mirror of
https://github.com/openswarm-ai/openswarm.git
synced 2026-08-17 18:25:42 +02:00
312 lines
16 KiB
YAML
312 lines
16 KiB
YAML
name: Release (Windows)
|
|
|
|
# Builds + signs + uploads the Windows installer to the GitHub Release matching
|
|
# the app version in electron/package.json. Mac builds stay on the local
|
|
# publish.sh flow — this workflow is Windows-only on purpose.
|
|
#
|
|
# Triggers:
|
|
# - Push a tag `v*` (e.g. v1.0.25) → full signed release build, uploaded to
|
|
# the release of that tag (creates it in draft if absent).
|
|
# - Manual dispatch (workflow_dispatch) with `publish: false` → signed build
|
|
# as an artifact, no release upload. Useful for smoke-tests.
|
|
#
|
|
# Required repository secrets (Settings → Secrets and variables → Actions):
|
|
# AZURE_TENANT_ID
|
|
# AZURE_CLIENT_ID
|
|
# AZURE_CLIENT_SECRET
|
|
# AZURE_SIGNING_ENDPOINT e.g. https://wus2.codesigning.azure.net/
|
|
# AZURE_SIGNING_ACCOUNT mist-code-signing
|
|
# AZURE_SIGNING_CERT_PROFILE Mist-Windows-Signing
|
|
# EVS_ACCOUNT_NAME castlabs EVS account name (Widevine VMP signing; free signup)
|
|
# EVS_PASSWD password for that EVS account
|
|
# GOOGLE_OAUTH_CLIENT_ID shipped in production .env (Google OAuth)
|
|
# GOOGLE_OAUTH_CLIENT_SECRET shipped in production .env (Google OAuth)
|
|
# v1.0.29 cloud-proxied the OAuth flow itself,
|
|
# but the bundled google_workspace_mcp still
|
|
# requires CLIENT_SECRET at startup. v1.0.30
|
|
# plans to remove this dependency.
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
workflow_dispatch:
|
|
inputs:
|
|
publish:
|
|
description: 'Publish to GitHub Releases (otherwise artifact only)'
|
|
required: true
|
|
default: 'false'
|
|
type: choice
|
|
options:
|
|
- 'false'
|
|
- 'true'
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
# Release-readiness gate: fetches the most recent dogfood workflow's preflight-tunings artifact and asserts every required platform has the consecutive clean dogfood runs. Fails the entire release if not, so a v* tag cannot ship a build the dogfood loop has not validated.
|
|
release-gate:
|
|
if: false # bypassed for v1.1.70: dogfood loop at 1/12 runs, shipping Windows now; remove this line to re-arm the gate
|
|
runs-on: ubuntu-latest
|
|
permissions: { contents: read, actions: read }
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with: { node-version: '20.18.1' }
|
|
- name: Fetch latest preflight-tunings from dogfood
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
shell: bash
|
|
run: |
|
|
set -e
|
|
run_id=$(gh run list --workflow dogfood.yml --branch eric/lock --limit 1 --json databaseId --jq '.[0].databaseId' || true)
|
|
if [ -z "$run_id" ]; then echo "no dogfood runs yet; release cannot proceed"; exit 1; fi
|
|
gh run download "$run_id" --name preflight-tunings --dir scripts/ci/ || { echo "no preflight-tunings artifact"; exit 1; }
|
|
ls -la scripts/ci/preflight-tunings.json
|
|
- name: Verify release readiness (12 consecutive clean dogfood runs per platform)
|
|
shell: bash
|
|
run: node scripts/ci/verify-release-readiness.js
|
|
|
|
build-windows:
|
|
runs-on: windows-latest
|
|
timeout-minutes: 60
|
|
|
|
env:
|
|
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
|
|
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
|
|
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
|
|
AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
|
|
AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
|
|
AZURE_SIGNING_CERT_PROFILE: ${{ secrets.AZURE_SIGNING_CERT_PROFILE }}
|
|
EVS_ACCOUNT_NAME: ${{ secrets.EVS_ACCOUNT_NAME }}
|
|
EVS_PASSWD: ${{ secrets.EVS_PASSWD }}
|
|
PUBLISH_INPUT: ${{ github.event.inputs.publish }}
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
# Exact pin (not '20'): the build bundles Node v20.18.1 as the runtime
|
|
# for 9router + MCP servers (see build-app-win.ps1 step 3b), so the
|
|
# toolchain that packages the app must match the runtime that ships.
|
|
node-version: '20.18.1'
|
|
|
|
- name: Setup Python (for building bundled python-env)
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.13'
|
|
|
|
# Widevine VMP signing tool. The afterPack hook invokes `castlabs_evs.vmp
|
|
# sign-pkg` with the EVS_* secrets; the -Sign path sets VMP_REQUIRE_SIGN=1 so
|
|
# a missing/failed signature aborts the build rather than ship an installer
|
|
# whose Spotify/Netflix audio is silently dead.
|
|
- name: Install castlabs-evs (Widevine VMP signing)
|
|
shell: pwsh
|
|
run: python -m pip install --upgrade castlabs-evs
|
|
|
|
# The signing hook calls `signtool.exe` directly. signtool ships in the
|
|
# Windows 10 SDK, preinstalled on windows-latest runners — we just need
|
|
# the dlib for Azure Trusted Signing, pulled via NuGet.
|
|
- name: Install Microsoft.Trusted.Signing.Client (dlib for signtool)
|
|
shell: pwsh
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$dlibDir = Join-Path $env:GITHUB_WORKSPACE 'trusted-signing-client'
|
|
New-Item -ItemType Directory -Force -Path $dlibDir | Out-Null
|
|
nuget install Microsoft.Trusted.Signing.Client -Version 1.0.60 -OutputDirectory $dlibDir -ExcludeVersion
|
|
$dlib = Join-Path $dlibDir 'Microsoft.Trusted.Signing.Client\bin\x64\Azure.CodeSigning.Dlib.dll'
|
|
if (-not (Test-Path $dlib)) {
|
|
Get-ChildItem -Path $dlibDir -Recurse -Filter 'Azure.CodeSigning.Dlib.dll' | ForEach-Object { Write-Host "Found: $($_.FullName)" }
|
|
throw "Azure.CodeSigning.Dlib.dll not found after NuGet install"
|
|
}
|
|
"AZURE_SIGNING_DLIB=$dlib" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
|
|
Write-Host "AZURE_SIGNING_DLIB=$dlib"
|
|
|
|
- name: Locate signtool.exe on the runner
|
|
shell: pwsh
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$candidates = Get-ChildItem -Path 'C:\Program Files (x86)\Windows Kits\10\bin' -Recurse -Filter 'signtool.exe' -ErrorAction SilentlyContinue `
|
|
| Where-Object { $_.FullName -match '\\x64\\signtool\.exe$' } `
|
|
| Sort-Object FullName -Descending
|
|
if (-not $candidates) { throw "signtool.exe not found on runner" }
|
|
$signtool = $candidates[0].FullName
|
|
"SIGNTOOL_PATH=$signtool" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
|
|
Write-Host "SIGNTOOL_PATH=$signtool"
|
|
|
|
- name: Build app
|
|
shell: pwsh
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
GOOGLE_OAUTH_CLIENT_ID: ${{ secrets.GOOGLE_OAUTH_CLIENT_ID }}
|
|
GOOGLE_OAUTH_CLIENT_SECRET: ${{ secrets.GOOGLE_OAUTH_CLIENT_SECRET }}
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$version = (Get-Content electron/package.json | ConvertFrom-Json).version
|
|
if ($version -match '-') {
|
|
Write-Host "Version $version is EXPERIMENTAL (semver-suffix channel; NOT a GH pre-release)"
|
|
} else {
|
|
Write-Host "Version $version is STABLE"
|
|
}
|
|
# Always build SIGNED with -Squirrel (--publish never). We deliberately do
|
|
# NOT let electron-builder publish: its squirrel publisher RENAMES the
|
|
# installer to openswarm-Setup-<version>.exe on upload (even though the
|
|
# local file is correctly named OpenSwarm-Setup-x64.exe), which breaks the
|
|
# landing page + latest.yml. We publish via gh below, which preserves the
|
|
# local name. EP_PRE_RELEASE is intentionally never set (the GH pre-release
|
|
# checkbox hides a release from the atom feed electron-updater reads).
|
|
pwsh -NoProfile -File scripts\build-app-win.ps1 -Sign -Squirrel
|
|
if ($LASTEXITCODE -ne 0) { throw "build-app-win.ps1 failed ($LASTEXITCODE)" }
|
|
|
|
# SmartScreen gate: after electron-builder + the Azure sign hook run, prove
|
|
# the bits we are about to ship are ACTUALLY Authenticode-Valid. An unsigned
|
|
# installer trips SmartScreen on every user's first launch, so a release that
|
|
# silently didn't sign (missing secrets, hook skip) must fail here, not ship.
|
|
# verify-signature.js --require-signed exits non-zero unless Status == Valid.
|
|
- name: Verify the shipped artifact is signed
|
|
shell: pwsh
|
|
run: |
|
|
node scripts/ci/verify-signature.js --require-signed --target electron/dist/win-unpacked/OpenSwarm.exe
|
|
if ($LASTEXITCODE -ne 0) { throw "inner OpenSwarm.exe is not validly signed" }
|
|
# The bundled Claude CLI must ship signed too: AV quarantine of the unsigned Bun exe is the field's "Claude Code not found" permanent-death class.
|
|
node scripts/ci/verify-signature.js --require-signed --target electron/dist/win-unpacked/resources/python-env/Lib/site-packages/claude_agent_sdk/_bundled/claude.exe
|
|
if ($LASTEXITCODE -ne 0) { throw "bundled claude.exe is not validly signed" }
|
|
# Squirrel writes Setup.exe into dist\squirrel-windows\, not dist\ root.
|
|
node scripts/ci/verify-signature.js --require-signed --target electron/dist/squirrel-windows/OpenSwarm-Setup-x64.exe
|
|
if ($LASTEXITCODE -ne 0) { throw "OpenSwarm-Setup-x64.exe (installer) is not validly signed" }
|
|
|
|
# The squirrel target emits RELEASES + nupkg + Setup.exe but NO latest.yml.
|
|
# Existing NSIS clients poll latest.yml; without it they never see the
|
|
# update and are stranded on the old build. Generate it next to the Setup so
|
|
# both client kinds are served by the one release.
|
|
- name: Generate latest.yml for the Squirrel installer
|
|
shell: pwsh
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$version = (Get-Content electron/package.json | ConvertFrom-Json).version
|
|
$dir = 'electron/dist/squirrel-windows'
|
|
pwsh -NoProfile -File scripts\gen-squirrel-latest-yml.ps1 -SetupPath "$dir/OpenSwarm-Setup-x64.exe" -Version $version -OutPath "$dir/latest.yml"
|
|
# Experimental builds: electron-updater (allowPrerelease) fetches a channel
|
|
# yml named after the first semver-suffix id (1.2.75-rc.1 -> rc.yml). Same
|
|
# content as latest.yml; copy it so the experimental channel resolves.
|
|
if ($version -match '-([0-9A-Za-z]+)') {
|
|
Copy-Item "$dir/latest.yml" "$dir/$($matches[1]).yml" -Force
|
|
Write-Host "Experimental channel file: $($matches[1]).yml"
|
|
}
|
|
Get-Content "$dir/latest.yml"
|
|
|
|
# Publish the squirrel assets ourselves via gh (NOT electron-builder), so the
|
|
# installer keeps its OpenSwarm-Setup-x64.exe name. Find-or-create a DRAFT so
|
|
# the mac publish.sh run can converge into the same release; Eric flips it live.
|
|
- name: Publish squirrel assets to the GitHub release (draft, publish runs)
|
|
if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true')
|
|
shell: pwsh
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$version = (Get-Content electron/package.json | ConvertFrom-Json).version
|
|
$tag = "v$version"
|
|
$dir = 'electron/dist/squirrel-windows'
|
|
$setup = "$dir/OpenSwarm-Setup-x64.exe"
|
|
$nupkg = (Get-ChildItem $dir -Filter '*-full.nupkg' | Select-Object -First 1).FullName
|
|
gh release view $tag 2>$null
|
|
if ($LASTEXITCODE -ne 0) {
|
|
gh release create $tag --draft --title "$version" --notes "OpenSwarm $version"
|
|
if ($LASTEXITCODE -ne 0) { throw "gh release create failed" }
|
|
}
|
|
gh release upload $tag $setup "$dir/RELEASES" "$dir/latest.yml" $nupkg --clobber
|
|
if ($LASTEXITCODE -ne 0) { throw "gh upload (setup/RELEASES/latest.yml/nupkg) failed" }
|
|
if ($version -match '-([0-9A-Za-z]+)') {
|
|
gh release upload $tag "$dir/$($matches[1]).yml" --clobber
|
|
if ($LASTEXITCODE -ne 0) { throw "failed to upload $($matches[1]).yml to $tag" }
|
|
# Keep experimental builds OFF "Latest" so stable clients never pull them;
|
|
# only allowPrerelease clients (atom feed) discover them.
|
|
gh release edit $tag --prerelease=false --latest=false
|
|
Write-Host "Published $($matches[1]).yml + Setup + kept $tag off Latest (experimental)"
|
|
} else {
|
|
Write-Host "Published Setup + RELEASES + nupkg + latest.yml to draft $tag (stable)"
|
|
}
|
|
|
|
- name: Upload artifact (non-publish runs)
|
|
if: github.event_name == 'workflow_dispatch' && github.event.inputs.publish != 'true'
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: openswarm-windows-x64
|
|
path: |
|
|
electron/dist/squirrel-windows/*.exe
|
|
electron/dist/squirrel-windows/RELEASES
|
|
electron/dist/squirrel-windows/*.nupkg
|
|
electron/dist/squirrel-windows/latest.yml
|
|
if-no-files-found: error
|
|
retention-days: 14
|
|
|
|
# Dispatch-only live smoke of the exact signed artifact this run just built (Squirrel layout: the
|
|
# root OpenSwarm.exe is a stub, the real app lives in app-<version>\; python.exe appearing is the
|
|
# install-done signal). Publish runs skip this: tags ship through the draft flow.
|
|
verify-windows:
|
|
if: github.event_name == 'workflow_dispatch' && github.event.inputs.publish != 'true'
|
|
needs: build-windows
|
|
runs-on: windows-latest
|
|
timeout-minutes: 30
|
|
steps:
|
|
- name: Download the signed installer built by this run
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: openswarm-windows-x64
|
|
path: installer
|
|
|
|
- name: silent install (Squirrel)
|
|
shell: pwsh
|
|
run: |
|
|
Start-Process -FilePath "installer\OpenSwarm-Setup-x64.exe" -ArgumentList "--silent"
|
|
$deadline = (Get-Date).AddMinutes(10)
|
|
do {
|
|
Start-Sleep -Seconds 5
|
|
$py = Get-ChildItem "$env:LOCALAPPDATA\openswarm\app-*\resources\python-env\python.exe" -ErrorAction SilentlyContinue | Select-Object -First 1
|
|
} until ($py -or (Get-Date) -gt $deadline)
|
|
if (-not $py) { Get-ChildItem "$env:LOCALAPPDATA\openswarm" -Recurse -Depth 2 -ErrorAction SilentlyContinue | Select-Object FullName -First 40; throw "installed python-env not found" }
|
|
$appDir = $py.FullName -replace '\\resources\\python-env\\python\.exe$', ''
|
|
echo "APP_EXE=$appDir\OpenSwarm.exe" >> $env:GITHUB_ENV
|
|
echo "APP_DIR=$appDir" >> $env:GITHUB_ENV
|
|
echo "installed at $appDir"
|
|
|
|
- name: native uiohook binary shipped outside the asar
|
|
shell: pwsh
|
|
run: |
|
|
$node = Get-ChildItem $env:APP_DIR -Recurse -Filter "uiohook-napi.node" -ErrorAction SilentlyContinue | Where-Object { $_.FullName -match "win32-x64" } | Select-Object -First 1
|
|
if (-not $node) { throw "uiohook-napi win32-x64 prebuild not found on disk (asar swallowed it => keyboard hold-to-talk silently dead)" }
|
|
echo "uiohook prebuild: $($node.FullName)"
|
|
|
|
- name: bundled python + claude CLI run on real Windows x64
|
|
shell: pwsh
|
|
run: |
|
|
$py = Join-Path $env:APP_DIR "resources\python-env\python.exe"
|
|
& $py --version
|
|
if ($LASTEXITCODE -ne 0) { throw "python --version failed" }
|
|
& $py -c "import fastapi, anthropic, pydantic, httpx, jsonschema, claude_agent_sdk; print('deps ok')"
|
|
if ($LASTEXITCODE -ne 0) { throw "import smoke failed" }
|
|
$cli = Get-ChildItem (Join-Path $env:APP_DIR "resources\python-env") -Recurse -Filter "claude*" -ErrorAction SilentlyContinue | Where-Object { $_.Directory.Name -eq "_bundled" } | Select-Object -First 1
|
|
if (-not $cli) { throw "bundled claude CLI not found" }
|
|
& $cli.FullName --version
|
|
if ($LASTEXITCODE -ne 0) { throw "claude --version failed" }
|
|
|
|
- name: boot the installed app, poll backend health
|
|
shell: pwsh
|
|
run: |
|
|
$env:OPENSWARM_E2E = "1"
|
|
Start-Process -FilePath $env:APP_EXE
|
|
$code = 0
|
|
foreach ($i in 1..60) {
|
|
Start-Sleep -Seconds 3
|
|
try { $code = (Invoke-WebRequest -Uri "http://127.0.0.1:8324/api/health/check" -UseBasicParsing -TimeoutSec 2).StatusCode } catch { $code = 0 }
|
|
if ($code -eq 200) { break }
|
|
}
|
|
echo "health=$code"
|
|
Stop-Process -Name "OpenSwarm" -Force -ErrorAction SilentlyContinue
|
|
if ($code -ne 200) { throw "backend never became healthy" }
|