|
|
- npm run dist:linux
|
|
- scripts/ci-verify-packages.sh '*.AppImage' '*.deb'
|
|
when:
|
|
- event: [tag, manual]
|
|
|
|
- name: windows
|
|
image: *wine_image
|
|
commands:
|
|
- npm run dist:win
|
|
- scripts/ci-verify-packages.sh '*.exe'
|
|
when:
|
|
- event: [tag, manual]
|
|
|
|
# Only on a tag, and only what this pipeline built: the macOS assets are uploaded
|
|
# from the Mac that can sign them.
|
|
- name: release
|
|
image: alpine
|
|
# No secret: the step authenticates with the forge credential Woodpecker already
|
|
# hands every step, which belongs to the repository's owner. To publish as someone
|
|
# else instead, add a `gitea_token` repository secret and map it here as GITEA_TOKEN.
|
|
commands:
|
|
- apk add --no-cache curl jq
|
|
# No globs on the command line: the package names have spaces in them.
|
|
- scripts/ci-upload.sh
|
|
when:
|
|
- event: tag
|