zhouchengcheng/ctms
1
1
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

build(desktop): allow controlled unsigned v0.1.0 release
Client Quality Gates / Shared client and Web (push) Has been cancelled
Details
Client Quality Gates / macOS Desktop (push) Has been cancelled
Details
Storage Persistence Guard / storage-persistence-audit (push) Has been cancelled
Details
Client Quality Gates / Shared client and Web (pull_request) Has been cancelled
Details
Client Quality Gates / macOS Desktop (pull_request) Has been cancelled
Details
Storage Persistence Guard / storage-persistence-audit (pull_request) Has been cancelled
Details

Browse Source
This commit is contained in:
Cheng Zhou
2026-07-17 10:52:20 +08:00
parent fa26c84bd2
commit c23a5d6a22
16 changed files with 647 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/scripts/verify-desktop-release.mjs
+34 -1
View File
@@ -62,7 +62,7 @@ const verifyTauriConfig = async () => {
assert(targetList.includes("dmg"), "Tauri bundle targets must include dmg for macOS distribution.");
assert(
tauriConfig.bundle?.createUpdaterArtifacts === true,
"Tauri must create updater artifacts for signed desktop release builds.",
"Tauri must create signed updater artifacts for formal desktop release builds.",
);
assert(
typeof tauriConfig.plugins?.updater?.pubkey === "string" && tauriConfig.plugins.updater.pubkey.length > 80,
@@ -392,7 +392,10 @@ const verifyWorkflowGates = async () => {
assert(packageInfo.engines?.node === ">=22.13.0", "package.json must require Node.js >=22.13.0.");
const requiredScripts = [
"desktop:build:macos-release",
"desktop:build:macos-unsigned-release",
"desktop:build:windows-release",
"desktop:release-policy:check",
"desktop:release-provenance:create",
"desktop:update-feed:create",
"desktop:update-feed:check",
"desktop:release-readiness:check",
@@ -403,6 +406,26 @@ const verifyWorkflowGates = async () => {
assert(Boolean(packageInfo.scripts?.[script]), `package.json must define ${script}.`);
}
const releasePolicy = await readJson(resolve(frontendDir, "desktop-release-policy.json"));
assert(releasePolicy.schemaVersion === 1, "Desktop release policy schemaVersion must be 1.");
assert(
releasePolicy.defaultPlatformSigningMode === "signed",
"Desktop release policy must default future versions to signed platform releases.",
);
assert(releasePolicy.updaterSigningRequired === true, "Desktop release policy must require updater signing.");
const currentUnsignedException = releasePolicy.unsignedPlatformExceptions?.find(
(exception) => exception.version === packageInfo.version,
);
if (packageInfo.version === "0.1.0") {
assert(Boolean(currentUnsignedException), "Desktop release policy must record the approved v0.1.0 exception.");
}
if (currentUnsignedException) {
assert(
currentUnsignedException.macos === "ad-hoc" && currentUnsignedException.windows === "unsigned",
`The v${packageInfo.version} exception must use macOS ad-hoc and unsigned Windows modes.`,
);
}
const workflow = await readFile(resolve(rootDir, ".github/workflows/client-quality-gates.yml"), "utf8");
const requiredCommands = [
"npm run version:check",
@@ -429,6 +452,16 @@ const verifyWorkflowGates = async () => {
"runs-on: windows-latest",
"REQUIRE_DESKTOP_SIGNING",
"REQUIRE_WINDOWS_SIGNING",
"REQUIRE_UPDATER_SIGNING",
"ALLOW_UNSIGNED_PLATFORM_RELEASE",
"DESKTOP_PLATFORM_SIGNING_MODE",
"desktop:release-policy:check",
"desktop:build:macos-unsigned-release",
"Signature=adhoc",
'"NotSigned"',
"UNSIGNED-PLATFORM",
"DESKTOP-RELEASE-PROVENANCE.json",
"--require-provenance",
"TAURI_SIGNING_PRIVATE_KEY",
"APPLE_ID",
"APPLE_PASSWORD",