From ec2109635e81258fc16f0da892748e1b85602247 Mon Sep 17 00:00:00 2001 From: Daniil Pokrovsky Date: Fri, 14 Aug 2026 13:58:48 +0700 Subject: [PATCH 1/2] ci: configure desktop build-time integrations --- .github/workflows/pm-desktop-release.yml | 3 +- packages/pm-desktop/RELEASE.md | 54 ++++++++++++++---------- 2 files changed, 33 insertions(+), 24 deletions(-) diff --git a/.github/workflows/pm-desktop-release.yml b/.github/workflows/pm-desktop-release.yml index c69760a..fb0227f 100644 --- a/.github/workflows/pm-desktop-release.yml +++ b/.github/workflows/pm-desktop-release.yml @@ -33,7 +33,8 @@ jobs: runs-on: ${{ matrix.os }} env: POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }} - POSTHOG_HOST: ${{ secrets.POSTHOG_HOST }} + POSTHOG_HOST: ${{ vars.POSTHOG_HOST || secrets.POSTHOG_HOST }} + GITHUB_OAUTH_CLIENT_ID: ${{ vars.GITHUB_OAUTH_CLIENT_ID }} steps: - name: Checkout diff --git a/packages/pm-desktop/RELEASE.md b/packages/pm-desktop/RELEASE.md index 6f5e6ed..26dbf60 100644 --- a/packages/pm-desktop/RELEASE.md +++ b/packages/pm-desktop/RELEASE.md @@ -8,10 +8,10 @@ Product source and the binary update feed are both maintained in `getdevintern/d Public macOS artifacts are Developer ID signed and notarized. The release job verifies the signature, stapled notarization ticket, and Gatekeeper acceptance for both Apple silicon and Intel before it uploads artifacts. -| Expectation | Detail | -| ----------- | ------ | -| **Linux** | AppImage / `.deb`; platform signing is not required | -| **macOS** | Signed and notarized DMG / ZIP for a Gatekeeper-verified install | +| Expectation | Detail | +| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| **Linux** | AppImage / `.deb`; platform signing is not required | +| **macOS** | Signed and notarized DMG / ZIP for a Gatekeeper-verified install | | **Update feed** | Same public release assets include `latest-mac.yml` / `latest-linux.yml` + blockmaps so packaged installs can discover updates once the release is **published** (not draft/prerelease) | Local packaging can still run without Apple credentials for contributor testing, but those unsigned artifacts are not public releases. @@ -26,6 +26,7 @@ Local packaging can still run without Apple credentials for contributor testing, git push origin pm-desktop-v0.2.0 ``` 4. **Package** on each OS (native runners — do not cross-compile macOS), or let CI do it: + ```bash # Linux runner / machine bun install @@ -34,6 +35,7 @@ Local packaging can still run without Apple credentials for contributor testing, # macOS runner / machine bun run --filter @devintern/pm-desktop package:mac ``` + 5. **CI packaging** (`.github/workflows/pm-desktop-release.yml` on `pm-desktop-v*` tags): - Builds installers on Linux / macOS and uploads artifacts (including `latest-mac.yml` / `latest-linux.yml` and `*.blockmap`). - Verifies every artifact URL in `latest-*.yml` has an exact filename match before uploading. This catches GitHub filename normalization mismatches that would break auto-update downloads. @@ -50,9 +52,9 @@ Local packaging can still run without Apple credentials for contributor testing, Packaged installs check GitHub Releases on **`getdevintern/devintern`** (see `electron-builder.yml` `publish.owner` / `publish.repo` and `package.json#repository`) on launch (after a short delay) and about every 6 hours, and **download updates automatically** when one is found. A banner surfaces when the update is ready to install (Restart & install / Later); a downloaded update is also applied on the next normal quit. About retains a lightweight manual **Check for updates** for power users; Settings has no Updates section. Dev / unpackaged builds no-op (`phase: disabled`) — no network calls, no error spam. -| Platform | Auto-update path | Gap / notes | -| -------- | ---------------- | ----------- | -| **macOS** | `.zip` (+ `latest-mac.yml`) | Signed and notarized update path; DMG is the manual-install fallback. | +| Platform | Auto-update path | Gap / notes | +| --------- | ------------------------------- | ---------------------------------------------------------------------------------------------- | +| **macOS** | `.zip` (+ `latest-mac.yml`) | Signed and notarized update path; DMG is the manual-install fallback. | | **Linux** | AppImage (+ `latest-linux.yml`) | Primary Linux auto-update path. `.deb` installs need a manual upgrade (or reinstall AppImage). | Windows packaging / auto-update is out of scope for now. @@ -63,9 +65,9 @@ Settings (`userData/settings.json`: last project, recent PM-ready projects, anal ## What gets produced -| Platform | Typical files under `release/` | -| -------- | ------------------------------ | -| Linux | `DevIntern-PM--linux-*.AppImage`, `.deb`, `latest-linux.yml` | +| Platform | Typical files under `release/` | +| -------- | -------------------------------------------------------------------------------------------------------- | +| Linux | `DevIntern-PM--linux-*.AppImage`, `.deb`, `latest-linux.yml` | | macOS | `DevIntern-PM--mac-.dmg`, `DevIntern-PM--mac-.zip`, `latest-mac.yml`, `*.blockmap` | Local builds work without signing secrets. Release CI fails closed when macOS signing or notarization credentials are missing. Windows packaging is out of scope for now. @@ -84,26 +86,32 @@ Before publishing a public release: - **macOS:** confirm Restart & install (or quit + relaunch) lands on N+1 and Settings survive. - **First release named `DevIntern PM.app`:** start from 0.9.8, then confirm the updater replaces `DevIntern-PM.app`, launches the spaced bundle name, and does not leave a duplicate app in `/Applications`. -## CI secrets (placeholders) +## CI configuration -Configure these on the repo / environment that runs `.github/workflows/pm-desktop-release.yml`. The release workflow fails when signing/notarization credentials are incomplete. +Configure these on the repo / environment that runs `.github/workflows/pm-desktop-release.yml`. Build-time values are compiled into the distributed application and are not confidential. The release workflow fails when signing/notarization credentials are incomplete. ### Analytics (build-time) -| Secret | Maps to env | -| ------ | ----------- | -| `POSTHOG_API_KEY` | Baked into the main bundle via `electron.vite.config.ts` at package time. Missing → analytics permanently no-op in that build. | -| `POSTHOG_HOST` | Optional; defaults to `https://us.i.posthog.com` when unset. | +| Repository setting | Kind | Maps to env | +| ------------------ | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `POSTHOG_API_KEY` | Actions secret | Baked into the main bundle via `electron.vite.config.ts` at package time. Use the PostHog project API key, not a personal API key. Missing → analytics permanently no-op in that build. | +| `POSTHOG_HOST` | Actions variable | Optional; defaults to `https://us.i.posthog.com` when unset. The existing Actions secret remains a compatibility fallback. | + +### GitHub OAuth (build-time) + +| Repository setting | Kind | Maps to env | +| ------------------------ | ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `GITHUB_OAUTH_CLIENT_ID` | Actions variable | Public GitHub App client ID baked into the main bundle. Missing → GitHub OAuth sign-in is hidden; PAT sign-in remains available. Do not configure or ship a client secret. | ### macOS (Apple Developer) — required -| Secret | Maps to env | -| ------ | ----------- | -| `PM_DESKTOP_CSC_LINK` | `CSC_LINK` (base64 `.p12` of **Developer ID Application**) | -| `PM_DESKTOP_CSC_KEY_PASSWORD` | `CSC_KEY_PASSWORD` | -| `PM_DESKTOP_APPLE_ID` | `APPLE_ID` | -| `PM_DESKTOP_APPLE_APP_SPECIFIC_PASSWORD` | `APPLE_APP_SPECIFIC_PASSWORD` | -| `PM_DESKTOP_APPLE_TEAM_ID` | `APPLE_TEAM_ID` | +| Secret | Maps to env | +| ---------------------------------------- | ---------------------------------------------------------- | +| `PM_DESKTOP_CSC_LINK` | `CSC_LINK` (base64 `.p12` of **Developer ID Application**) | +| `PM_DESKTOP_CSC_KEY_PASSWORD` | `CSC_KEY_PASSWORD` | +| `PM_DESKTOP_APPLE_ID` | `APPLE_ID` | +| `PM_DESKTOP_APPLE_APP_SPECIFIC_PASSWORD` | `APPLE_APP_SPECIFIC_PASSWORD` | +| `PM_DESKTOP_APPLE_TEAM_ID` | `APPLE_TEAM_ID` | API-key notarization alternative: `PM_DESKTOP_APPLE_API_KEY_ID`, `PM_DESKTOP_APPLE_API_ISSUER`, and either `PM_DESKTOP_APPLE_API_KEY` (`.p8` body — materialized to a temp file at notarize time) or set `APPLE_API_KEY_FILE` to a path to the `.p8` on the runner. Notarization is skipped unless mac signing secrets (`PM_DESKTOP_CSC_*`) are also set. From c7616b99a37e691291fecefbb538187ffaa7fd3a Mon Sep 17 00:00:00 2001 From: Daniil Pokrovsky Date: Fri, 14 Aug 2026 13:59:42 +0700 Subject: [PATCH 2/2] ci: use valid OAuth variable name --- .github/workflows/pm-desktop-release.yml | 2 +- packages/pm-desktop/RELEASE.md | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/pm-desktop-release.yml b/.github/workflows/pm-desktop-release.yml index fb0227f..16a54be 100644 --- a/.github/workflows/pm-desktop-release.yml +++ b/.github/workflows/pm-desktop-release.yml @@ -34,7 +34,7 @@ jobs: env: POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }} POSTHOG_HOST: ${{ vars.POSTHOG_HOST || secrets.POSTHOG_HOST }} - GITHUB_OAUTH_CLIENT_ID: ${{ vars.GITHUB_OAUTH_CLIENT_ID }} + GITHUB_OAUTH_CLIENT_ID: ${{ vars.PM_DESKTOP_GITHUB_OAUTH_CLIENT_ID }} steps: - name: Checkout diff --git a/packages/pm-desktop/RELEASE.md b/packages/pm-desktop/RELEASE.md index 26dbf60..2cd3709 100644 --- a/packages/pm-desktop/RELEASE.md +++ b/packages/pm-desktop/RELEASE.md @@ -99,9 +99,9 @@ Configure these on the repo / environment that runs `.github/workflows/pm-deskto ### GitHub OAuth (build-time) -| Repository setting | Kind | Maps to env | -| ------------------------ | ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `GITHUB_OAUTH_CLIENT_ID` | Actions variable | Public GitHub App client ID baked into the main bundle. Missing → GitHub OAuth sign-in is hidden; PAT sign-in remains available. Do not configure or ship a client secret. | +| Repository setting | Kind | Maps to env | +| ----------------------------------- | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `PM_DESKTOP_GITHUB_OAUTH_CLIENT_ID` | Actions variable | Maps to `GITHUB_OAUTH_CLIENT_ID`, the public GitHub App client ID baked into the main bundle. Missing → GitHub OAuth sign-in is hidden; PAT sign-in remains available. Do not configure or ship a client secret. | ### macOS (Apple Developer) — required