mirror of
https://github.com/johannesjo/super-productivity.git
synced 2026-07-17 16:37:43 +00:00
71 lines
2.6 KiB
YAML
71 lines
2.6 KiB
YAML
name: SignPath Code Signing
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: 'Release tag to sign (e.g. v1.2.3)'
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
contents: write
|
|
actions: read
|
|
|
|
jobs:
|
|
signpath-windows:
|
|
runs-on: windows-latest
|
|
|
|
steps:
|
|
- name: Download release assets
|
|
shell: pwsh
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
New-Item -ItemType Directory -Force -Path .tmp/app-builds | Out-Null
|
|
gh release download "${{ inputs.tag }}" --repo "${{ github.repository }}" --dir ".tmp/app-builds" --pattern "*.exe" --pattern "*.blockmap" --pattern "latest*.yml"
|
|
if (-not (Get-ChildItem -Path .tmp/app-builds -Filter *.exe)) {
|
|
Write-Error "No .exe assets found for tag ${{ inputs.tag }}"
|
|
}
|
|
|
|
- name: Upload unsigned executables for SignPath
|
|
id: upload-unsigned
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: unsigned-windows-executables
|
|
path: .tmp/app-builds/*.exe
|
|
if-no-files-found: error
|
|
|
|
- name: Sign Windows executables with SignPath
|
|
uses: signpath/github-action-submit-signing-request@v2
|
|
with:
|
|
api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
|
|
organization-id: ${{ secrets.SIGNPATH_ORGANIZATION_ID }}
|
|
project-slug: ${{ secrets.SIGNPATH_PROJECT_SLUG }}
|
|
signing-policy-slug: 'release-signing'
|
|
artifact-configuration-slug: 'setup'
|
|
github-artifact-id: ${{ steps.upload-unsigned.outputs.artifact-id }}
|
|
output-artifact-directory: '.tmp/app-builds-signed/'
|
|
wait-for-completion: true
|
|
wait-for-completion-timeout-in-seconds: 600
|
|
|
|
- name: Move signed executables back to build directory
|
|
shell: pwsh
|
|
run: |
|
|
New-Item -ItemType Directory -Force -Path .tmp/app-builds | Out-Null
|
|
Get-ChildItem -Path .tmp/app-builds-signed -Filter *.exe -Recurse | ForEach-Object {
|
|
Move-Item -Force $_.FullName .tmp/app-builds/
|
|
}
|
|
Write-Host "Signed executables:"
|
|
Get-ChildItem -Path .tmp/app-builds -Filter *.exe | Format-Table -AutoSize
|
|
|
|
- name: Upload signed binaries to GitHub Release
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
tag_name: ${{ inputs.tag }}
|
|
files: |
|
|
.tmp/app-builds/*.exe
|
|
.tmp/app-builds/*.blockmap
|
|
.tmp/app-builds/latest*.yml
|
|
draft: false
|
|
prerelease: ${{ contains(inputs.tag, 'RC') || contains(inputs.tag, 'beta') || contains(inputs.tag, 'alpha') }}
|