Merge branch 'develop' into ios-tor

Author: mcginty

.github/actions/setup-env/action.yml

@@ -21,7 +21,7 @@ runs:
         node-version-file: ".nvmrc"
 
     - name: Set up Python 3.12
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       if: runner.os == 'macOS'
       with:
         python-version: 3.12
@@ -63,7 +63,7 @@ runs:
 
     - name: "Cache NPM dependencies"
       id: cache-nodemodules
-      uses: actions/cache@v3
+      uses: actions/cache@v5
       with:
         path: |
           node_modules

.github/secrets/GoogleService-Info.plist.gpg

@@ -3,11 +3,15 @@
 set -e
 
 gpg --quiet --batch --yes --decrypt --passphrase="$IOS_PROFILE_KEY" --output ./.github/secrets/match_AppStore_comquietmobile.mobileprovision ./.github/secrets/match_AppStore_comquietmobile.mobileprovision.gpg
+gpg --quiet --batch --yes --decrypt --passphrase="$IOS_NSE_PROFILE_KEY" --output ./.github/secrets/match_AppStore_comquietmobile_QuietNotificationServiceExtension.mobileprovision ./.github/secrets/match_AppStore_comquietmobile_QuietNotificationServiceExtension.mobileprovision.gpg
 gpg --quiet --batch --yes --decrypt --passphrase="$IOS_CERTIFICATE_KEY" --output ./.github/secrets/Certificates.p12 ./.github/secrets/Certificates.p12.gpg
+gpg --quiet --batch --yes --decrypt --passphrase="$IOS_FIREBASE_KEY" --output ./.github/secrets/GoogleService-Info.plist ./.github/secrets/GoogleService-Info.plist.gpg
 
 mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
 
 cp ./.github/secrets/match_AppStore_comquietmobile.mobileprovision ~/Library/MobileDevice/Provisioning\ Profiles/762df280-302c-4336-a56d-c74914169337.mobileprovision
+cp ./.github/secrets/match_AppStore_comquietmobile_QuietNotificationServiceExtension.mobileprovision ~/Library/MobileDevice/Provisioning\ Profiles/247b3945-4f28-4ef1-b722-e98fb3fb59f7.mobileprovision
+cp ./.github/secrets/GoogleService-Info.plist ./packages/mobile/ios/GoogleService-Info.plist
 
 security create-keychain -p "" build.keychain
 security import ./.github/secrets/Certificates.p12 -t agg -k ~/Library/Keychains/build.keychain -P "$IOS_CERTIFICATE_KEY" -A

.github/secrets/decrypt_secrets.sh

@@ -12,7 +12,7 @@ jobs:
         os: [ubuntu-22.04, macos-latest, windows-latest]
 
     steps:
-      - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@v4
         id: filter
         with:
           filters: |
@@ -29,7 +29,7 @@ jobs:
         if: steps.filter.outputs.backend == 'true'
         run: echo ${{ matrix.os }}
 
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@v5
         if: steps.filter.outputs.backend == 'true'
         with:
           submodules: 'recursive'
@@ -52,7 +52,7 @@ jobs:
         os: [ubuntu-22.04]
 
     steps:
-      - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@v4
         id: filter
         with:
           filters: |
@@ -68,7 +68,7 @@ jobs:
         if: steps.filter.outputs.backend == 'true'
         run: echo ${{ matrix.os }}
 
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@v5
         if: steps.filter.outputs.backend == 'true'
         with:
           submodules: 'recursive'
@@ -91,7 +91,7 @@ jobs:
         os: [ubuntu-22.04]
 
     steps:
-      - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@v4
         id: filter
         with:
           filters: |
@@ -107,7 +107,7 @@ jobs:
         if: steps.filter.outputs.backend == 'true'
         run: echo ${{ matrix.os }}
 
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@v5
         if: steps.filter.outputs.backend == 'true'
         with:
           submodules: 'recursive'

.github/secrets/match_AppStore_comquietmobile_QuietNotificationServiceExtension.mobileprovision.gpg

@@ -12,7 +12,7 @@ jobs:
         os: [ubuntu-22.04]
 
     steps:
-      - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@v4
         id: filter
         with:
           filters: |
@@ -28,7 +28,7 @@ jobs:
         if: steps.filter.outputs.desktop == 'true'
         run: echo ${{ matrix.os }}
 
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@v5
         if: steps.filter.outputs.desktop == 'true'
         with:
           fetch-depth: 0 # Required to retrieve git history

.github/workflows/backend-tests.yml

@@ -16,7 +16,7 @@ jobs:
       - name: "Print OS"
         run: echo ${{ matrix.os }}
 
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@v5
         with:
           submodules: 'recursive'
 

.github/workflows/check-desktop-visual-regression.yml

@@ -41,7 +41,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+        uses: actions/checkout@v5
         with:
           submodules: 'recursive'
 

.github/workflows/check.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+        uses: actions/checkout@v5
         with:
           submodules: 'recursive'
 

.github/workflows/codeql.yml

@@ -19,11 +19,16 @@ jobs:
             source_path: linux
             build_cmd: "--linux AppImage"
             artifact_glob: "packages/desktop/dist/*.AppImage"
-          - os: macos-15-intel
+          - os: macos-26-intel
             target: macos
             source_path: darwin
             build_cmd: "--mac"
             artifact_glob: "packages/desktop/dist/*.dmg"
+          - os: macos-latest
+            target: macos-arm
+            source_path: darwin
+            build_cmd: "--mac --arm64"
+            artifact_glob: "packages/desktop/dist/*.dmg"
           - os: windows-latest
             target: win
             source_path: win32
@@ -35,7 +40,7 @@ jobs:
       TEST_MODE: true
       IS_LOCAL: true
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
+      - uses: actions/checkout@v5
         with:
           submodules: recursive
 
@@ -99,7 +104,7 @@ jobs:
       startsWith(github.ref, 'refs/tags/@quiet/desktop')
 
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@v5
         with:
           submodules: 'recursive'
 
@@ -145,7 +150,7 @@ jobs:
       CHECKSUM_PATH: ${{ github.event.action == 'released' && 'packages/desktop/dist/latest-linux.yml' || 'packages/desktop/dist/alpha-linux.yml' }}
 
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@v5
         with:
           submodules: 'recursive'
 
@@ -218,7 +223,7 @@ jobs:
 
   build-macos-prod:
     # needs: run-e2e-tests-mac
-    runs-on: macos-15-intel
+    runs-on: macos-26-intel
     if: |
       startsWith(github.ref, 'refs/tags/@quiet/desktop')
 
@@ -227,7 +232,7 @@ jobs:
       S3_BUCKET: ${{ github.event.action == 'released' && 'quiet.7.x' || 'test.quiet' }}
 
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@v5
         with:
           submodules: 'recursive'
 
@@ -296,6 +301,86 @@ jobs:
           version: ${{ steps.extract_version.outputs.version }}
           status: ${{ job.status }}
           slack_oauth_token: ${{ secrets.SLACK_BOT_OAUTH_TOKEN }}
+  
+  build-macos-arm64-prod:
+    runs-on: macos-26
+    if: |
+      startsWith(github.ref, 'refs/tags/@quiet/desktop')
+
+    env:
+      TEST_MODE: ${{ github.event.action == 'prereleased' }}
+      S3_BUCKET: ${{ github.event.action == 'released' && 'quiet.7.x' || 'test.quiet' }}
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          submodules: 'recursive'
+
+      - name: Extract version
+        id: extract_version
+        uses: Saionaro/extract-package-version@fdb5b74adc1278ddb777dfed4c988b9d098bb48d # v1.2.1
+        with:
+          path: packages/desktop
+
+      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
+        with:
+          toolchain: stable
+          components: clippy
+          override: true
+
+      - name: Setup environment
+        uses: ./.github/actions/setup-env
+        with:
+          bootstrap-packages: "@quiet/eslint-config,@quiet/logger,@quiet/common,@quiet/types,@quiet/state-manager,@quiet/backend,@quiet/identity,@quiet/desktop,backend-bundle,helia,@quiet/node-common"
+
+      - name: Before build
+        uses: ./.github/actions/before-build
+        with:
+          source-path: darwin
+
+      - name: "Remove crud files"
+        run: xattr -crs .
+
+      - name: "Set electron-builder props"
+        run: echo "ELECTRON_BUILDER_PROPS=-c.publish.bucket=$S3_BUCKET" >> $GITHUB_ENV
+
+      - name: "Release"
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          CSC_KEY_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
+          CSC_LINK: ${{ secrets.MAC_CSC_LINK }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_ID_PASS: ${{ secrets.APPLE_ID_PASS }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          USE_HARD_LINKS: false
+        run: cd packages/desktop && node_modules/.bin/electron-builder -p always --mac --arm64 ${{ env.ELECTRON_BUILDER_PROPS }}
+
+      - name: Get release
+        id: get_release
+        uses: bruceadams/get-release@74c3d60f5a28f358ccf241a00c9021ea16f0569f # v1.3.2
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+
+      - name: Upload Release Assets
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        with:
+          upload_url: ${{ steps.get_release.outputs.upload_url }}
+          asset_path: ./packages/desktop/dist/Quiet-${{ steps.extract_version.outputs.version}}-arm64.dmg
+          asset_name: Quiet-${{ steps.extract_version.outputs.version}}-arm64.dmg
+          asset_content_type: application/.dmg
+
+      - name: Send Release Notificaton
+        uses: ./.github/actions/release-notifier
+        if: always()
+        with:
+          os-name: MacOS (arm64)
+          version: ${{ steps.extract_version.outputs.version }}
+          status: ${{ job.status }}
+          slack_oauth_token: ${{ secrets.SLACK_BOT_OAUTH_TOKEN }}
 
   build-windows-prod:
     # needs: run-e2e-tests-win
@@ -308,7 +393,7 @@ jobs:
       S3_BUCKET: ${{ github.event.action == 'released' && 'quiet.7.x' || 'test.quiet' }}
 
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@v5
         with:
           submodules: 'recursive'