-
Notifications
You must be signed in to change notification settings - Fork 0
142 lines (121 loc) · 5.06 KB
/
snapshot-signed.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
name: "Build & Sign Snapshot"
on:
workflow_dispatch:
permissions:
contents: write
packages: write
jobs:
build-windows:
name: Build and sign Windows snapshot
runs-on: windows-latest
strategy:
matrix:
goos: [ windows ]
goarch: [ amd64, arm64 ]
steps:
- uses: actions/checkout@v4
- uses: ./
name: "Common Setup"
- name: Doctor
run: |
wails doctor
- name: Build
run: |
wails build -clean -platform ${{ matrix.goos }}/${{ matrix.goarch }} -trimpath -ldflags "-s -w -X 'main.GitCommit=${{env.GITHUB_SHA_SHORT}}' -X 'main.Version=${{env.GITHUB_REF_NAME}}'"
mkdir -p ./out
mv ./build/bin/ftb-debug-ui.exe ./out/ftb-debug-${{ matrix.goos }}-${{ matrix.goarch }}.exe
- name: Windows Signing
run: |
dotnet tool install --global AzureSignTool --version 5.0.0
azuresigntool sign -kvu ${{ secrets.AZURE_KEY_VAULT_URL }} -kvi ${{ secrets.AZURE_KEY_VAULT_CLIENT_ID }} -kvs ${{ secrets.AZURE_KEY_VAULT_CLIENT_SECRET }} -kvc ${{ secrets.AZURE_KEY_VAULT_CERTIFICATE_NAME }} -kvt ${{ secrets.AZURE_KEY_VAULT_TENANT_ID }} -tr http://timestamp.digicert.com -v out\ftb-debug-${{ matrix.goos }}-${{ matrix.goarch }}.exe
- name: Archive artifacts
uses: actions/upload-artifact@v4
with:
name: ftb-debug-${{ matrix.goos }}-${{ matrix.goarch }}
overwrite: true
path: |
out/*
build-linux:
name: Build and release Linux
runs-on: ubuntu-latest
strategy:
matrix:
goos: [ linux ]
goarch: [ amd64 ]
steps:
- uses: actions/checkout@v4
- uses: ./
name: "Common Setup"
- name: Linux Setup
run: |
sudo apt-get update
sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev
- name: Doctor
run: |
wails doctor
- name: Build
run: |
wails build -clean -platform ${{ matrix.goos }}/${{ matrix.goarch }} -trimpath -ldflags "-s -w -X 'main.GitCommit=$(GITHUB_SHA_SHORT)' -X 'main.Version=$(GITHUB_REF_NAME)'"
mkdir -p ./out
mv ./build/bin/ftb-debug-ui ./out/ftb-debug-${{ matrix.goos }}-${{ matrix.goarch }}
- name: Archive artifacts
uses: actions/upload-artifact@v4
with:
name: ftb-debug-${{ matrix.goos }}-${{ matrix.goarch }}
overwrite: true
path: |
out/*
build-macos:
name: Build and release macOS
runs-on: macos-latest
strategy:
matrix:
goos: [ darwin ]
goarch: [ amd64, arm64 ]
steps:
- uses: actions/checkout@v4
- uses: ./
name: "Common Setup"
- name: Doctor
run: |
wails doctor
- name: Build
run: |
wails build -clean -platform ${{ matrix.goos }}/${{ matrix.goarch }} -trimpath -ldflags "-s -w -X 'shared.GitCommit=$(GITHUB_SHA_SHORT)' -X 'shared.Version=$(GITHUB_REF_NAME)'"
mkdir -p ./out
cd ./build/bin; zip -r ../../out/ftb-debug-${{ matrix.goos }}-${{ matrix.goarch }}.zip ftb-debug-ui.app
- name: Apple Certificate
env:
BUILD_CERTIFICATE_BASE64: ${{ secrets.CSC_LINK }}
P12_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
run: |
# create variables
CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
# import certificate and provisioning profile from secrets
echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
# create temporary keychain
security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH > /dev/null
security set-keychain-settings -lut 21600 $KEYCHAIN_PATH > /dev/null
security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH > /dev/null
# import certificate to keychain
security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH > /dev/null
security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH > /dev/null
security list-keychain -d user -s $KEYCHAIN_PATH > /dev/null
- name: Codesign & Notarize
run: |
cd ./build/bin
codesign -s "5372643C69B1D499BDF6EA772082E9CE99E85029" -v ./ftb-debug-ui.app --options=runtime --timestamp
codesign -dv ./ftb-debug-ui.app
echo "${{secrets.APPLE_API_KEY}}" > apple_api_key.p8
zip -r ../../out/ftb-debug-${{ matrix.goos }}-${{ matrix.goarch }}.zip ftb-debug-ui.app
cd ../../out
xcrun notarytool submit "./ftb-debug-${{ matrix.goos }}-${{ matrix.goarch }}.zip" --key "./apple_api_key.p8" --key-id ${{ secrets.APPLE_API_KEY_ID }} --issuer ${{ secrets.APPLE_API_ISSUER }} --wait
- name: Archive artifacts
uses: actions/upload-artifact@v4
with:
name: ftb-debug-${{ matrix.goos }}-${{ matrix.goarch }}
overwrite: true
path: |
out/*