build-env 支持经 secrets 传入(reusable workflow 的 with: 不允许引用 secrets 上下文) #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Tauri Desktop Release | ||
|
Check failure on line 1 in .github/workflows/tauri-desktop-release.yml
|
||
| on: | ||
| workflow_call: | ||
| inputs: | ||
| project-path: | ||
| required: true | ||
| type: string | ||
| cargo-lock-path: | ||
| required: true | ||
| type: string | ||
| cargo-target-path: | ||
| required: true | ||
| type: string | ||
| tag-name: | ||
| required: true | ||
| type: string | ||
| release-name: | ||
| required: true | ||
| type: string | ||
| release-body: | ||
| required: false | ||
| type: string | ||
| default: '' | ||
| release-owner: | ||
| required: false | ||
| type: string | ||
| default: '' | ||
| release-repo: | ||
| required: false | ||
| type: string | ||
| default: '' | ||
| release-draft: | ||
| required: false | ||
| type: boolean | ||
| default: false | ||
| prerelease: | ||
| required: false | ||
| type: boolean | ||
| default: false | ||
| include-updater-json: | ||
| required: false | ||
| type: boolean | ||
| default: false | ||
| # 构建期注入到二进制的环境变量，多行 KEY=VALUE（非敏感值可直接写）。 | ||
| # 敏感值放调用方仓库的 BUILD_ENV_SECRETS secret（同为多行 KEY=VALUE）， | ||
| # 调用方使用 secrets: inherit 即可自动透传，此处不声明任何 secrets 输入。 | ||
| # 仅透传给构建步骤，值为空的行会被跳过；不使用该机制的项目无需配置。 | ||
| build-env: | ||
| required: false | ||
| type: string | ||
| default: '' | ||
| jobs: | ||
| release-desktop: | ||
| timeout-minutes: 60 | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| include: | ||
| - platform: macos-26 | ||
| args: --target universal-apple-darwin | ||
| rust-target: aarch64-apple-darwin,x86_64-apple-darwin | ||
| cache-key: universal-apple-darwin | ||
| - platform: ubuntu-24.04 | ||
| args: '' | ||
| rust-target: '' | ||
| - platform: windows-latest | ||
| args: '' | ||
| rust-target: '' | ||
| - platform: windows-latest | ||
| args: --target aarch64-pc-windows-msvc | ||
| rust-target: aarch64-pc-windows-msvc | ||
| runs-on: ${{ matrix.platform }} | ||
| steps: | ||
| - uses: actions/checkout@v5 | ||
| - uses: pnpm/action-setup@v6 | ||
| with: | ||
| version: 10.33.0 | ||
| - uses: actions/setup-node@v5 | ||
| with: | ||
| node-version: 24 | ||
| cache: pnpm | ||
| - name: Install Rust | ||
| uses: dtolnay/rust-toolchain@stable | ||
| with: | ||
| targets: ${{ matrix.rust-target }} | ||
| - name: Cache cargo registry | ||
| uses: actions/cache@v5 | ||
| with: | ||
| path: | | ||
| ~/.cargo/registry | ||
| ~/.cargo/git | ||
| ${{ inputs.cargo-target-path }} | ||
| key: ${{ matrix.platform }}-${{ matrix.cache-key || matrix.rust-target || 'default' }}-cargo-${{ hashFiles(inputs.cargo-lock-path) }} | ||
| restore-keys: | | ||
| ${{ matrix.platform }}-${{ matrix.cache-key || matrix.rust-target || 'default' }}-cargo- | ||
| ${{ matrix.platform }}-cargo- | ||
| - name: Remove cached Tauri bundles | ||
| shell: bash | ||
| run: | | ||
| if [ -d "${{ inputs.cargo-target-path }}" ]; then | ||
| find "${{ inputs.cargo-target-path }}" -type d -name bundle -prune -exec rm -rf {} + | ||
| fi | ||
| - name: Install Linux deps | ||
| if: startsWith(matrix.platform, 'ubuntu-') | ||
| run: | | ||
| sudo apt-get update | ||
| sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev libpipewire-0.3-dev libgbm-dev patchelf | ||
| - run: pnpm install --frozen-lockfile | ||
| - name: Import macOS signing certificate | ||
| if: startsWith(matrix.platform, 'macos-') | ||
| shell: bash | ||
| env: | ||
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | ||
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | ||
| run: | | ||
| if [ -f scripts/mac-import-signing-cert.sh ]; then | ||
| bash -- scripts/mac-import-signing-cert.sh | ||
| fi | ||
| - name: Apply build env | ||
| if: inputs.build-env != '' || secrets.BUILD_ENV_SECRETS != '' | ||
| shell: bash | ||
| env: | ||
| BUILD_ENV: ${{ inputs.build-env }} | ||
| BUILD_ENV_SECRETS: ${{ secrets.BUILD_ENV_SECRETS }} | ||
| run: | | ||
| printf '%s\n%s\n' "$BUILD_ENV" "$BUILD_ENV_SECRETS" | while IFS= read -r line; do | ||
| [ -z "$line" ] && continue | ||
| case "$line" in *=*) ;; *) continue ;; esac | ||
| # 值为空的变量跳过，避免覆盖构建环境里已有的有效值 | ||
| [ -n "${line#*=}" ] || continue | ||
| echo "$line" >> "$GITHUB_ENV" | ||
| done | ||
| - uses: tauri-apps/tauri-action@v0 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.PUBLIC_RELEASE_TOKEN || secrets.GITHUB_TOKEN }} | ||
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | ||
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | ||
| with: | ||
| projectPath: ${{ inputs.project-path }} | ||
| tagName: ${{ inputs.tag-name }} | ||
| releaseName: ${{ inputs.release-name }} | ||
| releaseBody: ${{ inputs.release-body }} | ||
| releaseDraft: ${{ inputs.release-draft }} | ||
| prerelease: ${{ inputs.prerelease }} | ||
| includeUpdaterJson: ${{ inputs.include-updater-json }} | ||
| owner: ${{ inputs.release-owner }} | ||
| repo: ${{ inputs.release-repo }} | ||
| args: ${{ matrix.args }} | ||
