Repository navigation
fix(release): upload only AppImage assets and install xdg-utils #3
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| permissions: | |
| contents: write | |
| id-token: write | |
| jobs: | |
| build-x86_64: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Linux dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y --no-install-recommends \ | |
| libwebkit2gtk-4.1-dev \ | |
| libayatana-appindicator3-dev \ | |
| librsvg2-dev \ | |
| patchelf \ | |
| libssl-dev \ | |
| xdg-utils | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: src-tauri | |
| - run: npm ci | |
| - run: npm run fetch:runtime | |
| - run: npm run build | |
| - run: npm run tauri build | |
| - name: Generate SBOM | |
| uses: anchore/sbom-action@v0 | |
| with: | |
| path: . | |
| format: spdx-json | |
| output-file: sbom.spdx.json | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@v3.7.0 | |
| - name: Sign AppImage artifacts | |
| env: | |
| COSIGN_EXPERIMENTAL: "1" | |
| run: | | |
| shopt -s nullglob | |
| for artifact in src-tauri/target/release/bundle/appimage/*.AppImage; do | |
| cosign sign-blob --yes "$artifact" --output-signature "${artifact}.sig" | |
| done | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: cotux-x86_64 | |
| path: | | |
| src-tauri/target/release/bundle/appimage/*.AppImage | |
| src-tauri/target/release/bundle/appimage/*.AppImage.sig | |
| sbom.spdx.json | |
| build-aarch64: | |
| runs-on: ubuntu-24.04-arm | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Linux dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y --no-install-recommends \ | |
| libwebkit2gtk-4.1-dev \ | |
| libayatana-appindicator3-dev \ | |
| librsvg2-dev \ | |
| patchelf \ | |
| libssl-dev \ | |
| xdg-utils | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: src-tauri | |
| - run: npm ci | |
| - run: npm run fetch:runtime | |
| - run: npm run validate:runtime | |
| - run: npm run build | |
| - run: npm run tauri build | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: cotux-aarch64 | |
| path: | | |
| src-tauri/target/release/bundle/appimage/*.AppImage | |
| github-release: | |
| needs: [build-x86_64, build-aarch64] | |
| if: ${{ needs.build-x86_64.result == 'success' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| path: dist | |
| merge-multiple: true | |
| - name: Prepare release assets | |
| run: | | |
| mkdir -p release-assets | |
| find dist -type f \( -name '*.AppImage' -o -name '*.AppImage.sig' -o -name 'sbom.spdx.json' \) -exec cp {} release-assets/ \; | |
| ls -lh release-assets/ | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| draft: false | |
| generate_release_notes: true | |
| fail_on_unmatched_files: false | |
| files: release-assets/* | |
| body: | | |
| See [CHANGELOG.md](CHANGELOG.md) and [docs/e2e-checklist.md](docs/e2e-checklist.md). | |
| Verify signed AppImages when cosign signatures are attached: | |
| ```bash | |
| cosign verify-blob --signature Cotux_*.AppImage.sig Cotux_*.AppImage | |
| ``` |