Merge pull request #722 from ooni/desktop-cd

Desktop CD workflow

Author: sdsantos

.github/workflows/desktop_make.yml

@@ -0,0 +1,34 @@
+name: Desktop package apps
+on: workflow_dispatch
+
+jobs:
+  package:
+    name: Package desktop apps
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      - name: Package app
+        run: ./gradlew copyBrandingToCommonResources package -Porganization=ooni
+
+      - name: Conveyor make site
+        uses: hydraulic-software/conveyor/actions/build@v18.0
+        env:
+          APPLE_ASP: ${{ secrets.APPLE_ASP }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+        with:
+          command: make site
+          signing_key: ${{ secrets.CONVEYOR_SIGNING_KEY }}
+          extra_flags: -f ci.conveyor.conf
+          agree_to_license: 1
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: desktopApps
+          path: output

certificates/apple.cer

@@ -0,0 +1,12 @@
+include required("conveyor.conf")
+
+app {
+    mac {
+        certificate = "certificates/apple.cer"
+        notarization {
+            app-specific-password = ${env.APPLE_ASP}
+            team-id = ${env.APPLE_TEAM_ID}
+            apple-id = ${env.APPLE_ID}
+        }
+    }
+}

ci.conveyor.conf

@@ -2,25 +2,27 @@ include "#!./gradlew -q composeApp:printConveyorConfig"
 
 // Config file documentation: https://conveyor.hydraulic.dev/latest/configs
 app {
-  vcs-url = "github.com/ooni/probe-multiplatform"
+    vcs-url = "github.com/ooni/probe-multiplatform"
 
-  // This is optional. If not specified the last component of the rdns name will be turned into a display name.
-  display-name = "OONI Probe"
+    // This is optional. If not specified the last component of the rdns name will be turned into a display name.
+    display-name = "OONI Probe"
 
-  // A global identifier for the app.
-  rdns-name = "org.ooni.probe"
+    // A global identifier for the app.
+    rdns-name = "org.ooni.probe"
 
-  // For iteration speed. Remove for release.
-  compression-level = low
+    // For iteration speed. Remove for release.
+    compression-level = low
 
-  // Check for and apply updates synchronously on every app launch instead of in the background.
-  // updates = aggressive
+    // Check for and apply updates synchronously on every app launch instead of in the background.
+    // updates = aggressive
 
-  mac.info-plist.LSMinimumSystemVersion = "10.15.0"
+    mac.info-plist.LSMinimumSystemVersion = "10.15.0"
 
-  url-schemes = [ ooni ]
+    url-schemes = [ ooni ]
 
-  icons = "icons/app.svg"
+    icons = "icons/app.svg"
+
+    machines = ["windows.amd64", "mac"]
 }
 
 app.linux.desktop-file."Desktop Entry" {

conveyor.conf

@@ -77,52 +77,46 @@ press *Run Workflow*. Confirm both actions run successfully.
 
 Once the alpha versions have been approved for release, we can start publishing.
 
-#### 2.1 Tag & Create Release
+#### 2.1 Tag & Merge Release
 
-2.1.1 Tag the latest commit on the release branch:
+**2.1.1** Tag the latest commit on the release branch:
 
 ```
 git tag -s v[x.y.z] -f -m "[x.x.x] release"
 git push origin tag v[x.y.z]
 ```
 
-2.1.2 Merge the release branch PR into `main`, always through a merge commit! We don't want to lose
+**2.1.2** Merge the release branch PR into `main`, always through a merge commit! We don't want to lose
 our tagged commit.
 
-2.1.3 Create a new [Github release](https://github.com/ooni/probe-multiplatform/releases) based on
-the new tag and write the release notes.
-
-The new Github release should create new release on Sentry to help with error reporting, and publish
-an internal Slack message warning of the new incoming release.
-
 #### 2.2 Publish iOS Apps
 
 Go to [Publish iOS Apps](https://github.com/ooni/probe-multiplatform/actions/workflows/publish_ios.yml),
 press *Run Workflow*, use workflow from the new tag, pick both apps and press *Run Workflow*.
 Confirm both actions run successfully. The updates will be reviewed by Apple, so we need to keep an
 eye if they pass.
 
-#### 2.2 Publish OONI Probe Android on F-Droid
+#### 2.3 Publish OONI Probe Android on F-Droid
 
 By pushing a new tag on Github, F-Droid bots will check if our app `versionCode` was updated. Since
 it was, they will trigger a new build and release it automatically. It should take around 3 days for
 the new release to be available [here](https://f-droid.org/en/packages/org.openobservatory.ooniprobe/)
 but sometimes it can take more time.
 
-#### 2.3 Publish OONI Probe Android on Huawei AppGallery
+#### 2.4 Publish OONI Probe Android on Huawei AppGallery
 
 Go to [Publish OONI Probe on Huawei AppGallery](https://github.com/ooni/probe-multiplatform/actions/workflows/publish_android_on_huawei.yml),
 press *Run Workflow*, use workflow from the new tag and press *Run Workflow*. Confirm the action ran
 successfully.
 
-#### 2.4 Promote News Media Scan Android
+#### 2.5 Promote News Media Scan Android
 
 Go to [Promote Android on Google Play](https://github.com/ooni/probe-multiplatform/actions/workflows/promote_android_on_google_play.yml),
 press *Run Workflow*, pick the Organization `dw`, the Current Track
 `alpha`, the Promote Track `production` and press *Run Workflow*. Confirm the action ran
 successfully.
 
-#### 2.5 Promote OONI Probe Android
+#### 2.6 Promote OONI Probe Android
 
 Since this is our app with the biggest amount of users, we take more steps to release it. First we
 promote from `alpha` to `beta`, and then from `beta` to `production` with a `0.2` (20%) rollout
@@ -131,6 +125,34 @@ value.
 Both steps are done at [Promote Android on Google Play](https://github.com/ooni/probe-multiplatform/actions/workflows/promote_android_on_google_play.yml) like on the previous step, but with the
 Organization as `ooni`.
 
+#### 2.7 Publish OONI Probe Desktop
+
+#### 2.7.1 Generate apps
+
+Go to [Desktop package apps](https://github.com/ooni/probe-multiplatform/actions/workflows/desktop_make.yml),
+press *Run Workflow*, use workflow from the new tag, and press *Run Workflow*. Confirm the action ran
+successfully and download the generated apps (zipped artifact).
+
+#### 2.7.2 Sign windows app
+
+We need to sign both the windows `.exe` and `.msix` files using our Extended Validation certificate.
+Follow the steps on our internal process to do so.
+
+### 2.8 Create Release
+
+**2.8.1** Create a new [Github release](https://github.com/ooni/probe-multiplatform/releases)
+based on the new tag.
+
+**2.8.2** Write our manual release notes and add at the bottom the automatic changelog using the
+`Generate release notes` button.
+
+**2.8.3** Upload all the desktop files downloaded during step *2.7.1*, except the `download.html`
+file, and swapping the windows `.exe` and `.msix` files for their signed versions (step *2.7.2*).
+
+**2.8.4** Publish release
+
+The new Github release post an internal Slack message warning of the new incoming release.
+
 ## Monitoring
 
 We use Sentry to monitor for crashes and handled errors. We have specific views for: