PetschStudios/KanbanGit
3
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases 24 Wiki Activity

KAN-58: macOS Actions release to Hetzner Object Storage #153

Merged
Twyco merged 1 commits from feature/KAN-58-macos-release-pipeline into main 2026-09-27 08:58:31 +00:00
Conversation 0 Commits 1 Files Changed 8
+1245 -43
Twyco commented 2026-09-27 06:57:38 +00:00
Owner
Copy Link
Copy Source

Adds separate native JavaScript checks, macOS Rust/build checks without release secrets, and a macOS release workflow for Hetzner Object Storage. The release uses pinned checkout, pnpm, Node, Rust, Apple-Actions certificate import and Tauri actions; Tauri builds, signs and notarizes the app. Small focused helpers validate the app/package and publish immutable S3 objects.

Releases use protected macos-vMAJOR.MINOR.PATCH tags contained in main; manual runs select an existing tag from the workflow on main. The app, package and Cargo versions must agree. The existing Apple team and bundle identifier are retained. The signing keychain and certificate export are cleaned up after each run.

ZIP and SHA-256 files are uploaded with conditional writes to <prefix>/<target>/<version>/. Byte-identical retries are accepted; different existing content is rejected. Each public download is checked before writing release.json. There is no latest pointer or updater manifest in this ticket. Hetzner requires an unversioned bucket for the conditional writes used here. Existing web/server workflows are unchanged.

Validation: all 98 native JavaScript tests and 8 Rust tests pass; ESLint, Rust formatting, Clippy and workflow YAML/shell checks pass. The unsigned macOS build succeeds. The new packaging helper was also exercised against the actual notarized 0.1.0 app, including extraction, signature, architecture, stapling and Gatekeeper verification.

Pending acceptance: the user is provisioning the macOS runner. Repository secrets and bucket variables must be configured, then an actual Actions/S3 release and installation of its public download must be verified. This PR remains a draft and KAN-58 remains In Progress until that acceptance is complete.

Required secrets: APPLE_CERTIFICATE (base64 .p12 including private key), APPLE_CERTIFICATE_PASSWORD, APPLE_PASSWORD (app-specific), S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY.

Required variables: MACOS_RUNNER, S3_BUCKET, S3_REGION (nbg1, fsn1, hel1). Optional variables: MACOS_CHECK_RUNNER, MACOS_RELEASE_TARGET (defaults to aarch64-apple-darwin), S3_PREFIX (defaults to releases/macos), S3_PUBLIC_BASE_URL (defaults to the public Hetzner bucket URL). Runner prerequisites: full Xcode and AWS CLI v2; the workflow prepares Node, pnpm and Rust. Use a clean isolated runner for PR checks.

The macos-v* tag-protection rule is already configured in Gitea with Twyco permitted to manage those tags. No release tag or external artifact has been published by this change.

Ticket: https://kanbangit.de/projects/1/tickets/58
Depends on PR #152. Original branch base and PR target: feature/KAN-56-signed-macos-release, successfully fast-forward pulled at 2b85517965d8710db04ae54f6eb4c2b7249b1846 before branch creation.

Adds separate native JavaScript checks, macOS Rust/build checks without release secrets, and a macOS release workflow for Hetzner Object Storage. The release uses pinned checkout, pnpm, Node, Rust, Apple-Actions certificate import and Tauri actions; Tauri builds, signs and notarizes the app. Small focused helpers validate the app/package and publish immutable S3 objects. Releases use protected `macos-vMAJOR.MINOR.PATCH` tags contained in `main`; manual runs select an existing tag from the workflow on `main`. The app, package and Cargo versions must agree. The existing Apple team and bundle identifier are retained. The signing keychain and certificate export are cleaned up after each run. ZIP and SHA-256 files are uploaded with conditional writes to `<prefix>/<target>/<version>/`. Byte-identical retries are accepted; different existing content is rejected. Each public download is checked before writing `release.json`. There is no latest pointer or updater manifest in this ticket. Hetzner requires an unversioned bucket for the conditional writes used here. Existing web/server workflows are unchanged. Validation: all 98 native JavaScript tests and 8 Rust tests pass; ESLint, Rust formatting, Clippy and workflow YAML/shell checks pass. The unsigned macOS build succeeds. The new packaging helper was also exercised against the actual notarized 0.1.0 app, including extraction, signature, architecture, stapling and Gatekeeper verification. Pending acceptance: the user is provisioning the macOS runner. Repository secrets and bucket variables must be configured, then an actual Actions/S3 release and installation of its public download must be verified. This PR remains a draft and KAN-58 remains In Progress until that acceptance is complete. Required secrets: `APPLE_CERTIFICATE` (base64 .p12 including private key), `APPLE_CERTIFICATE_PASSWORD`, `APPLE_PASSWORD` (app-specific), `S3_ACCESS_KEY_ID`, `S3_SECRET_ACCESS_KEY`. Required variables: `MACOS_RUNNER`, `S3_BUCKET`, `S3_REGION` (`nbg1`, `fsn1`, `hel1`). Optional variables: `MACOS_CHECK_RUNNER`, `MACOS_RELEASE_TARGET` (defaults to `aarch64-apple-darwin`), `S3_PREFIX` (defaults to `releases/macos`), `S3_PUBLIC_BASE_URL` (defaults to the public Hetzner bucket URL). Runner prerequisites: full Xcode and AWS CLI v2; the workflow prepares Node, pnpm and Rust. Use a clean isolated runner for PR checks. The `macos-v*` tag-protection rule is already configured in Gitea with `Twyco` permitted to manage those tags. No release tag or external artifact has been published by this change. Ticket: https://kanbangit.de/projects/1/tickets/58 Depends on PR #152. Original branch base and PR target: `feature/KAN-56-signed-macos-release`, successfully fast-forward pulled at `2b85517965d8710db04ae54f6eb4c2b7249b1846` before branch creation.
Twyco changed target branch from feature/KAN-56-signed-macos-release to main 2026-09-27 08:08:50 +00:00
Twyco added 1 commit 2026-09-27 08:09:01 +00:00
feat(KAN-58): add macOS actions and Hetzner release pipeline
CI/CD / preconditions (pull_request) Successful in 2s
Details
macOS checks / Native Rust tests and unsigned build (pull_request) Canceled after 0s
Details
Native JavaScript checks / Native launcher and release tests (pull_request) Successful in 57s
Details
CI/CD / test_and_check_app (pull_request) Successful in 6m33s
Details
CI/CD / Publish immutable image (pull_request) Skipped
Details
fcba7673c2
Twyco force-pushed feature/KAN-58-macos-release-pipeline from 96afd8b7ca to fcba7673c2 2026-09-27 08:09:01 +00:00 Compare
Twyco marked the pull request as ready for review 2026-09-27 08:42:05 +00:00
Twyco marked the pull request as work in progress 2026-09-27 08:42:15 +00:00
Twyco marked the pull request as ready for review 2026-09-27 08:58:28 +00:00
Twyco merged commit 1c620654a3 into main 2026-09-27 08:58:31 +00:00
Twyco deleted branch feature/KAN-58-macos-release-pipeline 2026-09-27 08:58:31 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Eric Twyco flux-image-automation (Flux Image Automation)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: PetschStudios/KanbanGit#153