fadf48f562
Consolidates eight of the ten open dependabot PRs into a single review surface. Two are intentionally left out because they bundle breaking-change deps that need source migration outside the scope of a combine PR; dependabot recreates them on the next weekly tick: - #5364 (cargo-tauri group, 13 updates) bumps hmac 0.12 -> 0.13 which removes Hmac::new_from_slice from the inherent impl, so studio/src-tauri/src/native_backend_lease.rs:152 fails to compile (error E0599). Also bumps sha2 0.10 -> 0.11 and reqwest 0.12 -> 0.13 which have their own migration surfaces. Needs a focused PR after the source migration. - #5365 (bun-frontend group, 14 updates) bumps TypeScript 5.9 -> 6.0 promoting the baseUrl deprecation to a hard tsc error, plus @assistant-ui/react 0.12 -> 0.14 renaming the unstable_* exports, react-day-picker 9 -> 10 dropping the table classname, and recharts 3.7 -> 3.8.1 tightening the Key prop type. Same shape: needs a focused frontend migration PR. The remaining eight land cleanly: - #4916 oxc-parser 0.123.0 -> 0.129.0 in /studio/backend/core/ data_recipe/oxc-validator (npm-oxc-validator group) - #5343 hono 4.12.17 -> 4.12.18 and ip-address 10.1.0 -> 10.2.0 in /studio/frontend (security advisory: GHSA-p77w-8qqv-26rm, GHSA-qp7p-654g-cw7p, GHSA-hm8q-7f3q-5f36) - #5362 python group (3 updates) in pyproject.toml - #5363 actions group (3 updates) in release-desktop / security-audit / studio-tauri-smoke workflows - #5366 openssl 0.10.76 -> 0.10.79 (security) - #5367 rand 0.10.0 -> 0.10.1 (security) - #5368 tauri 2.10.3 -> 2.11.1 (security; transitive bumps for tray-icon and wry come along) - #5369 rustls-webpki 0.103.10 -> 0.103.13 (security) studio/src-tauri/Cargo.toml stays at main's values (hmac 0.12, sha2 0.10, reqwest 0.12, rand 0.10.0, windows-sys 0.59); Cargo.lock is regenerated by running cargo update -p <pkg> --precise <ver> for each of the four security advisories on top of main, so only the four pinned packages move and the rest of the dep graph stays identical to main. Validated locally: cargo check passes through the Rust source; the only error is the build-time frontendDist check unrelated to source.
226 lines
9.5 KiB
YAML
226 lines
9.5 KiB
YAML
name: Release Desktop App
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
draft:
|
|
description: 'Create as draft release'
|
|
type: boolean
|
|
default: true
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
build:
|
|
strategy:
|
|
fail-fast: false
|
|
max-parallel: 1
|
|
matrix:
|
|
include:
|
|
- platform: macos-latest
|
|
args: '--target aarch64-apple-darwin'
|
|
label: macOS (Apple Silicon)
|
|
# - platform: macos-latest
|
|
# args: '--target x86_64-apple-darwin'
|
|
# label: macOS (Intel)
|
|
- platform: ubuntu-22.04
|
|
args: ''
|
|
label: Linux (x64)
|
|
- platform: windows-latest
|
|
args: ''
|
|
label: Windows (x64)
|
|
|
|
name: Build ${{ matrix.label }}
|
|
runs-on: ${{ matrix.platform }}
|
|
|
|
env:
|
|
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
|
|
|
|
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
|
|
|
|
# ── Linux dependencies ──
|
|
- name: Install Linux dependencies
|
|
if: matrix.platform == 'ubuntu-22.04'
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev libxdo-dev libssl-dev patchelf
|
|
|
|
# ── Node.js ──
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
|
|
with:
|
|
node-version: 24
|
|
|
|
- name: Install pinned Tauri CLI
|
|
run: npm install --save-dev --prefix studio @tauri-apps/cli@2.10.1
|
|
|
|
- name: Verify pinned Tauri CLI
|
|
shell: bash
|
|
run: |
|
|
out="$(npx --prefix studio tauri --version)"
|
|
echo "$out"
|
|
if [ "$out" != "tauri-cli 2.10.1" ]; then
|
|
echo "Expected tauri-cli 2.10.1, got $out" >&2
|
|
exit 1
|
|
fi
|
|
|
|
- name: Install frontend dependencies
|
|
working-directory: studio/frontend
|
|
run: npm install
|
|
|
|
- name: Verify backend package is published
|
|
shell: bash
|
|
run: |
|
|
node <<'JS'
|
|
const { readFileSync } = require('node:fs');
|
|
|
|
(async () => {
|
|
const cargo = readFileSync('studio/src-tauri/Cargo.toml', 'utf8');
|
|
const match = cargo.match(/^version\s*=\s*"([^"]+)"/m);
|
|
if (!match) throw new Error('Could not read desktop app version');
|
|
|
|
const appVersion = match[1];
|
|
const response = await fetch(`https://pypi.org/pypi/unsloth/${appVersion}/json`);
|
|
if (!response.ok) {
|
|
const message = 'Publish unsloth=={app_version} to PyPI before the desktop release';
|
|
throw new Error(`${message.replace('{app_version}', appVersion)} (HTTP ${response.status})`);
|
|
}
|
|
})();
|
|
JS
|
|
|
|
# ── Rust ──
|
|
- name: Install Rust stable
|
|
uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
|
|
|
|
- name: Rust cache
|
|
uses: swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
|
|
with:
|
|
workspaces: 'studio/src-tauri -> target'
|
|
|
|
# ── macOS: import signing certificate ──
|
|
- name: Import Apple certificate
|
|
if: matrix.platform == 'macos-latest'
|
|
env:
|
|
APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
|
|
APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
|
|
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
|
|
run: |
|
|
echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
|
|
security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
|
|
security default-keychain -s build.keychain
|
|
security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
|
|
security set-keychain-settings -t 3600 -u build.keychain
|
|
security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
|
|
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
|
|
security find-identity -v -p codesigning build.keychain
|
|
rm -f certificate.p12
|
|
|
|
# ── Windows: install Azure Trusted Signing CLI ──
|
|
- name: Install trusted-signing-cli
|
|
if: matrix.platform == 'windows-latest'
|
|
run: |
|
|
cargo install trusted-signing-cli --version 0.9.0 --locked
|
|
echo "$env:USERPROFILE\.cargo\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
|
|
|
|
# ── Windows: verify signing CLI is accessible ──
|
|
- name: Verify trusted-signing-cli
|
|
if: matrix.platform == 'windows-latest'
|
|
run: |
|
|
Write-Output "PATH: $env:PATH"
|
|
Get-Command trusted-signing-cli -ErrorAction SilentlyContinue || Write-Output "trusted-signing-cli NOT in PATH"
|
|
trusted-signing-cli --version || Write-Output "trusted-signing-cli failed to run"
|
|
|
|
# ── Linux: build + sign + upload ──
|
|
- name: Build Linux app
|
|
if: matrix.platform == 'ubuntu-22.04'
|
|
uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
|
|
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
|
|
with:
|
|
projectPath: studio
|
|
tauriScript: npx --prefix . tauri
|
|
tagName: desktop-v__VERSION__
|
|
releaseName: 'Unsloth Studio (Desktop) v__VERSION__'
|
|
releaseBody: |
|
|
Desktop app for Unsloth Studio.
|
|
|
|
**macOS**: Download the Apple Silicon `.dmg`.
|
|
**Windows**: Download the `-setup.exe` installer.
|
|
**Linux**: Download `.deb` (Ubuntu/Debian) or `.AppImage` (universal).
|
|
|
|
> Linux in-app updates are AppImage-oriented. Package installs should update by downloading a new package.
|
|
> Linux AppImage on Ubuntu 24.04+ may require: `sudo apt install libfuse2t64`
|
|
> First-run system dependency elevation is supported on Ubuntu/Debian. Other Linux distributions should install system packages manually.
|
|
releaseDraft: ${{ inputs.draft }}
|
|
prerelease: false
|
|
args: -v ${{ matrix.args }}
|
|
|
|
# ── macOS: build + sign + notarize + upload ──
|
|
- name: Build macOS app
|
|
if: matrix.platform == 'macos-latest'
|
|
uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
|
|
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
|
|
APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
|
|
APPLE_ID: ${{ secrets.APPLE_ID }}
|
|
APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
|
|
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
with:
|
|
projectPath: studio
|
|
tauriScript: npx --prefix . tauri
|
|
tagName: desktop-v__VERSION__
|
|
releaseName: 'Unsloth Studio (Desktop) v__VERSION__'
|
|
releaseBody: |
|
|
Desktop app for Unsloth Studio.
|
|
|
|
**macOS**: Download the Apple Silicon `.dmg`.
|
|
**Windows**: Download the `-setup.exe` installer.
|
|
**Linux**: Download `.deb` (Ubuntu/Debian) or `.AppImage` (universal).
|
|
|
|
> Linux in-app updates are AppImage-oriented. Package installs should update by downloading a new package.
|
|
> Linux AppImage on Ubuntu 24.04+ may require: `sudo apt install libfuse2t64`
|
|
> First-run system dependency elevation is supported on Ubuntu/Debian. Other Linux distributions should install system packages manually.
|
|
releaseDraft: ${{ inputs.draft }}
|
|
prerelease: false
|
|
args: -v ${{ matrix.args }}
|
|
|
|
# ── Windows: build + sign + upload ──
|
|
- name: Build Windows app
|
|
if: matrix.platform == 'windows-latest'
|
|
uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
|
|
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
|
|
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
|
|
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
|
|
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
|
|
AZURE_TRUSTED_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
|
|
AZURE_CERTIFICATE_PROFILE_NAME: ${{ secrets.AZURE_CERTIFICATE_PROFILE_NAME }}
|
|
with:
|
|
projectPath: studio
|
|
tauriScript: npx --prefix . tauri
|
|
tagName: desktop-v__VERSION__
|
|
releaseName: 'Unsloth Studio (Desktop) v__VERSION__'
|
|
releaseBody: |
|
|
Desktop app for Unsloth Studio.
|
|
|
|
**macOS**: Download the Apple Silicon `.dmg`.
|
|
**Windows**: Download the `-setup.exe` installer.
|
|
**Linux**: Download `.deb` (Ubuntu/Debian) or `.AppImage` (universal).
|
|
|
|
> Linux in-app updates are AppImage-oriented. Package installs should update by downloading a new package.
|
|
> Linux AppImage on Ubuntu 24.04+ may require: `sudo apt install libfuse2t64`
|
|
> First-run system dependency elevation is supported on Ubuntu/Debian. Other Linux distributions should install system packages manually.
|
|
releaseDraft: ${{ inputs.draft }}
|
|
prerelease: false
|
|
args: -v ${{ matrix.args }}
|