Skip to content

Packaging

Packaging happens centrally on CI: a tag push triggers .github/workflows/release.yml, which builds all three platforms and uploads the artifacts to a GitHub Release.

Local packaging (no publish)

The root package provides per-platform helpers. Each one cleans dist, rebuilds the extension and the app in production mode, and invokes electron-builder with --publish never:

yarn package:win       # NSIS installer + portable, per current Windows host
yarn package:linux     # AppImage + rpm + deb, per current Linux host
yarn package:mac       # dmg + zip, per current macOS host

Electron Builder cannot cross-compile installers: Windows builds must run on Windows, Linux on Linux, and macOS on macOS.

For a fast artifacts-less smoke check:

yarn package:preview   # produces dist/win-unpacked (unpacked app dir)

What actually gets built

From applications/electron/electron-builder.yml:

Platform Targets Artifacts
Windows nsis, portable Notepadia-<version>-x64.exe, Notepadia-<version>-x64-portable.exe
macOS dmg, zip Notepadia-<version>-<arch>.dmg, .zip (<arch> = arm64 on Apple-Silicon runners, x64 on Intel)
Linux AppImage, rpm, deb Notepadia-<version>-x86_64.AppImage, .rpm, .deb

npmRebuild: false — native addons are already rebuilt for the Electron ABI by theia rebuild:electron before electron-builder runs. See Development for the node-pty/Spectre caveat.

Installers and auto-update

  • Windows installers use an assisted (per-user) NSIS installer with a fixed install directory: electron-updater can only apply updates to the default location, so users are not offered a custom directory.
  • Installed apps poll GitHub Releases (publish.provider: github); the contract is described in Releases & updates.

Native dependencies

Rebuilding native modules for Electron requires a full C++ toolchain on the host running the build:

  • Windows: Visual Studio with the Desktop development with C++ workload (this is what node-pty's conpty targets need).
  • Linux: build-essential, python3, make, g++.
  • macOS: Xcode Command Line Tools.

In CI the runners already provide these. GitHub hosts which do not include the Spectre-mitigated MSVC libraries cannot rebuild node-pty from source (hence a rebuild list that omits it).

macOS: signing, notarization and file associations

The macOS artifacts are built unsigned by default because the project has no Apple Developer ID credentials. Everything is wired so the day the credentials exist, signing and notarization turn on automatically with no workflow change needed:

  • CSC_IDENTITY_AUTO_DISCOVERY is computed by CI: it is true only on the macOS job and when the CSC_LINK secret is populated.
  • electron-builder signs when CSC_LINK/CSC_KEY_PASSWORD are set and runs Apple notarization when APPLE_ID, APPLE_APP_SPECIFIC_PASSWORD and APPLE_TEAM_ID are set (mac.notarize: true in electron-builder.yml); with none of them present it simply skips (safe, non-fatal).
  • The hardened runtime and entitlements plists are already configured (they are valid and harmless on unsigned builds and required once signing starts).
  • macOS file associations are declared via mac.fileAssociations, which electron-builder renders as CFBundleDocumentTypes in Notepadia.app/Contents/Info.plist — the same 22 text/source extensions as Windows and Linux.
  • Every macOS build is verified inside the release workflow (there is no local Mac): plutil lints the Info.plist, every associated extension is asserted present, and the DMG is checked with hdiutil imageinfo. When the signing secrets are configured the step additionally asserts codesign --verify --deep --strict and Gatekeeper spctl -a -vv.

To enable a signed, notarized release, add these GitHub Secrets (see the release docs) and just re-run the workflow: CSC_LINK, CSC_KEY_PASSWORD, APPLE_ID, APPLE_APP_SPECIFIC_PASSWORD, APPLE_TEAM_ID.

Release integrity (checksums)

Every release artifact gets a companion *.sha256 checksum generated by the release workflow and uploaded next to the installer (both as a workflow attachment and onto the GitHub Release). Users can verify a download with:

shasum -a 256 -c Notepadia-<version>-<arch>.dmg.sha256