Merge branch 'develop' into renovate/apple-actions-import-codesign-certs-5.x

.github/FUNDING.yml

@@ -1,4 +1,4 @@
 # These are supported funding model platforms
 
-github: [zadam]
-custom: ["https://paypal.me/za4am"]
+github: [eliandoran]
+custom: ["https://paypal.me/eliandoran"]

.github/actions/build-electron/action.yml

@@ -84,10 +84,7 @@ runs:
         APPLE_ID_PASSWORD: ${{ env.APPLE_ID_PASSWORD }}
         WINDOWS_SIGN_EXECUTABLE: ${{ env.WINDOWS_SIGN_EXECUTABLE }}
         TRILIUM_ARTIFACT_NAME_HINT: TriliumNextNotes-${{ github.ref_name }}-${{ inputs.os }}-${{ inputs.arch }}
-      run: |
-        npm run electron-forge:make -- \
-          --arch=${{ inputs.arch }} \
-          --platform=${{ inputs.forge_platform }}
+      run: npm run electron-forge:make -- --arch=${{ inputs.arch }} --platform=${{ inputs.forge_platform }}
 
     # Add DMG signing step
     - name: Sign DMG
@@ -115,6 +112,16 @@ runs:
           xcrun notarytool submit "$dmg_file" --apple-id "$APPLE_ID" --password "$APPLE_ID_PASSWORD" --team-id "$APPLE_TEAM_ID" --wait
           # Staple the notarization ticket
           xcrun stapler staple "$dmg_file"
+        else
+          echo "No DMG found to sign"
+          fi
+          echo "Using signing identity: $SIGNING_IDENTITY"
+          # Sign the DMG
+          codesign --force --sign "$SIGNING_IDENTITY" --options runtime --timestamp "$dmg_file"
+          # Notarize the DMG
+          xcrun notarytool submit "$dmg_file" --apple-id "$APPLE_ID" --password "$APPLE_ID_PASSWORD" --team-id "$APPLE_TEAM_ID" --wait
+          # Staple the notarization ticket
+          xcrun stapler staple "$dmg_file"
         else
           echo "No DMG found to sign"
         fi

.github/actions/build-server/action.yml

@@ -28,4 +28,5 @@ runs:
       run: |
         mkdir -p upload
         file=$(find dist -name '*.tar.xz' -print -quit)
-        cp "$file" "upload/TriliumNextNotes-Server-${{ github.ref_name }}-${{ inputs.os }}-${{ inputs.arch }}.tar.xz"
+        name=${{ github.ref_name }}
+        cp "$file" "upload/TriliumNextNotes-Server-${name//\//-}-${{ inputs.os }}-${{ inputs.arch }}.tar.xz"

.github/actions/report-size/action.yml

@@ -0,0 +1,79 @@
+name: 'Bundle size reporter'
+description: 'Post bundle size difference compared to another branch'
+inputs:
+  branch:
+    description: 'Branch to compare to'
+    required: true
+    default: 'main'
+  paths:
+    description:
+      'Paths to json file bundle size report or folder containing bundles'
+    required: true
+    default: '/'
+  onlyDiff:
+    description: 'Report only different sizes'
+    required: false
+    default: 'false'
+  filter:
+    description: 'Regex filter based on file path'
+    required: false
+  unit:
+    description: 'Size unit'
+    required: false
+    default: 'KB'
+
+  # Comment inputs
+  comment:
+    description: 'Post comment'
+    required: false
+    default: 'true'
+  header:
+    description: 'Comment header'
+    required: false
+    default: 'Bundle size report'
+  append:
+    description: 'Append comment'
+    required: false
+    default: 'false'
+  ghToken:
+    description: 'Github token'
+    required: false
+
+runs:
+  using: 'composite'
+  steps:
+    # Checkout branch to compare to [required]
+    - name: Checkout base branch
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.branch }}
+        path: br-base
+        token: ${{ inputs.ghToken }}
+
+    # Generate the bundle size difference report [required]
+    - name: Generate report
+      id: bundleSize
+      uses: nejcm/bundle-size-reporter-action@v1.4.1
+      with:
+        paths: ${{ inputs.paths }}
+        onlyDiff: ${{ inputs.onlyDiff }}
+        filter: ${{ inputs.filter }}
+        unit: ${{ inputs.unit }}
+
+    # Post github action summary
+    - name: Post summary
+      if: ${{ steps.bundleSize.outputs.hasDifferences == 'true' }} # post only in case of changes
+      run: |
+        echo '${{ steps.bundleSize.outputs.summary }}' >> $GITHUB_STEP_SUMMARY
+      shell: bash
+
+    # Post github action comment
+    - name: Post comment
+      uses: marocchino/sticky-pull-request-comment@v2
+      if: ${{ steps.bundleSize.outputs.hasDifferences == 'true' }} # post only in case of changes
+      with:
+        number: ${{ github.event.pull_request.number }}
+        header: ${{ inputs.header }}
+        append: ${{ inputs.append }}
+        message: '${{ steps.bundleSize.outputs.summary }}'
+        GITHUB_TOKEN: ${{ inputs.ghToken }}

.github/workflows/codeql.yml

@@ -0,0 +1,100 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL Advanced"
+
+on:
+  push:
+    branches: [ "develop" ]
+  pull_request:
+    branches: [ "develop" ]
+  schedule:
+    - cron: '20 7 * * 0'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    # Runner size impacts CodeQL analysis time. To learn more, please see:
+    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
+    #   - https://gh.io/supported-runners-and-hardware-resources
+    #   - https://gh.io/using-larger-runners (GitHub.com only)
+    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    permissions:
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: actions
+          build-mode: none
+        - language: javascript-typescript
+          build-mode: none
+        # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
+        # Use `c-cpp` to analyze code written in C, C++ or both
+        # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
+        # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
+        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
+        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
+        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
+        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    # Add any setup steps before running the `github/codeql-action/init` action.
+    # This includes steps like installing compilers or runtimes (`actions/setup-node`
+    # or others). This is typically only required for manual builds.
+    # - name: Setup runtime (example)
+    #   uses: actions/setup-example@v1
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+
+    # If the analyze step fails for one of the languages you are analyzing with
+    # "We were unable to automatically build your code", modify the matrix above
+    # to set the build mode to "manual" for that language. Then modify this step
+    # to build your code.
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+    - if: matrix.build-mode == 'manual'
+      shell: bash
+      run: |
+        echo 'If you are using a "manual" build mode for one or more of the' \
+          'languages you are analyzing, replace this with the commands to build' \
+          'your code, for example:'
+        echo '  make bootstrap'
+        echo '  make release'
+        exit 1
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/dev.yml

@@ -15,7 +15,73 @@ env:
   IMAGE_NAME: ${{ github.repository_owner }}/notes
   TEST_TAG: ${{ github.repository_owner }}/notes:test
 
+permissions:
+  pull-requests: write  # for PR comments
+
 jobs:
+  report-electron-size:
+    name: Report Electron size
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout the repository
+        uses: actions/checkout@v4
+
+      - name: Set up node & dependencies
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: "npm"
+
+      - run: npm ci
+
+      - name: Run the build
+        uses: ./.github/actions/build-electron
+        with:
+          os: linux
+          arch: x64
+          shell: bash
+          forge_platform: linux
+
+      - name: Run the Electron size report
+        uses: ./.github/actions/report-size
+        with:
+          paths: 'upload/**/*'
+          onlyDiff: 'true'
+          branch: 'develop'
+          header: 'Electron size report'
+          unit: "MB"
+          ghToken: ${{ secrets.GITHUB_TOKEN }}
+  report-server-size:
+    name: Report server size
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout the repository
+        uses: actions/checkout@v4
+
+      - name: Set up node & dependencies
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: "npm"
+
+      - run: npm ci
+
+      - name: Run the build
+        uses: ./.github/actions/build-server
+        with:
+          os: linux
+          arch: x64
+
+      - name: Run the server size report
+        uses: ./.github/actions/report-size
+        with:
+          paths: 'upload/**/*'
+          onlyDiff: 'true'
+          branch: 'develop'
+          header: 'Server size report'
+          unit: "MB"
+          ghToken: ${{ secrets.GITHUB_TOKEN }}
+
   test_dev:
     name: Test development
     runs-on: ubuntu-latest
@@ -44,6 +110,10 @@ jobs:
       - test_dev
     steps:
       - uses: actions/checkout@v4
+      - name: Install dependencies
+        run: npm ci
+      - name: Update build info
+        run: npm run chore:update-build-info
       - uses: docker/setup-buildx-action@v3
       - uses: docker/build-push-action@v6
         with:
@@ -64,6 +134,12 @@ jobs:
       - name: Checkout the repository
         uses: actions/checkout@v4
 
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Update build info
+        run: npm run chore:update-build-info
+
       - name: Set IMAGE_NAME to lowercase
         run: echo "IMAGE_NAME=${IMAGE_NAME,,}" >> $GITHUB_ENV
       - name: Set TEST_TAG to lowercase

.github/workflows/main-docker.yml

@@ -131,6 +131,13 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Update build info
+        run: npm run chore:update-build-info
+
       - name: Docker meta
         id: meta
         uses: docker/metadata-action@v5

.github/workflows/nightly.yml

@@ -11,6 +11,7 @@ on:
   pull_request:
     paths:
       - .github/actions/build-electron/*
+      - forge.config.cjs
 env:
   GITHUB_UPLOAD_URL: https://uploads.github.com/repos/TriliumNext/Notes/releases/179589950/assets{?name,label}
   GITHUB_RELEASE_ID: 179589950
@@ -82,3 +83,36 @@ jobs:
         with:
           name: TriliumNextNotes ${{ matrix.os.name }} ${{ matrix.arch }}
           path: upload
+
+  nightly-server:
+    name: Deploy server nightly
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: [x64, arm64]
+        include:
+          - arch: x64
+            runs-on: ubuntu-latest
+          - arch: arm64
+            runs-on: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runs-on }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run the build
+        uses: ./.github/actions/build-server
+        with:
+          os: linux
+          arch: ${{ matrix.arch }}
+
+      - name: Publish release
+        uses: softprops/action-gh-release@v2
+        if: ${{ github.event_name != 'pull_request' }}
+        with:
+          make_latest: false
+          prerelease: true
+          draft: false
+          fail_on_unmatched_files: true
+          files: upload/*.*
+          tag_name: nightly
+          name: Nightly Build

.github/workflows/release-winget.yml

@@ -0,0 +1,20 @@
+name: Release to winget
+on:
+  release:
+    types: [ published ]
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: 'Git tag to release from'
+        type: string
+        required: true
+jobs:
+  release-winget:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Publish to WinGet
+        uses: vedantmgoyal9/winget-releaser@main
+        with:
+          identifier: TriliumNext.Notes
+          token: ${{ secrets.token }}
+          release-tag:  ${{ github.event.inputs.release_tag || github.event.release.tag_name }}

.github/workflows/release.yml

@@ -3,7 +3,6 @@ on:
   push:
     tags:
       - "v*"
-  workflow_dispatch:
 permissions:
   contents: write
 concurrency:
@@ -54,14 +53,13 @@ jobs:
           APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
           WINDOWS_SIGN_EXECUTABLE: ${{ vars.WINDOWS_SIGN_EXECUTABLE }}
 
-      - name: Publish release
-        uses: softprops/action-gh-release@v2
+      - name: Upload the artifact
+        uses: actions/upload-artifact@v4
         with:
-          draft: true
-          fail_on_unmatched_files: true
-          files: upload/*.*
+          name: release-desktop-${{ matrix.os.name }}-${{ matrix.arch }}
+          path: upload/*.*
 
-  build_linux_server-x64:
+  build_server:
     name: Build Linux Server
     strategy:
       fail-fast: false
@@ -82,9 +80,37 @@ jobs:
           os: linux
           arch: ${{ matrix.arch }}
 
+      - name: Upload the artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-server-linux-${{ matrix.arch }}
+          path: upload/*.*
+
+  publish_release:
+    name: Publish release
+    runs-on: ubuntu-latest
+    needs:
+      - make-electron
+      - build_server
+    steps:
+      - run: mkdir upload
+
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            docs/Release Notes
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          merge-multiple: true
+          pattern: release-*
+          path: upload
+
       - name: Publish release
         uses: softprops/action-gh-release@v2
         with:
-          draft: true
+          draft: false
+          body_path: docs/Release Notes/Release Notes/${{ github.ref_name }}.md
           fail_on_unmatched_files: true
           files: upload/*.*