feat(tooling): update upstream CI settings to work with fork (#393 #495

#551 #863)

.github/workflows/ci.yml

@@ -4,38 +4,14 @@ on:
   push:
     branches:
       - development
+      - linux
+      - 'linux-release-*'
+    tags:
+      - 'release-*.*.*-linux*'
   pull_request:
-  workflow_call:
-    inputs:
-      repository:
-        default: desktop/desktop
-        required: false
-        type: string
-      ref:
-        required: true
-        type: string
-      upload-artifacts:
-        default: false
-        required: false
-        type: boolean
-      environment:
-        type: string
-        required: true
-      sign:
-        type: boolean
-        default: true
-        required: false
-    secrets:
-      AZURE_CODE_SIGNING_TENANT_ID:
-      AZURE_CODE_SIGNING_CLIENT_ID:
-      AZURE_CODE_SIGNING_CLIENT_SECRET:
-      DESKTOP_OAUTH_CLIENT_ID:
-      DESKTOP_OAUTH_CLIENT_SECRET:
-      APPLE_ID:
-      APPLE_ID_PASSWORD:
-      APPLE_TEAM_ID:
-      APPLE_APPLICATION_CERT:
-      APPLE_APPLICATION_CERT_PASSWORD:
+    branches:
+      - linux
+      - 'linux-release-*'
 
 env:
   NODE_VERSION: 20.11.1
@@ -66,17 +42,22 @@ jobs:
     name: ${{ matrix.friendlyName }} ${{ matrix.arch }}
     runs-on: ${{ matrix.os }}
     permissions:
-      contents: read
+      contents: write
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-13-xl-arm64, windows-2019]
+        os: [macos-13, windows-2019, ubuntu-20.04]
         arch: [x64, arm64]
         include:
-          - os: macos-13-xl-arm64
+          - os: macos-13
             friendlyName: macOS
           - os: windows-2019
             friendlyName: Windows
+          - os: ubuntu-20.04
+            friendlyName: Ubuntu
+        exclude:
+          - os: ubuntu-20.04
+            arch: arm64
     timeout-minutes: 60
     env:
       RELEASE_CHANNEL: ${{ inputs.environment }}
@@ -102,14 +83,6 @@ jobs:
       - name: Build production app
         run: yarn build:prod
         env:
-          DESKTOP_OAUTH_CLIENT_ID: ${{ secrets.DESKTOP_OAUTH_CLIENT_ID }}
-          DESKTOP_OAUTH_CLIENT_SECRET:
-            ${{ secrets.DESKTOP_OAUTH_CLIENT_SECRET }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          APPLE_APPLICATION_CERT: ${{ secrets.APPLE_APPLICATION_CERT }}
-          KEY_PASSWORD: ${{ secrets.APPLE_APPLICATION_CERT_PASSWORD }}
           npm_config_arch: ${{ matrix.arch }}
           TARGET_ARCH: ${{ matrix.arch }}
       - name: Prepare testing environment
@@ -123,31 +96,20 @@ jobs:
       - name: Run script tests
         if: matrix.arch == 'x64'
         run: yarn test:script
-      - name: Install Azure Code Signing Client
-        if: ${{ runner.os == 'Windows' && inputs.sign }}
-        run: |
-          $acsZip = Join-Path $env:RUNNER_TEMP "acs.zip"
-          $acsDir = Join-Path $env:RUNNER_TEMP "acs"
-          Invoke-WebRequest -Uri https://www.nuget.org/api/v2/package/Microsoft.Trusted.Signing.Client/1.0.52 -OutFile $acsZip -Verbose
-          Expand-Archive $acsZip -Destination $acsDir -Force -Verbose
-          # Replace ancient signtool in electron-winstall with one that supports ACS
-          Copy-Item -Path "C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64\*" -Include signtool.exe,signtool.exe.manifest,Microsoft.Windows.Build.Signing.mssign32.dll.manifest,mssign32.dll,Microsoft.Windows.Build.Signing.wintrust.dll.manifest,wintrust.dll,Microsoft.Windows.Build.Appx.AppxSip.dll.manifest,AppxSip.dll,Microsoft.Windows.Build.Appx.AppxPackaging.dll.manifest,AppxPackaging.dll,Microsoft.Windows.Build.Appx.OpcServices.dll.manifest,OpcServices.dll -Destination "node_modules\electron-winstaller\vendor" -Verbose
-      - name: Package production app
-        run: yarn package
-        env:
-          npm_config_arch: ${{ matrix.arch }}
-          AZURE_TENANT_ID: ${{ secrets.AZURE_CODE_SIGNING_TENANT_ID }}
-          AZURE_CLIENT_ID: ${{ secrets.AZURE_CODE_SIGNING_CLIENT_ID }}
-          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CODE_SIGNING_CLIENT_SECRET }}
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v4
-        if: ${{ inputs.upload-artifacts }}
+      - name: Package application
+        run: yarn run package
+        if: ${{ matrix.os == 'ubuntu-20.04' && matrix.arch == 'x64' }}
+      - name: Create Release
+        uses: softprops/action-gh-release@v1
+        if:
+          ${{ matrix.os == 'ubuntu-20.04' && startsWith(github.ref,
+          'refs/tags/') }}
         with:
-          name: ${{matrix.friendlyName}}-${{matrix.arch}}
-          path: |
-            dist/GitHub Desktop-${{matrix.arch}}.zip
-            dist/GitHubDesktop-*.nupkg
-            dist/GitHubDesktopSetup-${{matrix.arch}}.exe
-            dist/GitHubDesktopSetup-${{matrix.arch}}.msi
-            dist/bundle-size.json
-          if-no-files-found: error
+          files: |
+            dist/*.AppImage
+            dist/*.deb
+            dist/*.rpm
+            dist/*.txt
+          draft: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}