BuzzbeeSCD/openchamber
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: sign Tauri migration payload with Tauri signer

Browse Source
This commit is contained in:
Bohdan Triapitsyn
2026-05-22 02:36:06 +03:00
parent 9faf97acbd
commit 8e11373865
2 changed files with 24 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release.yml
+11 -8
View File
@@ -104,6 +104,7 @@ jobs:
run: npm pack
- name: Upload npm tarball to release
if: ${{ github.event.inputs.dry_run != 'true' }}
uses: softprops/action-gh-release@v2
with:
tag_name: v${{ needs.create-release.outputs.version }}
@@ -287,19 +288,22 @@ jobs:
steps:
- uses: actions/checkout@v4
- name: Setup bun
uses: oven-sh/setup-bun@v2
- name: Install dependencies
run: bun install --frozen-lockfile
- name: Download signed Electron app
uses: actions/download-artifact@v4
with:
name: electron-app-${{ matrix.arch }}
path: staged
- name: Install minisign
run: brew install minisign
- name: Tar and sign Electron app as Tauri update payload
env:
TAURI_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
TAURI_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
VERSION: ${{ needs.create-release.outputs.version }}
run: |
set -euo pipefail
@@ -319,11 +323,10 @@ jobs:
TARBALL="OpenChamber.app.tar.gz"
tar -czf "$TARBALL" OpenChamber.app
printf '%s\n' "$TAURI_KEY" > ../tauri-signing.key
printf '%s\n' "$TAURI_KEY_PASSWORD" | minisign -S -s ../tauri-signing.key -m "$TARBALL" -W
bun run --cwd ../packages/desktop tauri signer sign "$PWD/$TARBALL"
mv "$TARBALL" "OpenChamber-${VERSION}-${{ matrix.platform }}.app.tar.gz"
mv "${TARBALL}.minisig" "OpenChamber-${VERSION}-${{ matrix.platform }}.app.tar.gz.sig"
mv "${TARBALL}.sig" "OpenChamber-${VERSION}-${{ matrix.platform }}.app.tar.gz.sig"
- name: Generate Tauri latest platform manifest
env:
docs/TAURI_TO_ELECTRON_CUTOVER.md
+13 -14
View File
@@ -20,7 +20,7 @@ and each has its own auto-update channel:
| Shell | Manifest | Update format | Secret used to sign |
|----------|-------------------|---------------------|---------------------|
| Tauri | `latest.json` | `.tar.gz` + `.sig` | `TAURI_SIGNING_PRIVATE_KEY` (minisign) |
| Tauri | `latest.json` | `.tar.gz` + `.sig` | `TAURI_SIGNING_PRIVATE_KEY` (Tauri signer / minisign format) |
| Electron | `latest-mac.yml` | `.zip` + `blockmap` | Developer ID codesign (APPLE_* secrets) |
Existing Tauri installs keep their own auto-update path (`latest.json`).
@@ -99,7 +99,7 @@ The transition works like this:
2. It uploads the signed `OpenChamber.app` as a short-lived Actions artifact.
3. `repackage-electron-as-tauri-update` downloads that Electron `.app`.
4. It packs it into `OpenChamber-<version>-darwin-*.app.tar.gz`.
5. It signs that tarball with the existing Tauri minisign private key.
5. It signs that tarball with `tauri signer sign` and the existing Tauri signing key.
6. It uploads the tarball and `.sig` to the GitHub release.
7. It generates Tauri-compatible manifests and `combine-manifests` merges them into `latest.json`.
@@ -183,13 +183,10 @@ repackage-electron-as-tauri-update:
name: electron-app-${{ matrix.arch }}
path: staged
- name: Install minisign
run: brew install minisign
- name: Tar and sign Electron .app as Tauri update payload
env:
TAURI_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
TAURI_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
VERSION: ${{ needs.create-release.outputs.version }}
run: |
set -euo pipefail
@@ -200,16 +197,13 @@ repackage-electron-as-tauri-update:
TARBALL="OpenChamber.app.tar.gz"
tar -czf "$TARBALL" OpenChamber.app
# minisign needs the private key written to a file and a non-interactive
# password via -W (or env). The key in the secret is a minisign secret
# key block (base64-ish multi-line blob). Write to a file verbatim.
echo "$TAURI_KEY" > ../tauri-signing.key
echo "$TAURI_KEY_PASSWORD" | minisign -S -s ../tauri-signing.key \
-m "$TARBALL" -W
# Use Tauri's signer instead of minisign directly. The CI secret is in
# the format consumed by TAURI_SIGNING_PRIVATE_KEY.
bun run --cwd ../packages/desktop tauri signer sign "$PWD/$TARBALL"
# Rename per platform so the release has distinct names for arm64/x64.
mv "$TARBALL" "OpenChamber-${VERSION}-${{ matrix.platform }}.app.tar.gz"
mv "${TARBALL}.minisig" "OpenChamber-${VERSION}-${{ matrix.platform }}.app.tar.gz.sig"
mv "${TARBALL}.sig" "OpenChamber-${VERSION}-${{ matrix.platform }}.app.tar.gz.sig"
- name: Generate Tauri latest-<platform>.json
env:
@@ -315,6 +309,11 @@ The manual arm64 macOS DMG workflow has already been changed to build Electron
only, so there should be no GitHub Actions path that accidentally produces a new
Tauri DMG.
When rerunning the same release version with `workflow_dispatch`, use
`dry_run=true` if npm and marketplace packages are already published. In that
mode the workflow still rebuilds release assets, but skips publishing to npm and
skips re-uploading the npm tarball asset.
## Validation before tagging the transition release
You must manually validate with a real Tauri install. Do NOT skip this.