authorgravatar for me@t3.ggTheo Browne <me@t3.gg> 2026-08-26 18:35:18-07:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2026-08-26 18:35:18-07:00
log33b650a5b3b27382b35d2182dec6b22438c3da56
tree03e9e1ad46238214f33fb636947ebb85f8079e4e
parenta3a8cbd60539b4af4de8f96c892dbd07a2b6c041
signature Signed by PGP key B5690EEEBB952194

feat(ci): download macOS preview DMGs without signing in (#8243)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

1 files changed, 209 insertions(+), 13 deletions(-)

.github/workflows/desktop-macos-preview.yml+209-13
......@@ -2,25 +2,38 @@ name: Desktop macOS Preview
22
33on:
44 pull_request:
5 types: [labeled, synchronize, reopened]
5 types: [labeled, unlabeled, synchronize, reopened, closed]
66
77permissions:
88 contents: read
9 pull-requests: write
109
10# Build events and cleanup events use separate groups: a push must cancel a
11# stale in-flight build, but must never cancel a cleanup run mid-delete. The
12# publish job re-checks PR state before uploading to cover the reverse race.
1113concurrency:
12 group: desktop-macos-preview-${{ github.event.pull_request.number }}
13 cancel-in-progress: true
14 group: desktop-macos-preview-${{ github.event.pull_request.number }}-${{ contains(fromJSON('["closed", "unlabeled"]'), github.event.action) && 'cleanup' || 'build' }}
15 # Cleanup runs must complete (a close event right after an unlabel queues
16 # behind the running cleanup instead of canceling it mid-delete), and events
17 # that skip the build job, such as adding an unrelated label, must not
18 # cancel an in-flight build either.
19 cancel-in-progress: ${{ !contains(fromJSON('["closed", "unlabeled"]'), github.event.action) && (github.event.action != 'labeled' || github.event.label.name == 'preview:mac') }}
1420
1521jobs:
22 # Builds run PR code, so this job keeps a read-only token. Publishing to the
23 # release happens in the publish job below, which never checks out PR code.
1624 build:
1725 name: Build macOS Apple Silicon preview
1826 if: >-
27 github.event.action != 'closed' &&
28 github.event.action != 'unlabeled' &&
1929 github.event.pull_request.head.repo.full_name == github.repository &&
2030 contains(github.event.pull_request.labels.*.name, 'preview:mac') &&
2131 (github.event.action != 'labeled' || github.event.label.name == 'preview:mac')
2232 runs-on: blacksmith-12vcpu-macos-26
2333 timeout-minutes: 30
34 outputs:
35 dmg_name: ${{ steps.build.outputs.dmg_name }}
36 version: ${{ steps.version.outputs.version }}
2437 steps:
2538 - name: Checkout
2639 uses: actions/checkout@v6
......@@ -93,8 +106,9 @@ jobs:
93106 fi
94107 printf 'dmg_name=%s\n' "$(basename "${dmg_files[0]}")" >> "$GITHUB_OUTPUT"
95108
96 - id: upload
97 name: Upload macOS DMG
109 # archive: false uploads the file as its own artifact named after the
110 # file, so the publish job downloads by *.dmg pattern, not by name.
111 - name: Upload macOS DMG
98112 uses: actions/upload-artifact@v7
99113 with:
100114 path: release/*.dmg
......@@ -103,13 +117,112 @@ jobs:
103117 overwrite: true
104118 retention-days: 7
105119
120 # Release assets download without a GitHub account, unlike workflow
121 # artifacts. All preview DMGs live on one rolling prerelease tagged
122 # "desktop-preview" (release.yml only matches v*.*.* tags), so publishing a
123 # build never notifies release watchers. This job holds the write token and
124 # only handles the artifact the build job produced; it never runs PR code.
125 publish:
126 name: Publish anonymous download
127 needs: build
128 runs-on: blacksmith-8vcpu-ubuntu-2404
129 timeout-minutes: 10
130 permissions:
131 contents: write
132 pull-requests: write
133 steps:
134 - name: Download macOS DMG
135 uses: actions/download-artifact@v8
136 with:
137 pattern: "*.dmg"
138 merge-multiple: true
139 path: release
140
141 - id: upload
142 name: Upload DMG to the rolling preview release
143 shell: bash
144 env:
145 GH_TOKEN: ${{ github.token }}
146 PR_NUMBER: ${{ github.event.pull_request.number }}
147 DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
148 run: |
149 set -euo pipefail
150
151 tag="desktop-preview"
152
153 # True while the PR is open and still carries the preview label.
154 preview_eligible() {
155 [[ "$(gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" \
156 --json state,labels \
157 --jq '.state + " " + (.labels | map(.name) | contains(["preview:mac"]) | tostring)')" == "OPEN true" ]]
158 }
159
160 # The build ran for many minutes. If the PR closed or lost the label
161 # meanwhile, cleanup already ran in its own concurrency group, so
162 # publishing now would resurrect a deleted download.
163 if ! preview_eligible; then
164 echo "PR closed or preview label removed while building. Skipping publish."
165 exit 0
166 fi
167
168 dmg_path="$(find release -type f -name '*.dmg' -print -quit)"
169 if [[ -z "$dmg_path" ]]; then
170 echo "No DMG found in the downloaded artifact." >&2
171 exit 1
172 fi
173
174 # The filename comes out of the build, which runs PR code. Requiring
175 # this PR's marker keeps a build from clobbering or deleting another
176 # PR's asset, since those names carry a different -pr.N. marker.
177 if [[ "$(basename "$dmg_path")" != *"-pr.${PR_NUMBER}."* ]]; then
178 echo "DMG name '$(basename "$dmg_path")' does not carry this PR's -pr.${PR_NUMBER}. marker. Refusing to publish." >&2
179 exit 1
180 fi
181
182 if ! gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
183 # "|| true" tolerates a concurrent publish job creating the
184 # release between the check and the create.
185 gh release create "$tag" \
186 --repo "$GITHUB_REPOSITORY" \
187 --target "$DEFAULT_BRANCH" \
188 --prerelease \
189 --title "Desktop preview builds" \
190 --notes "Rolling unsigned desktop builds from pull requests with a preview label. Each download is removed when its pull request closes or loses the label. Install stable builds from the latest release instead." \
191 || true
192 fi
193
194 # Keep one DMG per PR: drop this PR's older builds first. The
195 # trailing dot keeps -pr.12. from matching -pr.123. builds.
196 gh release view "$tag" --repo "$GITHUB_REPOSITORY" --json assets --jq '.assets[].name' \
197 | { grep -F -- "-pr.${PR_NUMBER}." || true; } \
198 | while read -r asset; do
199 gh release delete-asset "$tag" "$asset" --repo "$GITHUB_REPOSITORY" --yes \
200 || echo "Asset $asset was already removed by a concurrent run."
201 done
202
203 gh release upload "$tag" "$dmg_path" --repo "$GITHUB_REPOSITORY" --clobber
204
205 # Re-check after uploading. A cleanup run that started during the
206 # upload listed assets before ours existed, so it cannot delete it.
207 # Whichever writer acts last sees the final PR state; if the preview
208 # became ineligible, delete what we just uploaded.
209 if ! preview_eligible; then
210 gh release delete-asset "$tag" "$(basename "$dmg_path")" --repo "$GITHUB_REPOSITORY" --yes \
211 || echo "Asset was already removed by a concurrent run."
212 echo "PR closed or preview label removed during upload. Removed the download."
213 exit 0
214 fi
215
216 echo "download_url=https://github.com/${GITHUB_REPOSITORY}/releases/download/${tag}/$(basename "$dmg_path")" >> "$GITHUB_OUTPUT"
217
106218 - name: Comment download link
219 if: steps.upload.outputs.download_url != ''
107220 uses: actions/github-script@v8
108221 env:
109 ARTIFACT_URL: ${{ steps.upload.outputs.artifact-url }}
110 DMG_NAME: ${{ steps.build.outputs.dmg_name }}
222 DOWNLOAD_URL: ${{ steps.upload.outputs.download_url }}
223 DMG_NAME: ${{ needs.build.outputs.dmg_name }}
111224 HEAD_SHA: ${{ github.event.pull_request.head.sha }}
112 PREVIEW_VERSION: ${{ steps.version.outputs.version }}
225 PREVIEW_VERSION: ${{ needs.build.outputs.version }}
113226 with:
114227 script: |
115228 const { data: pullRequest } = await github.rest.pulls.get({
......@@ -117,7 +230,11 @@ jobs:
117230 repo: context.repo.repo,
118231 pull_number: context.payload.pull_request.number,
119232 });
120 if (pullRequest.head.sha !== process.env.HEAD_SHA) {
233 if (
234 pullRequest.head.sha !== process.env.HEAD_SHA ||
235 pullRequest.state !== "open" ||
236 !pullRequest.labels.some((label) => label.name === "preview:mac")
237 ) {
121238 core.info("Skipping the outdated macOS preview comment.");
122239 return;
123240 }
......@@ -127,7 +244,7 @@ jobs:
127244 marker,
128245 "### macOS preview",
129246 "",
130 `[Download Apple Silicon DMG](${process.env.ARTIFACT_URL})`,
247 `[Download Apple Silicon DMG](${process.env.DOWNLOAD_URL})`,
131248 "",
132249 `Version: ${process.env.PREVIEW_VERSION}`,
133250 `Commit: ${process.env.HEAD_SHA.slice(0, 7)}`,
......@@ -137,10 +254,10 @@ jobs:
137254 `xattr -d com.apple.quarantine ~/Downloads/${process.env.DMG_NAME}`,
138255 "```",
139256 "",
140 "The download requires GitHub access and expires after 7 days.",
257 "No GitHub sign-in is needed. The download stays available until this PR closes or the preview label is removed.",
141258 ].join("\n");
142259
143 const { data: comments } = await github.rest.issues.listComments({
260 const comments = await github.paginate(github.rest.issues.listComments, {
144261 owner: context.repo.owner,
145262 repo: context.repo.repo,
146263 issue_number: context.payload.pull_request.number,
......@@ -163,3 +280,82 @@ jobs:
163280 body,
164281 });
165282 }
283
284 # The way out: closing the PR or removing the label deletes its DMG from the
285 # rolling release and updates the PR comment to say so.
286 cleanup:
287 name: Remove preview download
288 if: >-
289 github.event.pull_request.head.repo.full_name == github.repository &&
290 ((github.event.action == 'closed' && contains(github.event.pull_request.labels.*.name, 'preview:mac')) ||
291 (github.event.action == 'unlabeled' && github.event.label.name == 'preview:mac'))
292 runs-on: blacksmith-8vcpu-ubuntu-2404
293 timeout-minutes: 10
294 permissions:
295 contents: write
296 pull-requests: write
297 steps:
298 - id: delete
299 name: Delete this PR's preview assets
300 shell: bash
301 env:
302 GH_TOKEN: ${{ github.token }}
303 PR_NUMBER: ${{ github.event.pull_request.number }}
304 run: |
305 set -euo pipefail
306
307 tag="desktop-preview"
308
309 # A stale cleanup must not delete a download that became valid
310 # again. If the PR is open and labeled once more, the next publish
311 # owns this PR's assets and replaces them itself.
312 if [[ "$(gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" \
313 --json state,labels \
314 --jq '.state + " " + (.labels | map(.name) | contains(["preview:mac"]) | tostring)')" == "OPEN true" ]]; then
315 echo "PR is open and labeled again. Skipping cleanup."
316 echo "removed=false" >> "$GITHUB_OUTPUT"
317 exit 0
318 fi
319
320 echo "removed=true" >> "$GITHUB_OUTPUT"
321
322 if ! gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
323 echo "No preview release exists. Nothing to clean up."
324 exit 0
325 fi
326
327 gh release view "$tag" --repo "$GITHUB_REPOSITORY" --json assets --jq '.assets[].name' \
328 | { grep -F -- "-pr.${PR_NUMBER}." || true; } \
329 | while read -r asset; do
330 gh release delete-asset "$tag" "$asset" --repo "$GITHUB_REPOSITORY" --yes \
331 || echo "Asset $asset was already removed by a concurrent run."
332 done
333
334 - name: Mark the preview comment as removed
335 if: steps.delete.outputs.removed == 'true'
336 uses: actions/github-script@v8
337 with:
338 script: |
339 const marker = "<!-- desktop-macos-preview -->";
340 const comments = await github.paginate(github.rest.issues.listComments, {
341 owner: context.repo.owner,
342 repo: context.repo.repo,
343 issue_number: context.payload.pull_request.number,
344 per_page: 100,
345 });
346 const existing = comments.find((comment) => comment.body?.includes(marker));
347 if (!existing) {
348 return;
349 }
350
351 await github.rest.issues.updateComment({
352 owner: context.repo.owner,
353 repo: context.repo.repo,
354 comment_id: existing.id,
355 body: [
356 marker,
357 "### macOS preview",
358 "",
359 "The preview download was removed because this PR closed or the preview label was removed.",
360 ].join("\n"),
361 });