4cc873883c
- Pin all 23 GitHub Actions uses to 40-char commit SHA with tag comments:
actions/checkout@v6 -> d23441a48e516b6c34aea4fa41551a30e30af803 (v6.1.0)
actions/setup-dotnet@v5 -> 26b0ec14cb23fa6904739307f278c14f94c95bf1 (v5.4.0)
actions/upload-artifact@v6 -> b7c566a772e6b6bfb58ed0dc250532a479d7789f (v6.0.0)
actions/download-artifact@v8 -> 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c (v8.0.1)
softprops/action-gh-release@v2 -> 3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 (v2.6.2)
SHAs verified via gh api repos/<owner>/<action>/git/ref/tags/<tag>
- Move contents:write from workflow level to release steps only
- Add dotnet CycloneDX SBOM generation to linux-release and windows-release
- Add .github/dependabot.yml (github-actions + nuget, weekly, limit 5 PRs)
- Add SECURITY.md with private advisory channel, 72h SLA, threat model
- Add CHANGELOG.md from real git history (Keep a Changelog format)
- Add CONTRIBUTING.md with build/test instructions and Linux test note
- Add CODEOWNERS
- Add .github/ISSUE_TEMPLATE/{bug_report,feature_request}.md
- Add .github/PULL_REQUEST_TEMPLATE.md with mandatory verification checklist
61 lines
2.5 KiB
YAML
61 lines
2.5 KiB
YAML
name: Windows build
|
|
|
|
on:
|
|
push:
|
|
branches: ['**']
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: windows-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
|
|
- name: Set up .NET 10
|
|
uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
|
|
with:
|
|
dotnet-version: 10.0.x
|
|
|
|
- name: Restore
|
|
run: dotnet restore src/ServerMonitorManager.Desktop/ServerMonitorManager.Desktop.csproj -p:Platform=x64 -p:PublishReadyToRun=true -r win-x64
|
|
|
|
- name: Build x64 Release
|
|
run: dotnet build src/ServerMonitorManager.Desktop/ServerMonitorManager.Desktop.csproj --configuration Release -p:Platform=x64 -p:PublishReadyToRun=true -r win-x64 --no-restore
|
|
|
|
- name: Verify formatting
|
|
run: dotnet format src/ServerMonitorManager.Desktop/ServerMonitorManager.Desktop.csproj --verify-no-changes --no-restore
|
|
|
|
- name: Verify Windows desktop contracts
|
|
shell: pwsh
|
|
run: ./tests/windows/Test-DesktopContracts.ps1
|
|
|
|
- name: Test Desktop security
|
|
run: dotnet test tests/ServerMonitorManager.Desktop.Security.Tests/ServerMonitorManager.Desktop.Security.Tests.csproj --configuration Release
|
|
|
|
- name: Build test-signed MSIX installer
|
|
shell: pwsh
|
|
run: |
|
|
$directory = Join-Path $env:RUNNER_TEMP 'smm-test-signing'
|
|
$password = [Convert]::ToBase64String([Security.Cryptography.RandomNumberGenerator]::GetBytes(24))
|
|
Write-Output "::add-mask::$password"
|
|
./build/windows/New-TestSigningCertificate.ps1 -OutputDirectory $directory -Password $password
|
|
./build/windows/Build-Installer.ps1 `
|
|
-CertificatePath (Join-Path $directory 'server-monitor-manager-test-signing.pfx') `
|
|
-CertificatePassword $password
|
|
Copy-Item `
|
|
-LiteralPath (Join-Path $directory 'server-monitor-manager-test-signing.cer') `
|
|
-Destination artifacts/windows-installer/ServerMonitorManager-test-signing.cer
|
|
|
|
- name: Upload test installer
|
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
|
with:
|
|
name: ServerMonitorManager-win-x64-test
|
|
path: |
|
|
artifacts/windows-installer/ServerMonitorManager-win-x64.msix
|
|
artifacts/windows-installer/ServerMonitorManager-test-signing.cer
|
|
artifacts/windows-installer/SHA256SUMS
|
|
if-no-files-found: error
|