Switch to .pkg/.exe/.deb installers with Azure Trusted Signing

Replaces the zip-based ci/build.sh flow with installer outputs (Inno Setup
on Windows, productbuild on macOS, cpack DEB on Linux) signed via Microsoft
Trusted Signing on Windows and Apple Developer ID on macOS.

Plugin code: factory wavetables and presets now ship as files via the
installer rather than embedded BinaryData. PluginProcessor implements
getProgramDirectory/getFactoryProgramDirectories so gin scans factory
content from systemResourceRoot. First-run migration copies any presets
from the legacy com.socalabs/Wavetable/programs path into the new user
dir under Library/Audio/Presets/SocaLabs/Wavetable.

Bumps gin submodule to match Identity for getFactoryProgramDirectories
support.
This commit is contained in:
Roland Rabien 2026-04-29 13:23:23 -07:00
commit 130e626ea6
21 changed files with 879 additions and 262 deletions

View file

@ -3,7 +3,7 @@ on:
push:
branches:
- '**'
concurrency:
group: build-${{ github.ref || github.run_id }}
@ -11,33 +11,58 @@ jobs:
build:
name: Build
runs-on: ${{ matrix.os }}
timeout-minutes: 30
timeout-minutes: 60
strategy:
fail-fast: false
matrix:
include:
- name: Windows
os: [windows-latest]
os: windows-latest
- name: Linux
os: [ubuntu-latest]
os: ubuntu-latest
- name: macOS
os: [macos-latest]
os: macos-latest
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
- name: "Run script"
- name: Install Linux dependencies
if: matrix.name == 'Linux'
run: |
./ci/build.sh
sudo apt-get update
sudo apt-get install -y --no-install-recommends \
ninja-build clang g++ \
libasound2-dev libjack-jackd2-dev ladspa-sdk libcurl4-openssl-dev \
libfreetype-dev libfontconfig1-dev \
libx11-dev libxcomposite-dev libxcursor-dev libxext-dev \
libxinerama-dev libxrandr-dev libxrender-dev \
libwebkit2gtk-4.1-dev libglu1-mesa-dev mesa-common-dev
shell: bash
- name: Install Inno Setup (Windows)
if: matrix.name == 'Windows'
run: choco install innosetup --no-progress -y
shell: bash
- name: Build installer
run: ./Installer/build.sh
shell: bash
env:
# macOS signing / notarization
APPLICATION: ${{ secrets.APPLICATION }}
INSTALLER: ${{ secrets.INSTALLER }}
APPLE_PASS: ${{ secrets.APPLE_PASS }}
APPLE_USER: ${{ secrets.APPLE_USER }}
APIKEY: ${{ secrets.APIKEY }}
INSTALLER: ${{ secrets.INSTALLER }}
APPLE_USER: ${{ secrets.APPLE_USER }}
APPLE_PASS: ${{ secrets.APPLE_PASS }}
# Windows Trusted Signing (Azure)
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
- name: Upload Artifact
uses: actions/upload-artifact@v4
if: always()
with:
name: Binaries ${{ matrix.name }}
path: ci/bin/*.zip
retention-days: 30
path: bin/*
retention-days: 30

View file

@ -8,45 +8,58 @@ jobs:
build:
name: Build
runs-on: ${{ matrix.os }}
timeout-minutes: 30
timeout-minutes: 60
strategy:
fail-fast: false
matrix:
include:
- name: Windows
os: [windows-latest]
os: windows-latest
- name: Linux
os: [ubuntu-latest]
os: ubuntu-latest
- name: macOS
os: [macos-latest]
os: macos-latest
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
- name: "Build"
- name: Install Linux dependencies
if: matrix.name == 'Linux'
run: |
./ci/build.sh
sudo apt-get update
sudo apt-get install -y --no-install-recommends \
ninja-build clang g++ \
libasound2-dev libjack-jackd2-dev ladspa-sdk libcurl4-openssl-dev \
libfreetype-dev libfontconfig1-dev \
libx11-dev libxcomposite-dev libxcursor-dev libxext-dev \
libxinerama-dev libxrandr-dev libxrender-dev \
libwebkit2gtk-4.1-dev libglu1-mesa-dev mesa-common-dev
shell: bash
- name: Install Inno Setup (Windows)
if: matrix.name == 'Windows'
run: choco install innosetup --no-progress -y
shell: bash
- name: Build installer
run: ./Installer/build.sh
shell: bash
env:
APPLICATION: ${{ secrets.APPLICATION }}
INSTALLER: ${{ secrets.INSTALLER }}
APPLE_PASS: ${{ secrets.APPLE_PASS }}
APPLE_USER: ${{ secrets.APPLE_USER }}
APIKEY: ${{ secrets.APIKEY }}
- name: "Upload"
run: |
./ci/upload.sh
shell: bash
env:
APPLICATION: ${{ secrets.APPLICATION }}
INSTALLER: ${{ secrets.INSTALLER }}
APPLE_PASS: ${{ secrets.APPLE_PASS }}
APPLE_USER: ${{ secrets.APPLE_USER }}
APIKEY: ${{ secrets.APIKEY }}
INSTALLER: ${{ secrets.INSTALLER }}
APPLE_USER: ${{ secrets.APPLE_USER }}
APPLE_PASS: ${{ secrets.APPLE_PASS }}
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
- name: Upload Artifact
uses: actions/upload-artifact@v4
if: always()
with:
name: Binaries ${{ matrix.name }}
path: ci/bin/*.zip
path: bin/*
retention-days: 30
release:
@ -54,7 +67,6 @@ jobs:
needs: build
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- uses: actions/checkout@v4
- name: Download Artifacts
@ -64,3 +76,4 @@ jobs:
shell: bash
env:
GH_TOKEN: ${{ secrets.ACCESS_TOKEN }}
APIKEY: ${{ secrets.APIKEY }}