Skip to content

ci: configure desktop build-time integrations #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
danii1 merged 2 commits into from
Aug 14, 2026
Merged

ci: configure desktop build-time integrations #6

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ec21096
ci: configure desktop build-time integrations
danii1 Aug 14, 2026
c7616b9
ci: use valid OAuth variable name
danii1 Aug 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .github/workflows/pm-desktop-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,8 @@ jobs:
runs-on: ${{ matrix.os }}
env:
POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}
POSTHOG_HOST: ${{ secrets.POSTHOG_HOST }}
POSTHOG_HOST: ${{ vars.POSTHOG_HOST || secrets.POSTHOG_HOST }}
GITHUB_OAUTH_CLIENT_ID: ${{ vars.PM_DESKTOP_GITHUB_OAUTH_CLIENT_ID }}

steps:
- name: Checkout
Expand Down
54 changes: 31 additions & 23 deletions packages/pm-desktop/RELEASE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,10 @@ Product source and the binary update feed are both maintained in `getdevintern/d

Public macOS artifacts are Developer ID signed and notarized. The release job verifies the signature, stapled notarization ticket, and Gatekeeper acceptance for both Apple silicon and Intel before it uploads artifacts.

| Expectation | Detail |
| ----------- | ------ |
| **Linux** | AppImage / `.deb`; platform signing is not required |
| **macOS** | Signed and notarized DMG / ZIP for a Gatekeeper-verified install |
| Expectation | Detail |
| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Linux** | AppImage / `.deb`; platform signing is not required |
| **macOS** | Signed and notarized DMG / ZIP for a Gatekeeper-verified install |
| **Update feed** | Same public release assets include `latest-mac.yml` / `latest-linux.yml` + blockmaps so packaged installs can discover updates once the release is **published** (not draft/prerelease) |

Local packaging can still run without Apple credentials for contributor testing, but those unsigned artifacts are not public releases.
Expand All @@ -26,6 +26,7 @@ Local packaging can still run without Apple credentials for contributor testing,
git push origin pm-desktop-v0.2.0
```
4. **Package** on each OS (native runners — do not cross-compile macOS), or let CI do it:

```bash
# Linux runner / machine
bun install
Expand All @@ -34,6 +35,7 @@ Local packaging can still run without Apple credentials for contributor testing,
# macOS runner / machine
bun run --filter @devintern/pm-desktop package:mac
```

5. **CI packaging** (`.github/workflows/pm-desktop-release.yml` on `pm-desktop-v*` tags):
- Builds installers on Linux / macOS and uploads artifacts (including `latest-mac.yml` / `latest-linux.yml` and `*.blockmap`).
- Verifies every artifact URL in `latest-*.yml` has an exact filename match before uploading. This catches GitHub filename normalization mismatches that would break auto-update downloads.
Expand All @@ -50,9 +52,9 @@ Local packaging can still run without Apple credentials for contributor testing,

Packaged installs check GitHub Releases on **`getdevintern/devintern`** (see `electron-builder.yml` `publish.owner` / `publish.repo` and `package.json#repository`) on launch (after a short delay) and about every 6 hours, and **download updates automatically** when one is found. A banner surfaces when the update is ready to install (Restart & install / Later); a downloaded update is also applied on the next normal quit. About retains a lightweight manual **Check for updates** for power users; Settings has no Updates section. Dev / unpackaged builds no-op (`phase: disabled`) — no network calls, no error spam.

| Platform | Auto-update path | Gap / notes |
| -------- | ---------------- | ----------- |
| **macOS** | `.zip` (+ `latest-mac.yml`) | Signed and notarized update path; DMG is the manual-install fallback. |
| Platform | Auto-update path | Gap / notes |
| --------- | ------------------------------- | ---------------------------------------------------------------------------------------------- |
| **macOS** | `.zip` (+ `latest-mac.yml`) | Signed and notarized update path; DMG is the manual-install fallback. |
| **Linux** | AppImage (+ `latest-linux.yml`) | Primary Linux auto-update path. `.deb` installs need a manual upgrade (or reinstall AppImage). |

Windows packaging / auto-update is out of scope for now.
Expand All @@ -63,9 +65,9 @@ Settings (`userData/settings.json`: last project, recent PM-ready projects, anal

## What gets produced

| Platform | Typical files under `release/` |
| -------- | ------------------------------ |
| Linux | `DevIntern-PM-<ver>-linux-*.AppImage`, `.deb`, `latest-linux.yml` |
| Platform | Typical files under `release/` |
| -------- | -------------------------------------------------------------------------------------------------------- |
| Linux | `DevIntern-PM-<ver>-linux-*.AppImage`, `.deb`, `latest-linux.yml` |
| macOS | `DevIntern-PM-<ver>-mac-<arch>.dmg`, `DevIntern-PM-<ver>-mac-<arch>.zip`, `latest-mac.yml`, `*.blockmap` |

Local builds work without signing secrets. Release CI fails closed when macOS signing or notarization credentials are missing. Windows packaging is out of scope for now.
Expand All @@ -84,26 +86,32 @@ Before publishing a public release:
- **macOS:** confirm Restart & install (or quit + relaunch) lands on N+1 and Settings survive.
- **First release named `DevIntern PM.app`:** start from 0.9.8, then confirm the updater replaces `DevIntern-PM.app`, launches the spaced bundle name, and does not leave a duplicate app in `/Applications`.

## CI secrets (placeholders)
## CI configuration

Configure these on the repo / environment that runs `.github/workflows/pm-desktop-release.yml`. The release workflow fails when signing/notarization credentials are incomplete.
Configure these on the repo / environment that runs `.github/workflows/pm-desktop-release.yml`. Build-time values are compiled into the distributed application and are not confidential. The release workflow fails when signing/notarization credentials are incomplete.

### Analytics (build-time)

| Secret | Maps to env |
| ------ | ----------- |
| `POSTHOG_API_KEY` | Baked into the main bundle via `electron.vite.config.ts` at package time. Missing → analytics permanently no-op in that build. |
| `POSTHOG_HOST` | Optional; defaults to `https://us.i.posthog.com` when unset. |
| Repository setting | Kind | Maps to env |
| ------------------ | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `POSTHOG_API_KEY` | Actions secret | Baked into the main bundle via `electron.vite.config.ts` at package time. Use the PostHog project API key, not a personal API key. Missing → analytics permanently no-op in that build. |
| `POSTHOG_HOST` | Actions variable | Optional; defaults to `https://us.i.posthog.com` when unset. The existing Actions secret remains a compatibility fallback. |

### GitHub OAuth (build-time)

| Repository setting | Kind | Maps to env |
| ----------------------------------- | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `PM_DESKTOP_GITHUB_OAUTH_CLIENT_ID` | Actions variable | Maps to `GITHUB_OAUTH_CLIENT_ID`, the public GitHub App client ID baked into the main bundle. Missing → GitHub OAuth sign-in is hidden; PAT sign-in remains available. Do not configure or ship a client secret. |

### macOS (Apple Developer) — required

| Secret | Maps to env |
| ------ | ----------- |
| `PM_DESKTOP_CSC_LINK` | `CSC_LINK` (base64 `.p12` of **Developer ID Application**) |
| `PM_DESKTOP_CSC_KEY_PASSWORD` | `CSC_KEY_PASSWORD` |
| `PM_DESKTOP_APPLE_ID` | `APPLE_ID` |
| `PM_DESKTOP_APPLE_APP_SPECIFIC_PASSWORD` | `APPLE_APP_SPECIFIC_PASSWORD` |
| `PM_DESKTOP_APPLE_TEAM_ID` | `APPLE_TEAM_ID` |
| Secret | Maps to env |
| ---------------------------------------- | ---------------------------------------------------------- |
| `PM_DESKTOP_CSC_LINK` | `CSC_LINK` (base64 `.p12` of **Developer ID Application**) |
| `PM_DESKTOP_CSC_KEY_PASSWORD` | `CSC_KEY_PASSWORD` |
| `PM_DESKTOP_APPLE_ID` | `APPLE_ID` |
| `PM_DESKTOP_APPLE_APP_SPECIFIC_PASSWORD` | `APPLE_APP_SPECIFIC_PASSWORD` |
| `PM_DESKTOP_APPLE_TEAM_ID` | `APPLE_TEAM_ID` |

API-key notarization alternative: `PM_DESKTOP_APPLE_API_KEY_ID`, `PM_DESKTOP_APPLE_API_ISSUER`, and either `PM_DESKTOP_APPLE_API_KEY` (`.p8` body — materialized to a temp file at notarize time) or set `APPLE_API_KEY_FILE` to a path to the `.p8` on the runner. Notarization is skipped unless mac signing secrets (`PM_DESKTOP_CSC_*`) are also set.

Expand Down
Loading