release.yml

name: Release

# === Triggers ===
"on":
  create

# === JOBS ===
jobs:

  # === OS Specific Job (runs on each OS) ===
  remote-installer:
    name: Remote Installer
    timeout-minutes: 30
    runs-on: windows-2019
    if: github.event.ref_type == 'tag' && contains(github.event.ref, 'release/remote-installer')
    permissions:
      id-token: write # This is required for requesting the JWT
    env:
      ACTIVESTATE_CI: true
      GITHUB_REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      AWS_REGION : "us-east-1"
      AWS_ROLE_SESSION_NAME: "gha-activestate-cli"

    # === OS Specific Steps ===
    steps:
      - # Checkout Code
        name: Checkout code
        uses: actions/checkout@v5

      - # === Install Go ===
        name: Install Go
        uses: actions/setup-go@v3
        with:
          go-version: '1.22.x'

      - # === Install State Tool ===
        name: Install State Tool
        uses: ActiveState/setup-state-tool@v1

      - # === Preprocess ===
        name: Preprocess
        shell: bash
        timeout-minutes: 1
        run: state run preprocess -v

      - # === Build Remote Installer ===
        name: Build Remote Installer
        shell: bash
        timeout-minutes: 15
        run: |
          echo $MSI_CERT_BASE64 | base64 --decode > Cert.p12
          export PATH=/c/Program\ Files\ \(x86\)/WiX\ Toolset\ v3.11/bin/:/c/Program\ Files\ \(x86\)/Windows\ Kits/10/bin/10.0.16299.0/x86/:$PATH

          GOOS=windows state run build-remote-installer
          signtool.exe sign -d "ActiveState State Tool Remote Installer" -f "Cert.p12" -p ${CODE_SIGNING_PASSWD} ./build/state-remote-installer.exe
          state run generate-remote-install-deployment windows amd64

          GOOS=linux state run build-remote-installer
          state run generate-remote-install-deployment linux amd64

          GOOS=darwin state run build-remote-installer
          state run generate-remote-install-deployment darwin amd64
        env:
          CODE_SIGNING_PASSWD: ${{ secrets.CODE_SIGNING_PASSWD }}
          MSI_CERT_BASE64: ${{ secrets.MSI_CERT_BASE64 }}

      - # === Configure AWS credentials ==
        name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          role-session-name: ${{ env.AWS_ROLE_SESSION_NAME }}
          aws-region: ${{ env.AWS_REGION }}
          mask-aws-account-id: true

      - # === Deploy ===
        name: Deploy
        shell: bash
        run: state run deploy-remote-installer