Python environment management enhancements

.eslintignore

@@ -17,3 +17,5 @@ typedoc-theme/
 # ms IDE stuff
 .history/
 .vscode/
+
+env_installer

.github/workflows/publish.yml

@@ -14,18 +14,17 @@ jobs:
     strategy:
       matrix:
         cfg:
-        - { platform: linux, platform_name: Linux,  os: ubuntu-latest }
-        - { platform: mac, platform_name: macOS, os: macos-latest }
-        - { platform: win, platform_name: Windows, os: windows-latest }
+        - { platform: linux, platform_name: Linux,  os: ubuntu-latest, conda_platform: linux-64 }
+        - { platform: mac, platform_name: macOS, os: macos-latest, conda_platform: osx-64 }
+        - { platform: win, platform_name: Windows, os: windows-latest, conda_platform: win-64 }
 
     name: '${{ matrix.cfg.platform_name }} installer'
     runs-on: ${{ matrix.cfg.os }}
 
     steps:
       - uses: actions/checkout@v3
       - uses: s-weigand/setup-conda@v1
-      # downgrade conda since v23.1.0 is causing issues in "Create Application Server Installer" step
-      - run: conda install -c conda-forge conda=22.11.1 -y
+      - run: conda install --file ./workflow_env/conda-${{ matrix.cfg.conda_platform }}.lock -y
 
       - name: Install node
         uses: actions/setup-node@v3
@@ -34,10 +33,8 @@ jobs:
           cache: 'yarn'
 
       - name: Install dependencies
-        # pin Pillow version to prevent Windows build errors
         run: |
           npm install --global yarn --prefer-offline
-          conda install -c conda-forge constructor Pillow=9.3.0
           yarn install
 
       - name: Check JupyterLab version match
@@ -73,6 +70,38 @@ jobs:
         run: |
           yarn create_env_installer:${{ matrix.cfg.platform }}
 
+      # contents of tarball needs to be signed for notarization
+      - name: Codesign Application Server
+        if: matrix.cfg.platform == 'mac' && steps.release-exists.outputs.result == 'true'
+        env: 
+          CSC_IDENTITY_AUTO_DISCOVERY: true
+          CSC_FOR_PULL_REQUEST: true
+          CSC_LINK: ${{ secrets.CSC_LINK }}
+          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+          APPLEID: ${{ secrets.APPLEID }}
+          APPLEIDPASS: ${{ secrets.APPLEIDPASS }}
+          ENV_INSTALLER_KEYCHAIN_PASS: ${{ secrets.ENV_INSTALLER_KEYCHAIN_PASS }}
+        run: |
+          echo "Extracting env installer"
+          yarn extract_env_installer:${{ matrix.cfg.platform }}
+          echo $CSC_LINK | base64 -d -o certificate.p12
+          security create-keychain -p $ENV_INSTALLER_KEYCHAIN_PASS build.keychain
+          security default-keychain -s build.keychain
+          security unlock-keychain -p $ENV_INSTALLER_KEYCHAIN_PASS build.keychain
+          security import certificate.p12 -k build.keychain -P $CSC_KEY_PASSWORD -T /usr/bin/codesign
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $ENV_INSTALLER_KEYCHAIN_PASS build.keychain
+          echo "Signing env binaries"
+          while read line; do /usr/bin/codesign --force --options=runtime --deep -s "Developer ID Application" ./env_installer/jlab_server_extracted/"$line" -v; done < ./env_installer/sign-osx-64.txt
+          rm certificate.p12
+          security delete-keychain build.keychain
+
+      # recreate tarball after signing contents
+      - name: Re-archive Application Server Installer
+        if: matrix.cfg.platform == 'mac' && steps.release-exists.outputs.result == 'true'
+        run: |
+          yarn compress_env_installer:${{ matrix.cfg.platform }}
+          rm -rf ./env_installer/jlab_server_extracted
+
       - name: Create Application Installer for Test
         env:
           CSC_IDENTITY_AUTO_DISCOVERY: false # disable code signing if not release asset

.gitignore

@@ -23,6 +23,4 @@ __pycache__
 .idea/
 *.log
 
-env_installer/
-!env_installer/construct.yaml
-
+env_installer/jlab_server/

.prettierignore

@@ -9,3 +9,5 @@
 # ms IDE stuff
 .history/
 .vscode/
+
+env_installer

.stylelintignore

@@ -1 +1,2 @@
 build/**/*
+env_installer

Release.md

@@ -20,23 +20,21 @@ If the JupyterLab version is not changing with the new JupyterLab Desktop releas
 
 In order to change the JupyterLab version bundled with the application:
 
-1. Update all `@jupyterlab` package dependencies in [package.json](package.json) using
+1. Bump the application version using `tbump` to `new-jlab-version-1`
 
    ```bash
-   yarn set_jupyterlab_version <new-jlab-version>
+   tbump --only-patch <new-jlab-version>-1
    ```
 
-   `<new-jlab-version>` must match a released JupyterLab version such as `3.1.13`. This command will update dependencies with `@jupyterlab` scope.
-
-2. Bump the application version using `tbump` to `new-jlab-version-1`
+2. Update conda lock files using
 
    ```bash
-   tbump --only-patch <new-jlab-version>-1
+   yarn update_conda_lock
    ```
 
-3. Update `@jupyter-widgets/jupyterlab-manager` version in [package.json](package.json) for ipywidgets if a compatible newer version is available.
+3. If python version is updated in [`env_installer/jlab_server.yaml`](env_installer/jlab_server.yaml), also update `pythonBin` variables in [`util.ts`](src/main/utils.ts) that are used in code signing related methods.
 
-4. Update `ipywidgets` python package version in [`env_installer/construct.yaml`](env_installer/construct.yaml) if there is a compatible newer version available.
+4. Update `ipywidgets` python package version in [`env_installer/jlab_server.yaml`](env_installer/jlab_server.yaml) if there is a compatible newer version available.
 
 Note that after updating the bundled JupyterLab version, it is necessary to bump JupyterLab Desktop version using `tbump` as described in the section below. Run `check_version_match` script before committing the changes to ensure version integrity.
 

dev.md

@@ -6,10 +6,10 @@
 
   You can install `conda` as part of a [Miniforge](https://github.com/conda-forge/miniforge) installer.
 
-- [(conda) Constructor](https://github.com/conda/constructor) to bundle JupyterLab Desktop Server into the stand-alone application. You can install Constructor using:
+- [conda pack](https://github.com/conda/conda-pack) and [conda lock](https://github.com/conda/conda-lock) to bundle JupyterLab Desktop Server into the standalone application and to create lock files. You can install them using:
 
   ```bash
-  conda install -c conda-forge constructor
+  conda install -c conda-forge conda-pack conda-lock
   ```
 
 - nodejs