devsyncwrld
9f7723d104
OpenSSF Scorecard / Scorecard analysis (push) Waiting to run
CI / Build & test (Node 20) (push) Canceled after 0s
CI / Build & test (Node 24) (push) Canceled after 0s
CI / Build & test (push) Canceled after 0s
CodeQL / Analyze (javascript-typescript) (push) Canceled after 0s
Security / Secret scan (gitleaks) (push) Canceled after 0s
Security / Dependency scan (OSV-Scanner) (push) Canceled after 0s
Security / IaC/config scan (Trivy) (push) Canceled after 0s
Security / License compliance scan (Trivy) (push) Canceled after 0s
GitHub stays the build machine — it has the Windows runners the native audio module needs — but the update feed moves to this fork's own Gitea. The GitHub repository is private, and electron-updater against a private GitHub repo needs a token inside the shipped app, which is a leaked token. Gitea serves release assets to anyone, so the installer carries no credential. The flow was verified end to end against the live instance before writing this: create release, upload asset, download anonymously. The release tag is fixed at 'latest' because electron-updater fetches latest.yml before it knows which version exists, so the URL cannot carry a version; CI replaces that release's assets each publish. electron-builder runs with --publish never since it cannot upload to Gitea, but still emits the latest.yml the updater reads. Needs a GITEA_TOKEN secret on the GitHub repository.
63 lines
2.2 KiB
YAML
63 lines
2.2 KiB
YAML
appId: com.backspace.desktop
|
|
productName: Backspace
|
|
artifactName: "${productName}-${version}-${arch}.${ext}"
|
|
directories:
|
|
output: dist-electron
|
|
files:
|
|
- dist/**/*
|
|
- resources/**/*
|
|
# Exclude host-compiled native module artifacts from the asar.
|
|
# electron-rebuild (postinstall) compiles uiohook-napi for the build machine,
|
|
# creating build/Release/*.node. node-gyp-build checks build/ BEFORE prebuilds/,
|
|
# so if these directories enter the asar, the app crashes on every platform
|
|
# (including the build platform after afterPack removes the unpacked file).
|
|
- "!**/node_modules/uiohook-napi/build/**"
|
|
- "!**/node_modules/uiohook-napi/build.bak/**"
|
|
- "!**/node_modules/uiohook-napi/bin/**"
|
|
# electron-native-screenshare has no prebuilds — build/Release/*.node is the
|
|
# only copy, so it must NOT be excluded the way uiohook-napi's is. asarUnpack
|
|
# below takes it out of the archive so the loader can find it.
|
|
asarUnpack:
|
|
- "**/*.node"
|
|
npmRebuild: false
|
|
afterPack: ./scripts/afterPack.js
|
|
publish:
|
|
# Updates are served from this fork's own Gitea, not from GitHub.
|
|
#
|
|
# GitHub is only the build machine — it has the Windows runners the native
|
|
# audio module needs. Its repository is private, and electron-updater against
|
|
# a private GitHub repo would need a token shipped inside the app, which is a
|
|
# leaked token. Gitea serves release assets to anyone, so no credential ends
|
|
# up in the installer.
|
|
#
|
|
# The tag is fixed at `latest` on purpose: electron-updater fetches
|
|
# latest.yml before it knows which version exists, so the URL cannot contain
|
|
# a version. CI replaces that release's assets on every publish.
|
|
- provider: generic
|
|
url: https://git.resenha.website/devsyncwrld/backspace/releases/download/latest/
|
|
protocols:
|
|
- name: Backspace
|
|
schemes:
|
|
- backspace
|
|
mac:
|
|
category: public.app-category.social-networking
|
|
minimumSystemVersion: "12.0"
|
|
extendInfo:
|
|
NSAudioCaptureUsageDescription: "Backspace needs access to system audio to share sound during screen sharing."
|
|
target:
|
|
- dmg
|
|
- zip
|
|
win:
|
|
icon: ./build/icon.ico
|
|
target:
|
|
- nsis
|
|
linux:
|
|
icon: build/icons/
|
|
target:
|
|
- AppImage
|
|
- deb
|
|
category: Network
|
|
nsis:
|
|
oneClick: false
|
|
allowToChangeInstallationDirectory: true
|