adrianbonpin
0cb70ecee0
v1.4.0: CSV/Excel/JSON/NextUp exports, units-first smart year standing, live export progress bar, AES-GCM at-rest password encryption.
83 lines
3.0 KiB
YAML
83 lines
3.0 KiB
YAML
name: build-extension
|
|
|
|
# Build + release only on version tags. Daily dev/test runs live in ci.yml.
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
|
|
# Ensure the job token can create releases and upload assets.
|
|
permissions:
|
|
contents: write
|
|
releases: write
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
|
|
- name: Install dev dependencies
|
|
run: npm ci || npm install
|
|
|
|
- name: Install PyMuPDF + openpyxl (PDF text + XLSX validation)
|
|
run: |
|
|
python3 -m venv /tmp/venv
|
|
/tmp/venv/bin/pip install --quiet pymupdf openpyxl
|
|
echo "/tmp/venv/bin" >> "$GITHUB_PATH"
|
|
|
|
- name: Run tests
|
|
run: npm test
|
|
|
|
- name: Validate exports open in real readers
|
|
run: node scripts/validate-exports.js
|
|
|
|
- name: Build both variants
|
|
run: node scripts/build.js all
|
|
|
|
- name: Sign Firefox build (xpi for permanent install)
|
|
# Optional: only runs when the AMO credentials exist as repo secrets.
|
|
# Signing requires a version AMO has not seen before — bump
|
|
# manifest.json before tagging (1.2.0 and 1.3.0 are already on AMO).
|
|
if: env.AMO_JWT_ISSUER != '' && env.AMO_JWT_SECRET != ''
|
|
env:
|
|
AMO_JWT_ISSUER: ${{ secrets.AMO_JWT_ISSUER }}
|
|
AMO_JWT_SECRET: ${{ secrets.AMO_JWT_SECRET }}
|
|
run: |
|
|
set -euo pipefail
|
|
npm run sign
|
|
XPI=$(ls dist/*.xpi | head -1)
|
|
VERSION=$(node -p "require('./dist/firefox/manifest.json').version")
|
|
mv "$XPI" "dist/ismis-helper-${VERSION}-an+fx.xpi"
|
|
|
|
- name: Publish release
|
|
# Gitea-native release: softprops/action-gh-release targets GitHub's API
|
|
# and fails on Gitea (405). Instead we call the Gitea API directly with
|
|
# the runner-provided GITHUB_TOKEN and GITHUB_API_URL.
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
REPO="${{ github.repository }}"
|
|
TAG="${{ github.ref_name }}"
|
|
API="${GITHUB_API_URL:-https://git.ranio.xyz/api/v1}"
|
|
# Create the release for the tag
|
|
RELEASE_JSON=$(curl -sS -X POST \
|
|
-H "Authorization: token ${GITHUB_TOKEN}" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"tag_name\":\"${TAG}\",\"name\":\"${TAG}\",\"body\":\"ISMIS Helper ${TAG}\"}" \
|
|
"${API}/repos/${REPO}/releases")
|
|
RELEASE_ID=$(echo "${RELEASE_JSON}" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
|
|
# Attach zips and the signed xpi (if present) as release assets
|
|
for f in dist/*.zip dist/*.xpi; do
|
|
[ -f "$f" ] || continue
|
|
curl -sS -X POST \
|
|
-H "Authorization: token ${GITHUB_TOKEN}" \
|
|
-F "attachment=@${f}" \
|
|
"${API}/repos/${REPO}/releases/${RELEASE_ID}/assets?name=$(basename "${f}")"
|
|
done |