Upgrade Electron Build Pipeline + Windows Signing (#543)

- Adds Windows signing (via Azure Artifact Signing) instead of old
expired cert!
- Updates to native Windows build to use Artifact Signing, Instead of
old wine image
- Updates CI action and ruffle update to run on windows, update all
actions in buildapp
- Update to electron-builder 27 alpha to use Azure signing, builder
schema migration
- Fixes #146

.github/workflows/buildapp.yaml

@@ -8,26 +8,22 @@ jobs:
 
     strategy:
       matrix:
-        os: [macos-14, ubuntu-latest]
+        os: [macos-14, ubuntu-latest, windows-latest]
-        platform: [windows, linux]
-        exclude:
-          - os: macos-14
-            platform: windows
 
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
+
+      - name: Install Node.js, NPM and Yarn
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
 
       - name: Set up corepack
         run: corepack enable yarn
 
-      - name: Install Node.js, NPM and Yarn
-        uses: actions/setup-node@v6
-        with:
-          node-version: 22
-
       - name: Cache Dirs
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ~/.cache/electron
@@ -38,7 +34,8 @@ jobs:
       - name: Update Ruffle
         env:
             GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: node --run update-ruffle
+        run: ruffle/download-latest-ruffle.sh
+        shell: bash
 
       - name: Run Build
         env:
@@ -47,67 +44,20 @@ jobs:
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           CSC_LINK: ${{ secrets.CSC_LINK }}
           CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
-          WIN_CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
+          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-          WIN_CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
+          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
           PLATFORM: ${{ matrix.platform }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+        shell: bash
+
         run: |
+          if [ "$GITHUB_REF" == "refs/heads/main" ] || [ -f ./force_release ]; then
+            export BUILD_CMD="release"
+          else
+            export BUILD_CMD="dist"
+          fi
 
-              #if [ "$RUNNER_OS" != "Linux" ]; then
+          yarn install --immutable
-              #  sudo rm -Rf /Library/Developer/CommandLineTools/SDKs/*
+          yarn run $BUILD_CMD
-              #  sudo xcode-select -s "/Applications/Xcode_12.3.app"
-              #fi
-
-              if [ "$GITHUB_REF" == "refs/heads/main" ] || [ -f ./force_release ]; then
-                export BUILD_CMD="release"
-              else
-                export BUILD_CMD="dist"
-              fi
-
-              if [ "$RUNNER_OS" == "Linux" ]; then
-                if [ "$PLATFORM" == "linux" ]; then
-                  #mkdir -p plugins-linux;
-                  #pushd plugins-linux;
-                  #wget "https://s3.amazonaws.com/webrecorder-builds/flashplugin/libpepflashplayer.so";
-                  #popd;
-
-                  docker run --rm \
-                    -e CI=${CI} \
-                    -e GH_TOKEN=${GH_TOKEN} \
-                    -e BUILD_CMD=${BUILD_CMD} \
-                    -v ${PWD}:/project \
-                    -v ~/.cache/electron:/root/.cache/electron \
-                    -v ~/.cache/electron-builder:/root/.cache/electron-builder \
-                    electronuserland/builder:22-wine \
-                    /bin/bash -c "corepack enable yarn && yarn install --immutable && yarn run $BUILD_CMD --linux --x64"
-                else
-                  #mkdir -p plugins-win;
-                  #pushd plugins-win;
-                  #wget "https://s3.amazonaws.com/webrecorder-builds/flashplugin/pepflashplayer-x86_64.dll";
-                  #wget "https://s3.amazonaws.com/webrecorder-builds/flashplugin/pepflashplayer-x86.dll";
-                  #popd;
-
-                  docker run --rm \
-                    -e CI=${CI} \
-                    -e GH_TOKEN=${GH_TOKEN} \
-                    -e WIN_CSC_LINK=${WIN_CSC_LINK} \
-                    -e WIN_CSC_KEY_PASSWORD=${WIN_CSC_KEY_PASSWORD} \
-                    -e BUILD_CMD=${BUILD_CMD} \
-                    -v ${PWD}:/project \
-                    -v ~/.cache/electron:/root/.cache/electron \
-                    -v ~/.cache/electron-builder:/root/.cache/electron-builder \
-                    electronuserland/builder:22-wine \
-                    /bin/bash -c "corepack enable yarn && yarn install --immutable && yarn run $BUILD_CMD --win --x64 --ia32"
-                fi
-              else
-                #mkdir -p plugins-mac;
-                #pushd plugins-mac;
-                #wget "https://s3.amazonaws.com/webrecorder-builds/flashplugin/PepperFlashPlayer.plugin.zip";
-                #unzip PepperFlashPlayer.plugin.zip;
-                #rm PepperFlashPlayer.plugin.zip;
-                #popd;
-                yarn install --immutable
-                yarn run $BUILD_CMD
-              fi
-

package.json

@@ -1,7 +1,7 @@
 {
   "name": "replaywebpage",
   "productName": "ReplayWeb.page",
-  "version": "2.5.0-rc.3",
+  "version": "2.5.0-rc.4",
   "description": "Serverless Web Archive Replay",
   "repository": "https://github.com/webrecorder/replayweb.page",
   "homepage": "https://replayweb.page/",
@@ -54,7 +54,7 @@
     "copy-webpack-plugin": "^9.0.1",
     "css-loader": "^6.2.0",
     "electron": "^43.3.0",
-    "electron-builder": "^26.0.12",
+    "electron-builder": "^27.0.0-alpha.6",
     "electron-notarize": "^1.2.2",
     "eslint": "^8.56.0",
     "eslint-config-prettier": "^9.1.0",
@@ -105,7 +105,7 @@
     "pack-signed": "electron-builder",
     "dist": "yarn run build && yarn run pack",
     "dist-dev": "yarn run build-dev && yarn run pack",
-    "release": "yarn run build && electron-builder",
+    "release": "yarn run build && electron-builder --publish always",
     "lint": "eslint ./",
     "format": "prettier --write ./",
     "prepare": "husky install; yarn node scripts/build-if-not-git-repo.js"
@@ -113,7 +113,6 @@
   "build": {
     "afterSign": "build/notarize.js",
     "productName": "ReplayWeb.page",
-    "asar": true,
     "appId": "net.webrecorder.replaywebpage",
     "artifactName": "${productName}-${version}.${ext}",
     "extraMetadata": {
@@ -146,17 +145,21 @@
         }
       ],
       "notarize": false,
-      "hardenedRuntime": true,
-      "gatekeeperAssess": false,
-      "entitlements": "build/entitlements.mac.plist",
-      "entitlementsInherit": "build/entitlements.mac.plist",
       "electronLanguages": [
         "en"
       ],
       "extraResources": [
         "plugins-mac"
       ],
-      "singleArchFiles": "{dist/prebuilds,dist/prebuilds/**}"
+      "sign": {
+        "entitlements": "build/entitlements.mac.plist",
+        "entitlementsInherit": "build/entitlements.mac.plist",
+        "hardenedRuntime": true,
+        "gatekeeperAssess": false
+      },
+      "universal": {
+        "singleArchFiles": "{dist/prebuilds,dist/prebuilds/**}"
+      }
     },
     "linux": {
       "category": "Archiving;Utility;",
@@ -168,10 +171,19 @@
       ]
     },
     "win": {
-      "target": "nsis",
+      "target": [
+        "nsis"
+      ],
       "extraResources": [
         "plugins-win"
-      ]
+      ],
+      "sign": {
+        "type": "azure",
+        "endpoint": "https://wus2.codesigning.azure.net/",
+        "codeSigningAccountName": "webrecorder",
+        "certificateProfileName": "webrecorder",
+        "publisherName": "CN=Webrecorer Software LLC"
+      }
     },
     "directories": {
       "buildResources": "build",