diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b2ace54c2..e47dae730 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -14,6 +14,9 @@ updates: versions: ["2.0.1.MR"] - dependency-name: "org.openjfx:*" update-types: ["version-update:semver-major"] + # due to https://github.com/fabriciorby/maven-surefire-junit5-tree-reporter/issues/68 + - dependency-name: "org.apache.maven.plugins:maven-surefire-plugin" + versions: [ "3.5.4", "3.5.5" ] groups: java-test-dependencies: patterns: diff --git a/.github/workflows/appimage.yml b/.github/workflows/appimage.yml index 6bb406441..08a0823a1 100644 --- a/.github/workflows/appimage.yml +++ b/.github/workflows/appimage.yml @@ -3,6 +3,8 @@ name: Build AppImage on: release: types: [published] + schedule: + - cron: '0 23 20 * *' workflow_dispatch: inputs: version: @@ -47,10 +49,12 @@ jobs: arch: x86_64 openjfx-url: 'https://download2.gluonhq.com/openjfx/25.0.2/openjfx-25.0.2_linux-x64_bin-jmods.zip' openjfx-sha: 'e0a9c29d8cf3af9b8b48848b43f87b5785bc107c53a951b19668ce05842bba1b' + appimagetool-sha: 'ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0' - os: ubuntu-24.04-arm arch: aarch64 openjfx-url: 'https://download2.gluonhq.com/openjfx/25.0.2/openjfx-25.0.2_linux-aarch64_bin-jmods.zip' openjfx-sha: 'c3408f818693cce09e59829a8e862a82c7695fdfcd585c41cfd527f5fc3fe646' + appimagetool-sha: 'f0837e7448a0c1e4e650a93bb3e85802546e60654ef287576f46c71c126a9158' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Java @@ -142,6 +146,7 @@ jobs: --java-options "-Dcryptomator.integrationsLinux.trayIconsDir=\"@{appdir}/usr/share/icons/hicolor/symbolic/apps\"" --java-options "-Dcryptomator.buildNumber=\"appimage-${REV_NUM}\"" --java-options "-Dcryptomator.networking.truststore.p12Path=\"/etc/cryptomator/certs.p12\"" + --java-options "-Dcryptomator.hub.enableTrustOnFirstUse=true" --java-options "-XX:ErrorFile=/cryptomator/cryptomator_crash.log" --resource-dir dist/linux/resources - name: Patch Cryptomator.AppDir @@ -165,7 +170,8 @@ jobs: ln -s bin/cryptomator.sh Cryptomator.AppDir/AppRun - name: Download AppImageKit run: | - curl --silent --fail-with-body --proto "=https" -L "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-${{ matrix.arch }}.AppImage" -o appimagetool.AppImage + curl --silent --fail-with-body --proto "=https" -L "https://github.com/AppImage/appimagetool/releases/download/1.9.1/appimagetool-${{ matrix.arch }}.AppImage" -o appimagetool.AppImage + echo "${{ matrix.appimagetool-sha }} appimagetool.AppImage" | shasum -a256 --check chmod +x appimagetool.AppImage ./appimagetool.AppImage --appimage-extract - name: Prepare GPG-Agent for signing with key 615D449FE6E6A235 @@ -185,7 +191,7 @@ jobs: gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a cryptomator-*.AppImage gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a cryptomator-*.AppImage.zsync - name: Upload artifacts - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: name: appimage-${{ matrix.arch }} path: | diff --git a/.github/workflows/av-whitelist.yml b/.github/workflows/av-whitelist.yml index 1a7488fd2..0c2bc3d9a 100644 --- a/.github/workflows/av-whitelist.yml +++ b/.github/workflows/av-whitelist.yml @@ -51,7 +51,7 @@ jobs: - name: Download file run: curl --silent --fail-with-body --proto "=https" -L "${INPUT_URL}" -o "${{steps.extractName.outputs.fileName}}" - name: Upload artifact - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: name: ${{ steps.extractName.outputs.fileName }} path: ${{ steps.extractName.outputs.fileName }} @@ -63,7 +63,7 @@ jobs: if: inputs.kaspersky steps: - name: Download artifact - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 + uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0 with: name: ${{ needs.download-file.outputs.fileName }} path: upload @@ -83,7 +83,7 @@ jobs: if: inputs.avast steps: - name: Download artifact - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 + uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0 with: name: ${{ needs.download-file.outputs.fileName }} path: upload diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 12ab0d3fe..218b1caae 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -67,7 +67,7 @@ jobs: ### Other Changes 📎 END REPLACE--> - Feel free to also read our [CHANGELOG.md](https://github.com/cryptomator/cryptomator/blob/develop/CHANGELOG.md). + For a comprehensive view of changes, read the [CHANGELOG](https://github.com/cryptomator/cryptomator/blob/develop/CHANGELOG.md). --- diff --git a/.github/workflows/debian.yml b/.github/workflows/debian.yml index f4e9a09a4..140120f4a 100644 --- a/.github/workflows/debian.yml +++ b/.github/workflows/debian.yml @@ -1,6 +1,8 @@ name: Build Debian Package on: + schedule: + - cron: '0 22 20 * *' workflow_dispatch: inputs: semver: @@ -143,7 +145,7 @@ jobs: run: | gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a cryptomator_*_amd64.deb - name: Upload artifacts - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: name: linux-deb-package path: | diff --git a/.github/workflows/flathub.yml b/.github/workflows/flathub.yml deleted file mode 100644 index bf22cec30..000000000 --- a/.github/workflows/flathub.yml +++ /dev/null @@ -1,85 +0,0 @@ -name: Create PR for flathub - -on: - release: - types: [published] - workflow_dispatch: - inputs: - tag: - description: 'Release tag' - required: true - -jobs: - get-version: - uses: ./.github/workflows/get-version.yml - with: - version: ${{ inputs.tag }} - tarball: - name: Determines tarball url and compute checksum - runs-on: ubuntu-latest - needs: [get-version] - if: github.event_name == 'workflow_dispatch' || needs.get-version.outputs.versionType == 'stable' - outputs: - url: ${{ steps.url.outputs.url}} - sha512: ${{ steps.sha512.outputs.sha512}} - steps: - - name: Determine tarball url - id: url - run: | - URL="https://github.com/cryptomator/cryptomator/archive/refs/tags/${TAG}.tar.gz" - echo "url=${URL}" >> "$GITHUB_OUTPUT" - env: - TAG: ${{ inputs.tag || github.event.release.tag_name}} - - name: Download source tarball and compute checksum - id: sha512 - run: | - curl --silent --fail-with-body --proto "=https" -L -H "Accept: application/vnd.github+json" ${{ steps.url.outputs.url }} --output cryptomator.tar.gz - TARBALL_SHA512=$(sha512sum cryptomator.tar.gz | cut -d ' ' -f1) - echo "sha512=${TARBALL_SHA512}" >> "$GITHUB_OUTPUT" - flathub: - name: Create PR for flathub - runs-on: ubuntu-latest - needs: [tarball, get-version] - env: - FLATHUB_PR_URL: tbd - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - repository: 'flathub/org.cryptomator.Cryptomator' - token: ${{ secrets.CRYPTOBOT_PR_TOKEN }} - - name: Checkout release branch - run: | - git checkout -b release/${{ needs.get-version.outputs.semVerStr }} - - name: Update build file - run: | - sed -i -e 's/VERSION: [0-9]\+\.[0-9]\+\.[0-9]\+.*/VERSION: ${{ needs.get-version.outputs.semVerStr }}/g' org.cryptomator.Cryptomator.yaml - sed -i -e 's/sha512: [0-9A-Za-z_\+-]\{128\} #CRYPTOMATOR/sha512: ${{ needs.tarball.outputs.sha512 }} #CRYPTOMATOR/g' org.cryptomator.Cryptomator.yaml - sed -i -e 's;url: https://github.com/cryptomator/cryptomator/archive/refs/tags/[^[:blank:]]\+;url: ${{ needs.tarball.outputs.url }};g' org.cryptomator.Cryptomator.yaml - - name: Commit and push - run: | - git config user.name "${{ github.actor }}" - git config user.email "${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com" - git config push.autoSetupRemote true - git stage . - git commit -m "Prepare release ${{needs.get-version.outputs.semVerStr}}" - git push - - name: Create pull request - run: | - printf "> [!IMPORTANT]\n> Todos:\n> - [ ] Update maven dependencies\n> - [ ] Check for JDK update\n> - [ ] Check for JFX update" > pr_body.md - PR_URL=$(gh pr create --title "Release ${{ needs.get-version.outputs.semVerStr }}" --body-file pr_body.md) - echo "FLATHUB_PR_URL=$PR_URL" >> "$GITHUB_ENV" - env: - GH_TOKEN: ${{ secrets.CRYPTOBOT_PR_TOKEN }} - - name: Slack Notification - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 - if: github.event_name == 'release' - env: - SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }} - SLACK_USERNAME: 'Cryptobot' - SLACK_ICON: false - SLACK_ICON_EMOJI: ':bot:' - SLACK_CHANNEL: 'cryptomator-desktop' - SLACK_TITLE: "Flathub release PR created for ${{ github.event.repository.name }} ${{ github.event.release.tag_name }} created." - SLACK_MESSAGE: "See <${{ env.FLATHUB_PR_URL }}|PR> on how to proceed.>." - SLACK_FOOTER: false - MSG_MINIMAL: true \ No newline at end of file diff --git a/.github/workflows/linux-flatpak.yml b/.github/workflows/linux-flatpak.yml new file mode 100644 index 000000000..bd671e6d1 --- /dev/null +++ b/.github/workflows/linux-flatpak.yml @@ -0,0 +1,264 @@ +name: Build flatpak + +on: + release: + types: [published] + workflow_dispatch: + inputs: + src-tag: + description: 'Source or Release tag' + required: false + create-pr: + description: 'Create Flathub PR' + required: false + type: boolean + default: false + push: + branches-ignore: + - 'dependabot/**' + paths: + - '.github/workflows/get-version.yml' + - '.github/workflows/linux-flatpak.yml' + - 'dist/linux/flatpak/**' + - 'dist/linux/common/**' + - 'dist/linux/resources/**' + +jobs: + get-version: + uses: ./.github/workflows/get-version.yml + with: + version: ${{ inputs.src-tag }} + + build-flatpak: + name: "Build flatpak" + needs: [get-version] + container: + image: ghcr.io/flathub-infra/flatpak-github-actions:freedesktop-25.08 + options: --privileged + strategy: + fail-fast: false + matrix: + variant: + - arch: x86_64 + runner: ubuntu-24.04 + - arch: aarch64 + runner: ubuntu-24.04-arm + runs-on: ${{ matrix.variant.runner }} + permissions: + contents: read + env: + SRC_GIT_SHA: ${{ inputs.src-tag || github.sha}} + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + repository: flathub/org.cryptomator.Cryptomator + submodules: true + - name: Checkout build script + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + path: build-scripts + - name: Checkout app source + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + path: cryptomator + ref: ${{ env.SRC_GIT_SHA }} + fetch-depth: 0 + - name: Prepare build files + # using envsubst instead of yq to keep linebreaks + run: | + cp -r -f build-scripts/dist/linux/flatpak/* . + envsubst '$FLATPAK_VERSION $FLATPAK_REVISION $CRYPTOMATOR_SOURCE' < org.cryptomator.Cryptomator.TEMPLATE.yaml > org.cryptomator.Cryptomator.yaml + env: + FLATPAK_VERSION: ${{ needs.get-version.outputs.semVerNum }} + FLATPAK_REVISION: 1 + CRYPTOMATOR_SOURCE: |- + type: git + path: cryptomator + commit: ${{ env.SRC_GIT_SHA }} + - name: Copy build script for upload + run: cp org.cryptomator.Cryptomator.yaml org.cryptomator.Cryptomator.${{matrix.variant.arch}}.yaml + - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + with: + archive: false + if-no-files-found: error + path: | + org.cryptomator.Cryptomator.${{matrix.variant.arch}}.yaml + - uses: flatpak/flatpak-github-actions/flatpak-builder@401fe28a8384095fc1531b9d320b292f0ee45adb # SNAPSHOT due to using keep-build-dirs + with: + bundle: cryptomator.flatpak + manifest-path: org.cryptomator.Cryptomator.yaml + cache-key: flatpak-builder-${{ env.SRC_GIT_SHA }} + arch: ${{ matrix.variant.arch }} + keep-build-dirs: true + - name: Collect maven dependencies + working-directory: .flatpak-builder/build/cryptomator-1/.m2/repository/ + run: | + find * -type f \( -iname '*.jar' -o -iname '*.pom' \) | sort -V > /tmp/maven-dependency-files.txt + grep -v '^org/openjfx/javafx-' /tmp/maven-dependency-files.txt > maven-dependency-files-common.txt + grep '^org/openjfx/javafx-' /tmp/maven-dependency-files.txt > maven-dependency-files-javafx.txt + - name: Update arch independent maven dependencies + run: | + ( + cd .flatpak-builder/build/cryptomator-1/.m2/repository/ + + while IFS= read -r dependencyPath; do + dependencyName=$(dirname "$dependencyPath") + dependencySha=$(sha256sum "$dependencyPath" | cut -c 1-64) + cat < maven-dependencies.yaml + - name: Update arch specific maven dependencies + run: | + ( + cd .flatpak-builder/build/cryptomator-1/.m2/repository/ + + while IFS= read -r dependencyPath; do + dependencyName=$(dirname "$dependencyPath") + dependencySha=$(sha256sum "$dependencyPath" | cut -c 1-64) + cat < javafx-maven-dependencies-${{ matrix.variant.arch }}.yaml + - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + with: + name: maven-sources-${{ matrix.variant.arch }} + if-no-files-found: error + path: | + maven-dependencies.yaml + javafx-maven-dependencies-${{ matrix.variant.arch }}.yaml + + verify-maven-sources: + name: Verify maven sources + runs-on: ubuntu-latest + needs: [build-flatpak] + permissions: + contents: none + steps: + - name: Download updated maven aarch64 dependencies + uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0 + with: + name: maven-sources-aarch64 + path: mvn-src-aarch64 + - name: Download updated maven x86_64 dependencies + uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0 + with: + name: maven-sources-x86_64 + path: mvn-src-x64 + - name: Verify arch independent maven dependencies + run: cmp --silent mvn-src-aarch64/maven-dependencies.yaml mvn-src-x64/maven-dependencies.yaml + + create-pr: + name: Create PR for flathub + runs-on: ubuntu-latest + needs: [get-version, verify-maven-sources] + if: (github.event_name == 'workflow_dispatch' && inputs.create-pr ) || (github.event_name == 'release' && needs.get-version.outputs.versionType == 'stable') + permissions: + contents: write + env: + TARBALL_URL: 'https://github.com/cryptomator/cryptomator/archive/refs/tags/${{ github.event.release.tag_name || inputs.src-tag }}.tar.gz' + steps: + - name: Check that input "src-tag" is actually a tag + if: github.event_name == 'workflow_dispatch' + run: | + if [ -z "$SRC_TAG" ]; then + echo '::error::Input "src-tag" must be set to create a Flathub PR' + exit 1 + fi + env: + SRC_TAG: ${{ inputs.src-tag }} + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + repository: flathub/org.cryptomator.Cryptomator + submodules: true #TODO: Update submodule! + token: ${{ secrets.CRYPTOBOT_PR_TOKEN }} + - name: Checkout release branch + run: | + git checkout -b release/${{ needs.get-version.outputs.semVerStr }} + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + path: cryptomator + - name: Download source tarball and compute checksum + id: sha512 + run: | + curl --silent --fail-with-body --proto "=https" -L -H "Accept: application/vnd.github+json" ${TARBALL_URL} --output cryptomator.tar.gz + TARBALL_SHA512=$(sha512sum cryptomator.tar.gz | cut -d ' ' -f1) + echo "value=${TARBALL_SHA512}" >> "$GITHUB_OUTPUT" + - name: Download updated maven aarch64 dependencies + uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0 + with: + name: maven-sources-aarch64 + path: mvn-src-aarch64 + - name: Download updated maven x86_64 dependencies + uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0 + with: + name: maven-sources-x86_64 + path: mvn-src-x64 + - name: Determine revision + id: revision + run: | + CURRENT_VERSION="$(yq '(.modules[] | select(.name == "cryptomator") | .build-options.env.VERSION)' org.cryptomator.Cryptomator.yaml)" + CURRENT_REVISION="$(yq '(.modules[] | select(.name == "cryptomator") | .build-options.env.REVISION_NO)' org.cryptomator.Cryptomator.yaml)" + + if [[ "$CURRENT_VERSION" == "$TARGET_VERSION" && "$CURRENT_REVISION" =~ ^[0-9]+$ ]]; then + NEXT_REVISION=$((CURRENT_REVISION + 1)) + else + NEXT_REVISION=1 + fi + + echo "value=${NEXT_REVISION}" >> "$GITHUB_OUTPUT" + env: + TARGET_VERSION: ${{ needs.get-version.outputs.semVerStr }} + - name: Update build files + run: | + cp -r -f cryptomator/dist/linux/flatpak/* . + cp -r -f mvn-src-x64/* . + cp -r -f mvn-src-aarch64/* . + envsubst '$FLATPAK_VERSION $FLATPAK_REVISION $CRYPTOMATOR_SOURCE' < org.cryptomator.Cryptomator.TEMPLATE.yaml > org.cryptomator.Cryptomator.yaml + yq -i 'del(.modules[] | select(.name == "cryptomator") | .build-options.build-args)' org.cryptomator.Cryptomator.yaml + yq -i '(.modules[] | select(.name == "cryptomator") | .sources) += ["maven-dependencies.yaml", "javafx-maven-dependencies-x86_64.yaml", "javafx-maven-dependencies-aarch64.yaml"]' org.cryptomator.Cryptomator.yaml + env: + FLATPAK_VERSION: ${{ needs.get-version.outputs.semVerNum }} + FLATPAK_REVISION: ${{ steps.revision.outputs.value}} + CRYPTOMATOR_SOURCE: |- + type: archive + sha512: ${{steps.sha512.outputs.value}} + url: ${{ env.TARBALL_URL }} + - name: Commit and push + run: | + git config user.name "cryptobot" + git config user.email "cryptobot@users.noreply.github.com" + git config push.autoSetupRemote true + git stage org.cryptomator.Cryptomator.yaml maven-dependencies.yaml javafx-maven-dependencies-aarch64.yaml javafx-maven-dependencies-x86_64.yaml + git commit -m "Prepare release ${{needs.get-version.outputs.semVerStr}}" + git push + - name: Create pull request + id: create-pr + run: | + printf "Created by $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" > pr_body.md + PR_URL=$(gh pr create --title "Release ${{ needs.get-version.outputs.semVerStr }}" --body-file pr_body.md) + echo "FLATHUB_PR_URL=$PR_URL" >> "$GITHUB_OUTPUT" + env: + GH_TOKEN: ${{ secrets.CRYPTOBOT_PR_TOKEN }} + - name: Slack Notification + uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + if: github.event_name == 'release' + env: + SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_CRYPTOMATOR_DESKTOP }} + SLACK_USERNAME: 'Cryptobot' + SLACK_ICON: false + SLACK_ICON_EMOJI: ':bot:' + SLACK_CHANNEL: 'cryptomator-desktop' + SLACK_TITLE: "Flathub release PR created for ${{ github.event.repository.name }} ${{ github.event.release.tag_name }} created." + SLACK_MESSAGE: "See <${{ steps.create-pr.outputs.FLATHUB_PR_URL }}|PR> on how to proceed." + SLACK_FOOTER: false + MSG_MINIMAL: true diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml index b53aa9e30..c28597aca 100644 --- a/.github/workflows/linux-makepkg.yml +++ b/.github/workflows/linux-makepkg.yml @@ -3,6 +3,8 @@ name: Build Arch package on: release: types: [published] + schedule: + - cron: '0 21 20 * *' workflow_dispatch: inputs: version: @@ -67,13 +69,13 @@ jobs: sudo -u builder env PKGDEST="$PKGDEST" SRCDEST="$SRCDEST" makepkg --syncdeps --cleanbuild --noconfirm --log - - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: name: arch-package if-no-files-found: error path: | ${{ env.PKGDEST }}/*.pkg.tar.zst - - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: name: pkgbuild-file if-no-files-found: error @@ -145,7 +147,7 @@ jobs: env: VERSION: ${{ needs.get-version.outputs.semVerStr }} - name: Download PKGBUILD template - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 + uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0 with: name: pkgbuild-file - name: Prepare PKGBUILD diff --git a/.github/workflows/mac-dmg-x64.yml b/.github/workflows/mac-dmg-x64.yml index 102e104c6..52cf69cf3 100644 --- a/.github/workflows/mac-dmg-x64.yml +++ b/.github/workflows/mac-dmg-x64.yml @@ -11,6 +11,8 @@ name: Build macOS .dmg for x64 on: release: types: [published] + schedule: + - cron: '0 20 20 * *' workflow_dispatch: inputs: version: @@ -138,12 +140,14 @@ jobs: --java-options "-Dcryptomator.showTrayIcon=true" --java-options "-Dcryptomator.updateMechanism=org.cryptomator.macos.update.DmgUpdateMechanism" --java-options "-Dcryptomator.buildNumber=\"dmg-${{ needs.get-version.outputs.revNum }}\"" + --java-options "-Dcryptomator.hub.enableTrustOnFirstUse=true" --mac-package-identifier org.cryptomator --resource-dir dist/mac/resources - name: Patch Cryptomator.app run: | mv appdir/Cryptomator.app Cryptomator.app mv dist/mac/resources/Cryptomator-Vault.icns Cryptomator.app/Contents/Resources/ + cp dist/mac/resources/Assets.car Cryptomator.app/Contents/Resources/ sed -i '' "s|###BUNDLE_SHORT_VERSION_STRING###|${VERSION_NO}|g" Cryptomator.app/Contents/Info.plist sed -i '' "s|###BUNDLE_VERSION###|${REVISION_NO}|g" Cryptomator.app/Contents/Info.plist echo -n "$PROVISIONING_PROFILE_BASE64" | base64 --decode --output Cryptomator.app/Contents/embedded.provisionprofile @@ -151,20 +155,6 @@ jobs: VERSION_NO: ${{ needs.get-version.outputs.semVerNum }} REVISION_NO: ${{ needs.get-version.outputs.revNum }} PROVISIONING_PROFILE_BASE64: ${{ secrets.MACOS_PROVISIONING_PROFILE_BASE64 }} - - name: Build and install DockTilePlugin - env: - DERIVED_DATA_PATH: dist/mac/DockTilePlugin/build - run: | - xcodebuild -project dist/mac/DockTilePlugin/DockTilePlugin.xcodeproj \ - -scheme DockTilePlugin \ - -configuration Release \ - -destination "platform=macOS,arch=x86_64" \ - -derivedDataPath ${DERIVED_DATA_PATH} \ - -quiet \ - clean build - mkdir -p Cryptomator.app/Contents/PlugIns - cp -R ${DERIVED_DATA_PATH}/Build/Products/Release/Cryptomator.docktileplugin Cryptomator.app/Contents/PlugIns/ - rm -rf ${DERIVED_DATA_PATH} - name: Generate license for dmg run: > mvn -B license:add-third-party @@ -261,7 +251,7 @@ jobs: env: CODESIGN_IDENTITY: ${{ secrets.MACOS_CODESIGN_IDENTITY }} - name: Notarize .dmg - if: startsWith(github.ref, 'refs/tags/') || inputs.notarize + if: startsWith(github.ref, 'refs/tags/') || inputs.notarize || github.event_name == 'schedule' uses: cocoalibs/xcode-notarization-action@5cf433d494b6fa26504b574c591f4dd120388846 # v1.0.3 with: app-path: 'Cryptomator-*.dmg' @@ -283,7 +273,7 @@ jobs: run: security delete-keychain $RUNNER_TEMP/codesign.keychain-db continue-on-error: true - name: Upload artifacts - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: name: dmg-${{ matrix.output-suffix }} path: | diff --git a/.github/workflows/mac-dmg.yml b/.github/workflows/mac-dmg.yml index b2b962b6f..6b3638faf 100644 --- a/.github/workflows/mac-dmg.yml +++ b/.github/workflows/mac-dmg.yml @@ -3,6 +3,8 @@ name: Build macOS .dmg for arm64 on: release: types: [published] + schedule: + - cron: '0 20 20 * *' workflow_dispatch: inputs: version: @@ -137,12 +139,14 @@ jobs: --java-options "-Dcryptomator.updateMechanism=org.cryptomator.macos.update.DmgUpdateMechanism" --java-options "-Dcryptomator.buildNumber=\"dmg-${{ needs.get-version.outputs.revNum }}\"" --java-options "-XX:ErrorFile=/cryptomator/cryptomator_crash.log" + --java-options "-Dcryptomator.hub.enableTrustOnFirstUse=true" --mac-package-identifier org.cryptomator --resource-dir dist/mac/resources - name: Patch Cryptomator.app run: | mv appdir/Cryptomator.app Cryptomator.app mv dist/mac/resources/Cryptomator-Vault.icns Cryptomator.app/Contents/Resources/ + cp dist/mac/resources/Assets.car Cryptomator.app/Contents/Resources/ sed -i '' "s|###BUNDLE_SHORT_VERSION_STRING###|${VERSION_NO}|g" Cryptomator.app/Contents/Info.plist sed -i '' "s|###BUNDLE_VERSION###|${REVISION_NO}|g" Cryptomator.app/Contents/Info.plist echo -n "$PROVISIONING_PROFILE_BASE64" | base64 --decode --output Cryptomator.app/Contents/embedded.provisionprofile @@ -150,20 +154,6 @@ jobs: VERSION_NO: ${{ needs.get-version.outputs.semVerNum }} REVISION_NO: ${{ needs.get-version.outputs.revNum }} PROVISIONING_PROFILE_BASE64: ${{ secrets.MACOS_PROVISIONING_PROFILE_BASE64 }} - - name: Build and install DockTilePlugin - env: - DERIVED_DATA_PATH: dist/mac/DockTilePlugin/build - run: | - xcodebuild -project dist/mac/DockTilePlugin/DockTilePlugin.xcodeproj \ - -scheme DockTilePlugin \ - -configuration Release \ - -destination "platform=macOS,arch=arm64" \ - -derivedDataPath ${DERIVED_DATA_PATH} \ - -quiet \ - clean build - mkdir -p Cryptomator.app/Contents/PlugIns - cp -R ${DERIVED_DATA_PATH}/Build/Products/Release/Cryptomator.docktileplugin Cryptomator.app/Contents/PlugIns/ - rm -rf ${DERIVED_DATA_PATH} - name: Generate license for dmg run: > mvn -B license:add-third-party @@ -260,7 +250,7 @@ jobs: env: CODESIGN_IDENTITY: ${{ secrets.MACOS_CODESIGN_IDENTITY }} - name: Notarize .dmg - if: startsWith(github.ref, 'refs/tags/') || inputs.notarize + if: startsWith(github.ref, 'refs/tags/') || inputs.notarize || github.event_name == 'schedule' uses: cocoalibs/xcode-notarization-action@5cf433d494b6fa26504b574c591f4dd120388846 # v1.0.3 with: app-path: 'Cryptomator-*.dmg' @@ -282,7 +272,7 @@ jobs: run: security delete-keychain $RUNNER_TEMP/codesign.keychain-db continue-on-error: true - name: Upload artifacts - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: name: dmg-${{ matrix.output-suffix }} path: | diff --git a/.github/workflows/no-response.yml b/.github/workflows/no-response.yml index 7c180e77d..6585256bb 100644 --- a/.github/workflows/no-response.yml +++ b/.github/workflows/no-response.yml @@ -12,7 +12,7 @@ jobs: issues: write pull-requests: write steps: - - uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1 + - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0 with: days-before-stale: 14 days-before-close: 0 diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 40559ca06..9f30d89a5 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -12,7 +12,7 @@ jobs: issues: write pull-requests: write steps: - - uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1 + - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0 with: days-before-stale: 365 days-before-close: 90 diff --git a/.github/workflows/win-exe.yml b/.github/workflows/win-exe.yml index 30e2f9f67..f292f2532 100644 --- a/.github/workflows/win-exe.yml +++ b/.github/workflows/win-exe.yml @@ -3,6 +3,8 @@ name: Build Windows Installer on: release: types: [published] + schedule: + - cron: '0 19 20 * *' workflow_dispatch: inputs: version: @@ -157,6 +159,7 @@ jobs: --java-options "-Dcryptomator.integrationsWin.windowsHelloKeychainPaths=\"@{appdata}/Cryptomator/windowsHelloKeychain.json\"" --java-options "-Dcryptomator.disableUpdateCheck=false" --java-options "-XX:ErrorFile=C:/cryptomator/cryptomator_crash.log" + --java-options "-Dcryptomator.hub.enableTrustOnFirstUse=true" --resource-dir dist/win/resources --icon dist/win/resources/Cryptomator.ico --add-launcher "Cryptomator (Debug)=dist/win/debug-launcher.properties" @@ -192,7 +195,7 @@ jobs: & $env:JAVA_HOME\bin\jmod.exe extract --dir jpackage-jmod "${env:JAVA_HOME}\jmods\jdk.jpackage.jmod" Get-ChildItem -Recurse -Path "jpackage-jmod" -File wixhelper.dll | Select-Object -Last 1 | Copy-Item -Destination "appdir" - name: Sign DLLs with Azure Trusted Signing - if: inputs.sign || github.event_name == 'release' + if: inputs.sign || github.event_name == 'release' || github.event_name == 'schedule' uses: ./.github/actions/win-sign-action with: base-dir: ${{ github.workspace }}\appdir @@ -201,17 +204,6 @@ jobs: tenant-id: ${{ secrets.AZURE_TENANT_ID }} client-id: ${{ secrets.AZURE_CLIENT_ID }} client-secret: ${{ secrets.AZURE_CLIENT_SECRET }} - - name: Sign DLLs with Actalis CodeSigner - if: inputs.sign || github.event_name == 'release' - uses: skymatic/workflows/.github/actions/win-sign-action@957d3c2c08c56855fdac41e5afb9a7aca8c30dd9 # no specific version - with: - base-dir: 'appdir' - file-extensions: 'dll,exe,ps1' - recursive: true - sign-description: 'Cryptomator' - sign-url: 'https://cryptomator.org' - username: ${{ secrets.WIN_CODESIGN_USERNAME }} - password: ${{ secrets.WIN_CODESIGN_PW }} - name: Replace DLLs inside jars with signed ones shell: pwsh run: | @@ -261,7 +253,7 @@ jobs: JP_WIXWIZARD_RESOURCES: ${{ github.workspace }}/dist/win/resources # requires abs path, used in resources/main.wxs JP_WIXHELPER_DIR: ${{ github.workspace }}\appdir - name: Sign MSI with Azure Trusted Signing - if: inputs.sign || github.event_name == 'release' + if: inputs.sign || github.event_name == 'release' || github.event_name == 'schedule' uses: ./.github/actions/win-sign-action with: base-dir: ${{ github.workspace }}\installer @@ -280,7 +272,7 @@ jobs: GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }} GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }} - name: Upload artifacts - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: name: msi-${{ matrix.arch }} path: | @@ -311,7 +303,7 @@ jobs: env: WIX_VERSION: ${{ env.WIX_VERSION }} - name: Download .msi - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 + uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0 with: name: msi-${{ matrix.arch }} path: dist/win/bundle/resources @@ -369,7 +361,7 @@ jobs: run: > wix burn detach installer/unsigned/Cryptomator-Installer.exe -engine tmp/engine.exe - name: Sign WiX burn engine with Azure Trusted Signing - if: inputs.sign || github.event_name == 'release' + if: inputs.sign || github.event_name == 'release' || github.event_name == 'schedule' uses: ./.github/actions/win-sign-action with: base-dir: ${{ github.workspace }}\tmp @@ -379,21 +371,11 @@ jobs: tenant-id: ${{ secrets.AZURE_TENANT_ID }} client-id: ${{ secrets.AZURE_CLIENT_ID }} client-secret: ${{ secrets.AZURE_CLIENT_SECRET }} - - name: Sign burn engine with Actalis CodeSigner - if: inputs.sign || github.event_name == 'release' - uses: skymatic/workflows/.github/actions/win-sign-action@957d3c2c08c56855fdac41e5afb9a7aca8c30dd9 # no specific version - with: - base-dir: 'tmp' - file-extensions: 'exe' - sign-description: 'Cryptomator Bundle Installer' - sign-url: 'https://cryptomator.org' - username: ${{ secrets.WIN_CODESIGN_USERNAME }} - password: ${{ secrets.WIN_CODESIGN_PW }} - name: Reattach signed burn engine to installer run: > wix burn reattach installer/unsigned/Cryptomator-Installer.exe -engine tmp/engine.exe -o installer/Cryptomator-Installer.exe - name: Sign EXE installer with Azure Trusted Signing - if: inputs.sign || github.event_name == 'release' + if: inputs.sign || github.event_name == 'release' || github.event_name == 'schedule' uses: ./.github/actions/win-sign-action with: base-dir: ${{ github.workspace }}\installer @@ -403,16 +385,6 @@ jobs: tenant-id: ${{ secrets.AZURE_TENANT_ID }} client-id: ${{ secrets.AZURE_CLIENT_ID }} client-secret: ${{ secrets.AZURE_CLIENT_SECRET }} - - name: Sign installer with Actalis CodeSigner - if: inputs.sign || github.event_name == 'release' - uses: skymatic/workflows/.github/actions/win-sign-action@957d3c2c08c56855fdac41e5afb9a7aca8c30dd9 # no specific version - with: - base-dir: 'installer' - file-extensions: 'exe' - sign-description: 'Cryptomator Bundle Installer' - sign-url: 'https://cryptomator.org' - username: ${{ secrets.WIN_CODESIGN_USERNAME }} - password: ${{ secrets.WIN_CODESIGN_PW }} - name: Add possible alpha/beta tags to installer name run: mv installer/Cryptomator-Installer.exe Cryptomator-${{ needs.get-version.outputs.semVerStr }}-${{ matrix.executable-suffix }}.exe - name: Create detached GPG signature with key 615D449FE6E6A235 @@ -423,7 +395,7 @@ jobs: GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }} GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }} - name: Upload artifacts - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: name: exe-${{ matrix.executable-suffix }} path: | @@ -441,7 +413,7 @@ jobs: download-url-exe-x64: ${{ fromJSON(steps.publish.outputs.assets)[2].browser_download_url }} steps: - name: Download installers - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 + uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0 with: merge-multiple: true - name: Publish installers on GitHub Releases @@ -479,7 +451,7 @@ jobs: - name: Slack Notification uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 env: - SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }} + SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_CRYPTOMATOR_DESKTOP }} SLACK_USERNAME: 'Cryptobot' SLACK_ICON: false SLACK_ICON_EMOJI: ':bot:' diff --git a/.idea/runConfigurations/Cryptomator_Linux.xml b/.idea/runConfigurations/Cryptomator_Linux.xml index e9ecf3a50..22b4a3029 100644 --- a/.idea/runConfigurations/Cryptomator_Linux.xml +++ b/.idea/runConfigurations/Cryptomator_Linux.xml @@ -2,7 +2,7 @@