ci: add manual build-only workflow with per-OS toggles

Author: xacnio

.github/workflows/build-artifacts.yml

@@ -0,0 +1,258 @@
+name: 'Build Artifacts (Manual)'
+
+# Manual-only: builds installers and uploads them as workflow artifacts.
+# Never creates a git tag or a GitHub Release.
+on:
+  workflow_dispatch:
+    inputs:
+      windows:
+        description: 'Build Windows (x64 + arm64)'
+        type: boolean
+        default: true
+      macos:
+        description: 'Build macOS (universal)'
+        type: boolean
+        default: true
+      linux:
+        description: 'Build Linux (x64 + arm64)'
+        type: boolean
+        default: false
+
+concurrency:
+  group: build-artifacts-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # Step 0: Turn the platforms input into a matrix include list
+  setup:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set.outputs.matrix }}
+    steps:
+      - id: set
+        shell: bash
+        run: |
+          ENTRIES=()
+
+          if [ "${{ inputs.windows }}" = "true" ]; then
+            ENTRIES+=('{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","rust-targets":"x86_64-pc-windows-msvc","cache-key":"win-x64"}')
+            ENTRIES+=('{"platform":"windows-latest","args":"--target aarch64-pc-windows-msvc","rust-targets":"aarch64-pc-windows-msvc","cache-key":"win-arm64"}')
+          fi
+
+          if [ "${{ inputs.macos }}" = "true" ]; then
+            ENTRIES+=('{"platform":"macos-14","args":"--target universal-apple-darwin -- --no-default-features","rust-targets":"aarch64-apple-darwin,x86_64-apple-darwin","cache-key":"macos-universal"}')
+          fi
+
+          if [ "${{ inputs.linux }}" = "true" ]; then
+            ENTRIES+=('{"platform":"ubuntu-22.04","args":"--target x86_64-unknown-linux-gnu","rust-targets":"x86_64-unknown-linux-gnu","cache-key":"linux-x64"}')
+            ENTRIES+=('{"platform":"ubuntu-22.04","args":"--target aarch64-unknown-linux-gnu --bundles deb,rpm","rust-targets":"aarch64-unknown-linux-gnu","cache-key":"linux-arm64"}')
+          fi
+
+          if [ ${#ENTRIES[@]} -eq 0 ]; then
+            echo "No platforms selected — pick at least one of windows/macos/linux." >&2
+            exit 1
+          fi
+
+          JOINED=$(IFS=,; echo "${ENTRIES[*]}")
+          echo "matrix={\"include\":[$JOINED]}" >> "$GITHUB_OUTPUT"
+
+  # Step 1: Build frontend once
+  build-frontend:
+    needs: setup
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+      - name: Cache node_modules
+        uses: actions/cache@v4
+        with:
+          path: node_modules
+          key: npm-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
+          restore-keys: |
+            npm-${{ runner.os }}-
+      - name: Install dependencies
+        run: npm ci
+      - name: Build frontend
+        run: npm run build
+      - name: Upload dist artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: frontend-dist
+          path: dist/
+          retention-days: 1
+
+  # Step 2: Build native binaries (no release, no tag)
+  build-tauri:
+    needs: [setup, build-frontend]
+    runs-on: ${{ matrix.platform }}
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.setup.outputs.matrix) }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Select latest stable Xcode
+        if: runner.os == 'macOS'
+        uses: maxim-lobanov/setup-xcode@v1
+        with:
+          xcode-version: latest-stable
+      # Split into small steps, each with a short timeout: any of these
+      # `security` subcommands can silently pop a GUI auth dialog on some
+      # macOS versions, which hangs forever on a headless runner with no one
+      # to click it. A per-step timeout turns that into a fast, clearly
+      # attributed failure instead of a frozen job.
+      - name: Create signing keychain (macOS)
+        if: runner.os == 'macOS'
+        timeout-minutes: 2
+        run: |
+          KEYCHAIN_PATH="$RUNNER_TEMP/signing.keychain-db"
+          KEYCHAIN_PASSWORD=$(uuidgen)
+          echo "::add-mask::$KEYCHAIN_PASSWORD"
+          echo "KEYCHAIN_PATH=$KEYCHAIN_PATH" >> "$GITHUB_ENV"
+          echo "KEYCHAIN_PASSWORD=$KEYCHAIN_PASSWORD" >> "$GITHUB_ENV"
+
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security list-keychains -d user -s "$KEYCHAIN_PATH" $(security list-keychains -d user | sed 's/"//g')
+
+      - name: Import certificate (macOS)
+        if: runner.os == 'macOS'
+        timeout-minutes: 2
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+        run: |
+          CERT_PATH="$RUNNER_TEMP/cert.p12"
+          echo "CERT_PATH=$CERT_PATH" >> "$GITHUB_ENV"
+          echo -n "$APPLE_CERTIFICATE" | base64 --decode -o "$CERT_PATH"
+          security import "$CERT_PATH" -k "$KEYCHAIN_PATH" -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security
+
+      - name: Set key partition list (macOS)
+        if: runner.os == 'macOS'
+        timeout-minutes: 2
+        run: |
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+
+      - name: Extract plain cert from p12 (macOS)
+        if: runner.os == 'macOS'
+        timeout-minutes: 1
+        env:
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+        run: |
+          CERT_PEM_PATH="$RUNNER_TEMP/cert.pem"
+          echo "CERT_PEM_PATH=$CERT_PEM_PATH" >> "$GITHUB_ENV"
+          openssl pkcs12 -in "$CERT_PATH" -clcerts -nokeys -passin pass:"$APPLE_CERTIFICATE_PASSWORD" -out "$CERT_PEM_PATH"
+
+      - name: Trust self-signed cert (macOS)
+        if: runner.os == 'macOS'
+        timeout-minutes: 1
+        run: |
+          # Self-signed root: not trusted by default like a real Apple cert
+          # chain would be, so codesign can't resolve it without this.
+          # add-trusted-cert (with or without -d) normally pops a GUI auth
+          # dialog for trust-settings changes, which hangs forever with no
+          # one to click it. Relaxing this one authorization right lets sudo
+          # satisfy it non-interactively instead - documented workaround for
+          # exactly this CI hang.
+          sudo security authorizationdb write com.apple.trust-settings.admin allow
+          sudo security add-trusted-cert -d -r trustRoot "$CERT_PEM_PATH"
+
+      - name: Verify signing identity is resolvable (macOS)
+        if: runner.os == 'macOS'
+        timeout-minutes: 1
+        run: security find-identity -v -p codesigning "$KEYCHAIN_PATH"
+      - name: Install Linux dependencies (x64)
+        if: matrix.cache-key == 'linux-x64'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y build-essential pkg-config libssl-dev libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libasound2-dev libxdo-dev
+      - name: Install Linux cross-compile dependencies (arm64)
+        if: matrix.cache-key == 'linux-arm64'
+        run: |
+          sudo dpkg --add-architecture arm64
+          # Add arm64 sources from ports.ubuntu.com
+          echo "deb [arch=arm64] http://ports.ubuntu.com/ jammy main restricted universe multiverse" | sudo tee /etc/apt/sources.list.d/arm64.list
+          echo "deb [arch=arm64] http://ports.ubuntu.com/ jammy-updates main restricted universe multiverse" | sudo tee -a /etc/apt/sources.list.d/arm64.list
+          # Restrict existing sources to amd64 only
+          sudo sed -i 's/^deb /deb [arch=amd64] /' /etc/apt/sources.list
+          sudo apt-get update
+          sudo apt-get install -y build-essential pkg-config libssl-dev libssl-dev:arm64 gcc-aarch64-linux-gnu g++-aarch64-linux-gnu patchelf \
+            libgtk-3-dev:arm64 libwebkit2gtk-4.1-dev:arm64 libappindicator3-dev:arm64 \
+            librsvg2-dev:arm64 libasound2-dev:arm64 libxdo-dev:arm64
+          echo "PKG_CONFIG_ALLOW_CROSS=1" >> $GITHUB_ENV
+          echo "PKG_CONFIG_PATH=/usr/lib/aarch64-linux-gnu/pkgconfig" >> $GITHUB_ENV
+          echo "PKG_CONFIG_SYSROOT_DIR=/" >> $GITHUB_ENV
+          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> $GITHUB_ENV
+      - name: Download frontend
+        uses: actions/download-artifact@v4
+        with:
+          name: frontend-dist
+          path: dist/
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.rust-targets }}
+      - name: Set up sccache
+        uses: mozilla-actions/sccache-action@v0.0.7
+      - name: Rust cache
+        uses: swatinem/rust-cache@v2
+        with:
+          workspaces: './src-tauri -> target'
+          shared-key: ${{ matrix.cache-key }}-${{ hashFiles('package.json') }}
+          # sccache already caches compiled objects; caching the whole target/
+          # dir here too would just double up on the repo's 10GB cache quota.
+          cache-targets: false
+
+      - name: Cache node_modules
+        uses: actions/cache@v4
+        with:
+          path: node_modules
+          key: npm-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
+          restore-keys: |
+            npm-${{ runner.os }}-
+      - name: Install npm deps
+        run: npm ci
+
+      - name: Skip frontend build
+        run: node -e "const f='src-tauri/tauri.conf.json';const j=JSON.parse(require('fs').readFileSync(f,'utf8'));j.build.beforeBuildCommand='';require('fs').writeFileSync(f,JSON.stringify(j,null,4))"
+
+      - name: Build (no release)
+        uses: tauri-apps/tauri-action@v0.6
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
+          GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
+          # Self-signed cert (no Apple Developer account): keeps the code
+          # signature identity stable across builds so macOS TCC permissions
+          # (Screen Recording) survive updates. Not notarized. Already
+          # imported and trusted by the step above — only the identity name
+          # is needed here, not the cert itself.
+          APPLE_SIGNING_IDENTITY: 'Shotcove Self Signed'
+        with:
+          args: ${{ matrix.args }}
+          # includeRelease controls whether `tauri build` actually runs, not
+          # whether a GitHub Release gets created — that only happens if
+          # tagName/releaseId is set below, which we deliberately omit.
+          includeRelease: true
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: shotcove-${{ matrix.cache-key }}
+          path: |
+            src-tauri/target/**/release/bundle/msi/*.msi
+            src-tauri/target/**/release/bundle/nsis/*.exe
+            src-tauri/target/**/release/bundle/dmg/*.dmg
+            src-tauri/target/**/release/bundle/deb/*.deb
+            src-tauri/target/**/release/bundle/rpm/*.rpm
+            src-tauri/target/**/release/bundle/appimage/*.AppImage
+          if-no-files-found: warn