electron-builder.yml

# Packaging for the release workflow. electron-vite compiles main, preload, and
# renderer into out/; this only wraps that output into a macOS app.
# Moved with the product rename, deliberately and once. An appId identifies an
# installed application: anyone already on 0.2.0 keeps the OpenVideo install and
# is not offered this as an update, because to their machine it is a different
# app. That break is the cost of the rename and is stated in the release notes
# rather than discovered.
appId: tech.theorvane.openscene
productName: OpenScene
copyright: Open source under the MIT License
# Declared so electron-builder generates the latest*.yml update manifests the
# in-app updater reads. The release workflow uploads the artifacts itself with
# `--publish never`, so nothing is pushed from a packaging run.
publish:
  provider: github
  owner: Theorvane
  repo: openvideo
directories:
  output: dist
  buildResources: build
files:
  - out/**
  - package.json
extraResources:
  # The window icon is read from resources/ at runtime on platforms that take one.
  - from: resources/icon.png
    to: icon.png
  # OpenCut editor source is compiled into out/; ship its MIT text beside the
  # inventory so redistributed desktop packages retain the upstream notice.
  - from: THIRD_PARTY_NOTICES.md
    to: THIRD_PARTY_NOTICES.md
  - from: external/opencut/LICENSE
    to: licenses/OpenCut-LICENSE.txt
mac:
  category: public.app-category.video
  icon: build/icon.png
  target:
    - target: dmg
      arch: [arm64, x64]
    - target: zip
      arch: [arm64, x64]
  # Developer ID distribution requires the hardened runtime, and Electron will
  # not launch under it without the JIT and library-validation entitlements.
  hardenedRuntime: true
  entitlements: build/entitlements.mac.plist
  entitlementsInherit: build/entitlements.mac.plist
  # A Developer ID signature alone still trips Gatekeeper with "Apple cannot
  # check it for malicious software"; only notarization clears it. Driven by
  # APPLE_ID / APPLE_APP_SPECIFIC_PASSWORD / APPLE_TEAM_ID in the release job.
  notarize: true
win:
  icon: build/icon.png
  # No code-signing certificate either, so Windows SmartScreen warns on first run.
  #
  # Said here as well as in the release workflow because it is a fact about the
  # build, not about the runner: the certificate is handed to the macOS leg
  # alone. It was once given to every leg, which signed this installer with the
  # Apple Developer ID — a signature Windows cannot chain to a trusted root.
  #
  # And with no signature there must be no signature check. A signed build
  # writes the certificate's subject into `app-update.yml` as the publisher
  # name, and `electron-updater` then refuses any installer that does not match
  # it. Unsigned, the check has nothing to compare against and would refuse
  # every update. Delete this line the day a real Windows certificate exists,
  # not before.
  verifyUpdateCodeSignature: false
  target:
    - target: nsis
      arch: [x64]
    - target: zip
      arch: [x64]
deb:
  packageName: openscene
nsis:
  oneClick: false
  allowToChangeInstallationDirectory: true
  # Named without spaces, or Windows cannot update itself.
  #
  # The default is `${productName} Setup ${version}.${ext}`, which produces
  # `OpenScene Setup 0.4.0.exe`. Two things then disagree about that file:
  # electron-builder writes the URL into `latest.yml` with the spaces replaced by
  # hyphens, while GitHub replaces them with dots when the asset is uploaded. The
  # updater reads the manifest, asks for the hyphenated name, and gets a 404 —
  # which is how every Windows release since the first one has behaved.
  #
  # electron-builder's own GitHub publisher reconciles the two; this repository
  # uploads with `gh release upload`, which does not. Removing the spaces removes
  # the disagreement rather than papering over either side of it.
  artifactName: OpenScene-Setup-${version}.${ext}
linux:
  icon: build/icon.png
  # The deb package name, the binary, and the artifact filename all default to
  # package.json's `name`, so an install reads video-window-recorder while
  # everything the user sees says OpenScene. executableName fixes the binary and
  # the desktop entry; artifactName and the deb package name are set separately
  # because electron-builder derives neither from it.
  executableName: openscene
  artifactName: openscene-${version}-${arch}.${ext}
  category: AudioVideo
  target:
    - target: AppImage
      arch: [x64]
    - target: deb
      arch: [x64]