Improve ad security, add CMP changes (#2399) #121
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 'Modrinth App build' | |
| on: | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - 'v*' | |
| paths: | |
| - .github/workflows/app-release.yml | |
| - 'apps/app/**' | |
| - 'apps/app-frontend/**' | |
| - 'packages/app-lib/**' | |
| - 'packages/app-macros/**' | |
| - 'packages/assets/**' | |
| - 'packages/ui/**' | |
| - 'packages/utils/**' | |
| workflow_dispatch: | |
| jobs: | |
| build: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| platform: [macos-latest, windows-latest, ubuntu-22.04] | |
| runs-on: ${{ matrix.platform }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Rust setup (mac) | |
| if: startsWith(matrix.platform, 'macos') | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt, clippy | |
| targets: aarch64-apple-darwin, x86_64-apple-darwin | |
| - name: Rust setup | |
| if: "!startsWith(matrix.platform, 'macos')" | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt, clippy | |
| - name: Install Tauri CLI | |
| run: cargo install tauri-cli --git https://github.com/modrinth/tauri.git --rev 5e2942876c2266594ed1db516c1d9975c873c36a | |
| - name: Setup rust cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| target/** | |
| !target/*/release/bundle/*/*.dmg | |
| !target/*/release/bundle/*/*.app.tar.gz | |
| !target/*/release/bundle/*/*.app.tar.gz.sig | |
| !target/release/bundle/*/*.dmg | |
| !target/release/bundle/*/*.app.tar.gz | |
| !target/release/bundle/*/*.app.tar.gz.sig | |
| !target/release/bundle/*/*.AppImage | |
| !target/release/bundle/*/*.AppImage.tar.gz | |
| !target/release/bundle/*/*.AppImage.tar.gz.sig | |
| !target/release/bundle/*/*.deb | |
| !target/release/bundle/*/*.rpm | |
| !target/release/bundle/msi/*.msi | |
| !target/release/bundle/msi/*.msi.zip | |
| !target/release/bundle/msi/*.msi.zip.sig | |
| !target/release/bundle/nsis/*.exe | |
| !target/release/bundle/nsis/*.nsis.zip | |
| !target/release/bundle/nsis/*.nsis.zip.sig | |
| key: ${{ runner.os }}-rust-target-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-rust-target- | |
| - name: Use Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| - name: Install pnpm via corepack | |
| shell: bash | |
| run: | | |
| corepack enable | |
| corepack prepare --activate | |
| - name: Get pnpm store directory | |
| id: pnpm-cache | |
| shell: bash | |
| run: | | |
| echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT | |
| - name: Setup pnpm cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: ${{ steps.pnpm-cache.outputs.STORE_PATH }} | |
| key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-pnpm-store- | |
| - name: install dependencies (ubuntu only) | |
| if: startsWith(matrix.platform, 'ubuntu') | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libwebkit2gtk-4.1-dev build-essential curl wget file libxdo-dev libssl-dev pkg-config libayatana-appindicator3-dev librsvg2-dev | |
| - name: Install frontend dependencies | |
| run: pnpm install | |
| - name: build app (macos) | |
| run: pnpm --filter=@modrinth/app run tauri build --target universal-apple-darwin --config "tauri-release.conf.json" | |
| if: startsWith(matrix.platform, 'macos') | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| ENABLE_CODE_SIGNING: ${{ secrets.APPLE_CERTIFICATE }} | |
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }} | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }} | |
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }} | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }} | |
| V1_COMPATIBLE_BIN_NAME: true | |
| - name: build app | |
| run: pnpm --filter=@modrinth/app run tauri build --config "tauri-release.conf.json" | |
| id: build_os | |
| if: "!startsWith(matrix.platform, 'macos')" | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }} | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }} | |
| V1_COMPATIBLE_BIN_NAME: true | |
| - name: upload ${{ matrix.platform }} | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ${{ matrix.platform }} | |
| path: | | |
| target/*/release/bundle/*/*.dmg | |
| target/*/release/bundle/*/*.app.tar.gz | |
| target/*/release/bundle/*/*.app.tar.gz.sig | |
| target/release/bundle/*/*.dmg | |
| target/release/bundle/*/*.app.tar.gz | |
| target/release/bundle/*/*.app.tar.gz.sig | |
| target/release/bundle/*/*.AppImage | |
| target/release/bundle/*/*.AppImage.tar.gz | |
| target/release/bundle/*/*.AppImage.tar.gz.sig | |
| target/release/bundle/*/*.deb | |
| target/release/bundle/*/*.rpm | |
| target/release/bundle/msi/*.msi | |
| target/release/bundle/msi/*.msi.zip | |
| target/release/bundle/msi/*.msi.zip.sig | |
| target/release/bundle/nsis/*.exe | |
| target/release/bundle/nsis/*.nsis.zip | |
| target/release/bundle/nsis/*.nsis.zip.sig |