Skip to content

Commit 38ca631

Browse files
prabhatsharmaprabhatsharma
committed
feat: add Dependabot configuration and security workflows
1 parent b6c22b1 commit 38ca631

File tree

4 files changed

+587
-1
lines changed

4 files changed

+587
-1
lines changed

‎.github/dependabot.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
version: 2
2+
updates:
3+
# npm dependencies
4+
- package-ecosystem: "npm"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"
8+
day: "monday"
9+
time: "09:00"
10+
open-pull-requests-limit: 10
11+
labels:
12+
- "dependencies"
13+
- "npm"
14+
commit-message:
15+
prefix: "chore"
16+
include: "scope"
17+
18+
# Cargo (Rust) dependencies
19+
- package-ecosystem: "cargo"
20+
directory: "/src-tauri"
21+
schedule:
22+
interval: "weekly"
23+
day: "monday"
24+
time: "09:00"
25+
open-pull-requests-limit: 10
26+
labels:
27+
- "dependencies"
28+
- "rust"
29+
commit-message:
30+
prefix: "chore"
31+
include: "scope"
32+
33+
# GitHub Actions
34+
- package-ecosystem: "github-actions"
35+
directory: "/"
36+
schedule:
37+
interval: "weekly"
38+
day: "monday"
39+
time: "09:00"
40+
open-pull-requests-limit: 5
41+
labels:
42+
- "dependencies"
43+
- "github-actions"
44+
commit-message:
45+
prefix: "chore"
46+
include: "scope"

‎.github/workflows/release.yml‎

Lines changed: 318 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,318 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
tags:
6+
- 'v*' # Trigger on version tags like v1.0.0
7+
workflow_dispatch:
8+
inputs:
9+
version:
10+
description: 'Version to release (e.g., v1.0.0)'
11+
required: true
12+
type: string
13+
14+
env:
15+
CARGO_TERM_COLOR: always
16+
17+
jobs:
18+
# Security scanning before building
19+
security-check:
20+
runs-on: ubicloud-standard-8
21+
steps:
22+
- name: Checkout code
23+
uses: actions/checkout@v4
24+
with:
25+
fetch-depth: 0
26+
27+
- name: TruffleHog Secret Scan
28+
uses: trufflesecurity/trufflehog@main
29+
with:
30+
path: ./
31+
base: ${{ github.event.repository.default_branch }}
32+
head: HEAD
33+
34+
- name: Setup Node.js
35+
uses: actions/setup-node@v4
36+
with:
37+
node-version: '20'
38+
cache: 'npm'
39+
40+
- name: Install dependencies
41+
run: npm ci
42+
43+
- name: Audit npm dependencies
44+
run: npm audit --audit-level=moderate
45+
46+
- name: Setup Rust
47+
uses: dtolnay/rust-toolchain@stable
48+
49+
- name: Install cargo-audit
50+
run: cargo install cargo-audit --locked
51+
52+
- name: Audit Rust dependencies
53+
run: cd src-tauri && cargo audit
54+
55+
release-macos:
56+
needs: security-check
57+
runs-on: macos-latest
58+
59+
steps:
60+
- name: Checkout code
61+
uses: actions/checkout@v4
62+
63+
- name: Setup Node.js
64+
uses: actions/setup-node@v4
65+
with:
66+
node-version: '20'
67+
cache: 'npm'
68+
69+
- name: Setup Rust
70+
uses: dtolnay/rust-toolchain@stable
71+
with:
72+
targets: aarch64-apple-darwin,x86_64-apple-darwin
73+
74+
- name: Install dependencies
75+
run: npm ci
76+
77+
- name: Import Apple Certificate
78+
env:
79+
APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
80+
APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
81+
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
82+
run: |
83+
# Create temporary keychain
84+
KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
85+
security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
86+
security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
87+
security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
88+
89+
# Import certificate
90+
echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
91+
security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
92+
security list-keychain -d user -s $KEYCHAIN_PATH
93+
94+
# Allow codesign to access keychain
95+
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
96+
97+
# Clean up certificate file
98+
rm certificate.p12
99+
100+
echo "✅ Certificate imported successfully"
101+
102+
- name: Build Tauri app (Universal Binary)
103+
run: npm run tauri build -- --target universal-apple-darwin
104+
105+
- name: Notarize macOS app
106+
env:
107+
APPLE_ID: ${{ secrets.APPLE_ID }}
108+
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
109+
APPLE_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
110+
run: |
111+
# Find the DMG file
112+
DMG_PATH=$(find src-tauri/target/universal-apple-darwin/release/bundle/dmg -name "*.dmg" | head -n 1)
113+
114+
if [ -z "$DMG_PATH" ]; then
115+
echo "❌ Error: DMG file not found"
116+
exit 1
117+
fi
118+
119+
echo "📦 Found DMG: $DMG_PATH"
120+
echo "🔐 Submitting for notarization..."
121+
122+
# Submit for notarization
123+
xcrun notarytool submit "$DMG_PATH" \
124+
--apple-id "$APPLE_ID" \
125+
--team-id "$APPLE_TEAM_ID" \
126+
--password "$APPLE_PASSWORD" \
127+
--wait \
128+
--timeout 30m
129+
130+
echo "✅ Notarization complete!"
131+
132+
# Staple the notarization ticket
133+
echo "📎 Stapling notarization ticket..."
134+
xcrun stapler staple "$DMG_PATH"
135+
136+
echo "✅ Stapling complete!"
137+
138+
# Verify notarization
139+
echo "🔍 Verifying notarization..."
140+
spctl -a -vvv -t install "$DMG_PATH"
141+
142+
- name: Generate checksums
143+
run: |
144+
cd src-tauri/target/universal-apple-darwin/release/bundle/dmg
145+
shasum -a 256 *.dmg > checksums-macos.txt
146+
cat checksums-macos.txt
147+
148+
- name: Upload macOS artifacts
149+
uses: actions/upload-artifact@v4
150+
with:
151+
name: macos-dmg
152+
path: |
153+
src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg
154+
src-tauri/target/universal-apple-darwin/release/bundle/dmg/checksums-macos.txt
155+
156+
- name: Cleanup keychain
157+
if: always()
158+
run: |
159+
security delete-keychain $RUNNER_TEMP/app-signing.keychain-db || true
160+
161+
release-linux:
162+
needs: security-check
163+
runs-on: ubicloud-standard-8
164+
165+
steps:
166+
- name: Checkout code
167+
uses: actions/checkout@v4
168+
169+
- name: Setup Node.js
170+
uses: actions/setup-node@v4
171+
with:
172+
node-version: '20'
173+
cache: 'npm'
174+
175+
- name: Setup Rust
176+
uses: dtolnay/rust-toolchain@stable
177+
178+
- name: Install system dependencies
179+
run: |
180+
sudo apt-get update
181+
sudo apt-get install -y \
182+
libgtk-3-dev \
183+
libwebkit2gtk-4.1-dev \
184+
libappindicator3-dev \
185+
librsvg2-dev \
186+
patchelf
187+
188+
- name: Install dependencies
189+
run: npm ci
190+
191+
- name: Build Tauri app
192+
run: npm run tauri build
193+
194+
- name: Generate checksums
195+
run: |
196+
cd src-tauri/target/release/bundle
197+
find . -type f \( -name "*.deb" -o -name "*.AppImage" \) -exec shasum -a 256 {} \; > checksums-linux.txt
198+
cat checksums-linux.txt
199+
200+
- name: Upload Linux artifacts
201+
uses: actions/upload-artifact@v4
202+
with:
203+
name: linux-packages
204+
path: |
205+
src-tauri/target/release/bundle/deb/*.deb
206+
src-tauri/target/release/bundle/appimage/*.AppImage
207+
src-tauri/target/release/bundle/checksums-linux.txt
208+
209+
release-windows:
210+
needs: security-check
211+
runs-on: windows-2022-16-cores
212+
213+
steps:
214+
- name: Checkout code
215+
uses: actions/checkout@v4
216+
217+
- name: Setup Node.js
218+
uses: actions/setup-node@v4
219+
with:
220+
node-version: '20'
221+
cache: 'npm'
222+
223+
- name: Setup Rust
224+
uses: dtolnay/rust-toolchain@stable
225+
226+
- name: Install dependencies
227+
run: npm ci
228+
229+
- name: Build Tauri app
230+
run: npm run tauri build
231+
232+
- name: Generate checksums
233+
shell: pwsh
234+
run: |
235+
cd src-tauri/target/release/bundle
236+
Get-ChildItem -Recurse -Include *.msi,*.exe | ForEach-Object {
237+
$hash = Get-FileHash $_.FullName -Algorithm SHA256
238+
"$($hash.Hash) $($_.Name)"
239+
} | Out-File -FilePath checksums-windows.txt
240+
Get-Content checksums-windows.txt
241+
242+
- name: Upload Windows artifacts
243+
uses: actions/upload-artifact@v4
244+
with:
245+
name: windows-installers
246+
path: |
247+
src-tauri/target/release/bundle/msi/*.msi
248+
src-tauri/target/release/bundle/nsis/*.exe
249+
src-tauri/target/release/bundle/checksums-windows.txt
250+
251+
create-release:
252+
needs: [release-macos, release-linux, release-windows]
253+
runs-on: ubicloud-standard-8
254+
permissions:
255+
contents: write
256+
257+
steps:
258+
- name: Checkout code
259+
uses: actions/checkout@v4
260+
261+
- name: Download all artifacts
262+
uses: actions/download-artifact@v4
263+
with:
264+
path: artifacts
265+
266+
- name: Display structure of downloaded files
267+
run: ls -R artifacts
268+
269+
- name: Create GitHub Release
270+
uses: softprops/action-gh-release@v1
271+
with:
272+
files: |
273+
artifacts/macos-dmg/*.dmg
274+
artifacts/macos-dmg/checksums-macos.txt
275+
artifacts/linux-packages/*.deb
276+
artifacts/linux-packages/*.AppImage
277+
artifacts/linux-packages/checksums-linux.txt
278+
artifacts/windows-installers/*.msi
279+
artifacts/windows-installers/*.exe
280+
artifacts/windows-installers/checksums-windows.txt
281+
draft: false
282+
prerelease: false
283+
generate_release_notes: true
284+
body: |
285+
## Installation
286+
287+
### macOS
288+
1. Download `Kide_*.dmg`
289+
2. Open the DMG and drag Kide to Applications
290+
3. Right-click Kide and select "Open" on first launch
291+
4. Verify: `codesign -dv --verbose=4 /Applications/Kide.app`
292+
293+
### Linux
294+
- **Debian/Ubuntu**: Download and install `.deb` file
295+
- **Other distros**: Download `.AppImage` file and make executable
296+
297+
### Windows
298+
- Download and run `.msi` installer
299+
300+
## Verification
301+
302+
All releases include SHA-256 checksums. Verify your download:
303+
304+
```bash
305+
# macOS/Linux
306+
shasum -a 256 -c checksums-*.txt
307+
308+
# Windows (PowerShell)
309+
Get-FileHash Kide_*.msi -Algorithm SHA256
310+
```
311+
312+
## Security
313+
314+
- macOS app is code-signed and notarized by Apple
315+
- All builds are reproducible from source
316+
- See [SECURITY.md](https://github.com/${{ github.repository }}/blob/main/SECURITY.md)
317+
env:
318+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)