修雨
bd711108f9
GoReleaser cross-compiles darwin/arm64 binaries on ubuntu-latest with no codesign step. macOS 11+ on Apple Silicon requires at least an ad-hoc signature; unsigned arm64 binaries are SIGKILL'd by amfid on first exec, which surfaces as `signal: killed` and aborts `dws upgrade` at the "解压并验证" step. Two layers of fix: 1. Release-side: post-goreleaser.sh now unpacks each dws-darwin-*.tar.gz, applies an ad-hoc signature (codesign locally, rcodesign in CI), deterministically repacks, and rewrites the matching line in checksums.txt. release.yml installs rcodesign 0.27.0 before GoReleaser runs. 2. Client-side self-heal: validateNewBinary detects `signal: killed` on darwin and retries once after running `codesign --force --sign -` and clearing com.apple.quarantine. Future releases stay functional even if the signing step is ever skipped. Verified end-to-end: stripped a real dws binary → exec exits 137 → validateNewBinary recovers → final binary shows Signature=adhoc and runs.
72 lines
2.0 KiB
YAML
72 lines
2.0 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
|
|
- name: Install archive tooling
|
|
run: sudo apt-get update && sudo apt-get install -y zip unzip
|
|
|
|
- name: Install rcodesign (ad-hoc sign darwin binaries from Linux)
|
|
run: |
|
|
set -eu
|
|
RCS_VERSION="0.27.0"
|
|
curl -fsSL -o /tmp/rcodesign.tar.gz \
|
|
"https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F${RCS_VERSION}/apple-codesign-${RCS_VERSION}-x86_64-unknown-linux-musl.tar.gz"
|
|
mkdir -p /tmp/rcodesign
|
|
tar -xzf /tmp/rcodesign.tar.gz -C /tmp/rcodesign --strip-components=1
|
|
sudo install -m 0755 /tmp/rcodesign/rcodesign /usr/local/bin/rcodesign
|
|
rcodesign --version
|
|
|
|
- name: Run GoReleaser
|
|
uses: goreleaser/goreleaser-action@v6
|
|
with:
|
|
version: "~> v2"
|
|
args: release --clean
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Post-release packaging
|
|
run: ./scripts/release/post-goreleaser.sh
|
|
env:
|
|
DWS_PACKAGE_VERSION: ${{ github.ref_name }}
|
|
|
|
- name: Upload dws-skills.zip to release
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
gh release upload "${{ github.ref_name }}" dist/dws-skills.zip --clobber
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "20"
|
|
registry-url: "https://registry.npmjs.org"
|
|
|
|
- name: Publish to npm
|
|
working-directory: dist/npm/dingtalk-workspace-cli
|
|
run: npm publish --access public
|
|
env:
|
|
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
|