| ... | @@ -2,25 +2,38 @@ name: Desktop macOS Preview | ... | @@ -2,25 +2,38 @@ name: Desktop macOS Preview |
| 2 | | 2 | |
| 3 | on: | 3 | on: |
| 4 | pull_request: | 4 | pull_request: |
| 5 | types: [labeled, synchronize, reopened] | 5 | types: [labeled, unlabeled, synchronize, reopened, closed] |
| 6 | | 6 | |
| 7 | permissions: | 7 | permissions: |
| 8 | contents: read | 8 | contents: read |
| 9 | pull-requests: write | | |
| 10 | | 9 | |
| | 10 | # Build events and cleanup events use separate groups: a push must cancel a |
| | 11 | # stale in-flight build, but must never cancel a cleanup run mid-delete. The |
| | 12 | # publish job re-checks PR state before uploading to cover the reverse race. |
| 11 | concurrency: | 13 | concurrency: |
| 12 | group: desktop-macos-preview-${{ github.event.pull_request.number }} | 14 | group: desktop-macos-preview-${{ github.event.pull_request.number }}-${{ contains(fromJSON('["closed", "unlabeled"]'), github.event.action) && 'cleanup' || 'build' }} |
| 13 | cancel-in-progress: true | 15 | # Cleanup runs must complete (a close event right after an unlabel queues |
| | 16 | # behind the running cleanup instead of canceling it mid-delete), and events |
| | 17 | # that skip the build job, such as adding an unrelated label, must not |
| | 18 | # cancel an in-flight build either. |
| | 19 | cancel-in-progress: ${{ !contains(fromJSON('["closed", "unlabeled"]'), github.event.action) && (github.event.action != 'labeled' || github.event.label.name == 'preview:mac') }} |
| 14 | | 20 | |
| 15 | jobs: | 21 | jobs: |
| | 22 | # Builds run PR code, so this job keeps a read-only token. Publishing to the |
| | 23 | # release happens in the publish job below, which never checks out PR code. |
| 16 | build: | 24 | build: |
| 17 | name: Build macOS Apple Silicon preview | 25 | name: Build macOS Apple Silicon preview |
| 18 | if: >- | 26 | if: >- |
| | 27 | github.event.action != 'closed' && |
| | 28 | github.event.action != 'unlabeled' && |
| 19 | github.event.pull_request.head.repo.full_name == github.repository && | 29 | github.event.pull_request.head.repo.full_name == github.repository && |
| 20 | contains(github.event.pull_request.labels.*.name, 'preview:mac') && | 30 | contains(github.event.pull_request.labels.*.name, 'preview:mac') && |
| 21 | (github.event.action != 'labeled' || github.event.label.name == 'preview:mac') | 31 | (github.event.action != 'labeled' || github.event.label.name == 'preview:mac') |
| 22 | runs-on: blacksmith-12vcpu-macos-26 | 32 | runs-on: blacksmith-12vcpu-macos-26 |
| 23 | timeout-minutes: 30 | 33 | timeout-minutes: 30 |
| | 34 | outputs: |
| | 35 | dmg_name: ${{ steps.build.outputs.dmg_name }} |
| | 36 | version: ${{ steps.version.outputs.version }} |
| 24 | steps: | 37 | steps: |
| 25 | - name: Checkout | 38 | - name: Checkout |
| 26 | uses: actions/checkout@v6 | 39 | uses: actions/checkout@v6 |
| ... | @@ -93,8 +106,9 @@ jobs: | ... | @@ -93,8 +106,9 @@ jobs: |
| 93 | fi | 106 | fi |
| 94 | printf 'dmg_name=%s\n' "$(basename "${dmg_files[0]}")" >> "$GITHUB_OUTPUT" | 107 | printf 'dmg_name=%s\n' "$(basename "${dmg_files[0]}")" >> "$GITHUB_OUTPUT" |
| 95 | | 108 | |
| 96 | - id: upload | 109 | # archive: false uploads the file as its own artifact named after the |
| 97 | name: Upload macOS DMG | 110 | # file, so the publish job downloads by *.dmg pattern, not by name. |
| | 111 | - name: Upload macOS DMG |
| 98 | uses: actions/upload-artifact@v7 | 112 | uses: actions/upload-artifact@v7 |
| 99 | with: | 113 | with: |
| 100 | path: release/*.dmg | 114 | path: release/*.dmg |
| ... | @@ -103,13 +117,112 @@ jobs: | ... | @@ -103,13 +117,112 @@ jobs: |
| 103 | overwrite: true | 117 | overwrite: true |
| 104 | retention-days: 7 | 118 | retention-days: 7 |
| 105 | | 119 | |
| | 120 | # Release assets download without a GitHub account, unlike workflow |
| | 121 | # artifacts. All preview DMGs live on one rolling prerelease tagged |
| | 122 | # "desktop-preview" (release.yml only matches v*.*.* tags), so publishing a |
| | 123 | # build never notifies release watchers. This job holds the write token and |
| | 124 | # only handles the artifact the build job produced; it never runs PR code. |
| | 125 | publish: |
| | 126 | name: Publish anonymous download |
| | 127 | needs: build |
| | 128 | runs-on: blacksmith-8vcpu-ubuntu-2404 |
| | 129 | timeout-minutes: 10 |
| | 130 | permissions: |
| | 131 | contents: write |
| | 132 | pull-requests: write |
| | 133 | steps: |
| | 134 | - name: Download macOS DMG |
| | 135 | uses: actions/download-artifact@v8 |
| | 136 | with: |
| | 137 | pattern: "*.dmg" |
| | 138 | merge-multiple: true |
| | 139 | path: release |
| | 140 | |
| | 141 | - id: upload |
| | 142 | name: Upload DMG to the rolling preview release |
| | 143 | shell: bash |
| | 144 | env: |
| | 145 | GH_TOKEN: ${{ github.token }} |
| | 146 | PR_NUMBER: ${{ github.event.pull_request.number }} |
| | 147 | DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} |
| | 148 | run: | |
| | 149 | set -euo pipefail |
| | 150 | |
| | 151 | tag="desktop-preview" |
| | 152 | |
| | 153 | # True while the PR is open and still carries the preview label. |
| | 154 | preview_eligible() { |
| | 155 | [[ "$(gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" \ |
| | 156 | --json state,labels \ |
| | 157 | --jq '.state + " " + (.labels | map(.name) | contains(["preview:mac"]) | tostring)')" == "OPEN true" ]] |
| | 158 | } |
| | 159 | |
| | 160 | # The build ran for many minutes. If the PR closed or lost the label |
| | 161 | # meanwhile, cleanup already ran in its own concurrency group, so |
| | 162 | # publishing now would resurrect a deleted download. |
| | 163 | if ! preview_eligible; then |
| | 164 | echo "PR closed or preview label removed while building. Skipping publish." |
| | 165 | exit 0 |
| | 166 | fi |
| | 167 | |
| | 168 | dmg_path="$(find release -type f -name '*.dmg' -print -quit)" |
| | 169 | if [[ -z "$dmg_path" ]]; then |
| | 170 | echo "No DMG found in the downloaded artifact." >&2 |
| | 171 | exit 1 |
| | 172 | fi |
| | 173 | |
| | 174 | # The filename comes out of the build, which runs PR code. Requiring |
| | 175 | # this PR's marker keeps a build from clobbering or deleting another |
| | 176 | # PR's asset, since those names carry a different -pr.N. marker. |
| | 177 | if [[ "$(basename "$dmg_path")" != *"-pr.${PR_NUMBER}."* ]]; then |
| | 178 | echo "DMG name '$(basename "$dmg_path")' does not carry this PR's -pr.${PR_NUMBER}. marker. Refusing to publish." >&2 |
| | 179 | exit 1 |
| | 180 | fi |
| | 181 | |
| | 182 | if ! gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then |
| | 183 | # "|| true" tolerates a concurrent publish job creating the |
| | 184 | # release between the check and the create. |
| | 185 | gh release create "$tag" \ |
| | 186 | --repo "$GITHUB_REPOSITORY" \ |
| | 187 | --target "$DEFAULT_BRANCH" \ |
| | 188 | --prerelease \ |
| | 189 | --title "Desktop preview builds" \ |
| | 190 | --notes "Rolling unsigned desktop builds from pull requests with a preview label. Each download is removed when its pull request closes or loses the label. Install stable builds from the latest release instead." \ |
| | 191 | || true |
| | 192 | fi |
| | 193 | |
| | 194 | # Keep one DMG per PR: drop this PR's older builds first. The |
| | 195 | # trailing dot keeps -pr.12. from matching -pr.123. builds. |
| | 196 | gh release view "$tag" --repo "$GITHUB_REPOSITORY" --json assets --jq '.assets[].name' \ |
| | 197 | | { grep -F -- "-pr.${PR_NUMBER}." || true; } \ |
| | 198 | | while read -r asset; do |
| | 199 | gh release delete-asset "$tag" "$asset" --repo "$GITHUB_REPOSITORY" --yes \ |
| | 200 | || echo "Asset $asset was already removed by a concurrent run." |
| | 201 | done |
| | 202 | |
| | 203 | gh release upload "$tag" "$dmg_path" --repo "$GITHUB_REPOSITORY" --clobber |
| | 204 | |
| | 205 | # Re-check after uploading. A cleanup run that started during the |
| | 206 | # upload listed assets before ours existed, so it cannot delete it. |
| | 207 | # Whichever writer acts last sees the final PR state; if the preview |
| | 208 | # became ineligible, delete what we just uploaded. |
| | 209 | if ! preview_eligible; then |
| | 210 | gh release delete-asset "$tag" "$(basename "$dmg_path")" --repo "$GITHUB_REPOSITORY" --yes \ |
| | 211 | || echo "Asset was already removed by a concurrent run." |
| | 212 | echo "PR closed or preview label removed during upload. Removed the download." |
| | 213 | exit 0 |
| | 214 | fi |
| | 215 | |
| | 216 | echo "download_url=https://github.com/${GITHUB_REPOSITORY}/releases/download/${tag}/$(basename "$dmg_path")" >> "$GITHUB_OUTPUT" |
| | 217 | |
| 106 | - name: Comment download link | 218 | - name: Comment download link |
| | 219 | if: steps.upload.outputs.download_url != '' |
| 107 | uses: actions/github-script@v8 | 220 | uses: actions/github-script@v8 |
| 108 | env: | 221 | env: |
| 109 | ARTIFACT_URL: ${{ steps.upload.outputs.artifact-url }} | 222 | DOWNLOAD_URL: ${{ steps.upload.outputs.download_url }} |
| 110 | DMG_NAME: ${{ steps.build.outputs.dmg_name }} | 223 | DMG_NAME: ${{ needs.build.outputs.dmg_name }} |
| 111 | HEAD_SHA: ${{ github.event.pull_request.head.sha }} | 224 | HEAD_SHA: ${{ github.event.pull_request.head.sha }} |
| 112 | PREVIEW_VERSION: ${{ steps.version.outputs.version }} | 225 | PREVIEW_VERSION: ${{ needs.build.outputs.version }} |
| 113 | with: | 226 | with: |
| 114 | script: | | 227 | script: | |
| 115 | const { data: pullRequest } = await github.rest.pulls.get({ | 228 | const { data: pullRequest } = await github.rest.pulls.get({ |
| ... | @@ -117,7 +230,11 @@ jobs: | ... | @@ -117,7 +230,11 @@ jobs: |
| 117 | repo: context.repo.repo, | 230 | repo: context.repo.repo, |
| 118 | pull_number: context.payload.pull_request.number, | 231 | pull_number: context.payload.pull_request.number, |
| 119 | }); | 232 | }); |
| 120 | if (pullRequest.head.sha !== process.env.HEAD_SHA) { | 233 | if ( |
| | 234 | pullRequest.head.sha !== process.env.HEAD_SHA || |
| | 235 | pullRequest.state !== "open" || |
| | 236 | !pullRequest.labels.some((label) => label.name === "preview:mac") |
| | 237 | ) { |
| 121 | core.info("Skipping the outdated macOS preview comment."); | 238 | core.info("Skipping the outdated macOS preview comment."); |
| 122 | return; | 239 | return; |
| 123 | } | 240 | } |
| ... | @@ -127,7 +244,7 @@ jobs: | ... | @@ -127,7 +244,7 @@ jobs: |
| 127 | marker, | 244 | marker, |
| 128 | "### macOS preview", | 245 | "### macOS preview", |
| 129 | "", | 246 | "", |
| 130 | `[Download Apple Silicon DMG](${process.env.ARTIFACT_URL})`, | 247 | `[Download Apple Silicon DMG](${process.env.DOWNLOAD_URL})`, |
| 131 | "", | 248 | "", |
| 132 | `Version: ${process.env.PREVIEW_VERSION}`, | 249 | `Version: ${process.env.PREVIEW_VERSION}`, |
| 133 | `Commit: ${process.env.HEAD_SHA.slice(0, 7)}`, | 250 | `Commit: ${process.env.HEAD_SHA.slice(0, 7)}`, |
| ... | @@ -137,10 +254,10 @@ jobs: | ... | @@ -137,10 +254,10 @@ jobs: |
| 137 | `xattr -d com.apple.quarantine ~/Downloads/${process.env.DMG_NAME}`, | 254 | `xattr -d com.apple.quarantine ~/Downloads/${process.env.DMG_NAME}`, |
| 138 | "```", | 255 | "```", |
| 139 | "", | 256 | "", |
| 140 | "The download requires GitHub access and expires after 7 days.", | 257 | "No GitHub sign-in is needed. The download stays available until this PR closes or the preview label is removed.", |
| 141 | ].join("\n"); | 258 | ].join("\n"); |
| 142 | | 259 | |
| 143 | const { data: comments } = await github.rest.issues.listComments({ | 260 | const comments = await github.paginate(github.rest.issues.listComments, { |
| 144 | owner: context.repo.owner, | 261 | owner: context.repo.owner, |
| 145 | repo: context.repo.repo, | 262 | repo: context.repo.repo, |
| 146 | issue_number: context.payload.pull_request.number, | 263 | issue_number: context.payload.pull_request.number, |
| ... | @@ -163,3 +280,82 @@ jobs: | ... | @@ -163,3 +280,82 @@ jobs: |
| 163 | body, | 280 | body, |
| 164 | }); | 281 | }); |
| 165 | } | 282 | } |
| | 283 | |
| | 284 | # The way out: closing the PR or removing the label deletes its DMG from the |
| | 285 | # rolling release and updates the PR comment to say so. |
| | 286 | cleanup: |
| | 287 | name: Remove preview download |
| | 288 | if: >- |
| | 289 | github.event.pull_request.head.repo.full_name == github.repository && |
| | 290 | ((github.event.action == 'closed' && contains(github.event.pull_request.labels.*.name, 'preview:mac')) || |
| | 291 | (github.event.action == 'unlabeled' && github.event.label.name == 'preview:mac')) |
| | 292 | runs-on: blacksmith-8vcpu-ubuntu-2404 |
| | 293 | timeout-minutes: 10 |
| | 294 | permissions: |
| | 295 | contents: write |
| | 296 | pull-requests: write |
| | 297 | steps: |
| | 298 | - id: delete |
| | 299 | name: Delete this PR's preview assets |
| | 300 | shell: bash |
| | 301 | env: |
| | 302 | GH_TOKEN: ${{ github.token }} |
| | 303 | PR_NUMBER: ${{ github.event.pull_request.number }} |
| | 304 | run: | |
| | 305 | set -euo pipefail |
| | 306 | |
| | 307 | tag="desktop-preview" |
| | 308 | |
| | 309 | # A stale cleanup must not delete a download that became valid |
| | 310 | # again. If the PR is open and labeled once more, the next publish |
| | 311 | # owns this PR's assets and replaces them itself. |
| | 312 | if [[ "$(gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" \ |
| | 313 | --json state,labels \ |
| | 314 | --jq '.state + " " + (.labels | map(.name) | contains(["preview:mac"]) | tostring)')" == "OPEN true" ]]; then |
| | 315 | echo "PR is open and labeled again. Skipping cleanup." |
| | 316 | echo "removed=false" >> "$GITHUB_OUTPUT" |
| | 317 | exit 0 |
| | 318 | fi |
| | 319 | |
| | 320 | echo "removed=true" >> "$GITHUB_OUTPUT" |
| | 321 | |
| | 322 | if ! gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then |
| | 323 | echo "No preview release exists. Nothing to clean up." |
| | 324 | exit 0 |
| | 325 | fi |
| | 326 | |
| | 327 | gh release view "$tag" --repo "$GITHUB_REPOSITORY" --json assets --jq '.assets[].name' \ |
| | 328 | | { grep -F -- "-pr.${PR_NUMBER}." || true; } \ |
| | 329 | | while read -r asset; do |
| | 330 | gh release delete-asset "$tag" "$asset" --repo "$GITHUB_REPOSITORY" --yes \ |
| | 331 | || echo "Asset $asset was already removed by a concurrent run." |
| | 332 | done |
| | 333 | |
| | 334 | - name: Mark the preview comment as removed |
| | 335 | if: steps.delete.outputs.removed == 'true' |
| | 336 | uses: actions/github-script@v8 |
| | 337 | with: |
| | 338 | script: | |
| | 339 | const marker = "<!-- desktop-macos-preview -->"; |
| | 340 | const comments = await github.paginate(github.rest.issues.listComments, { |
| | 341 | owner: context.repo.owner, |
| | 342 | repo: context.repo.repo, |
| | 343 | issue_number: context.payload.pull_request.number, |
| | 344 | per_page: 100, |
| | 345 | }); |
| | 346 | const existing = comments.find((comment) => comment.body?.includes(marker)); |
| | 347 | if (!existing) { |
| | 348 | return; |
| | 349 | } |
| | 350 | |
| | 351 | await github.rest.issues.updateComment({ |
| | 352 | owner: context.repo.owner, |
| | 353 | repo: context.repo.repo, |
| | 354 | comment_id: existing.id, |
| | 355 | body: [ |
| | 356 | marker, |
| | 357 | "### macOS preview", |
| | 358 | "", |
| | 359 | "The preview download was removed because this PR closed or the preview label was removed.", |
| | 360 | ].join("\n"), |
| | 361 | }); |
Theo Browne <me@t3.gg> 2026-08-26 18:35:18-07:00
GitHub <noreply@github.com> 2026-08-26 18:35:18-07:00