a25f04e24b
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.6.2 to 3.0.2.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](3bb12739c2...3d0d9888cb)
---
updated-dependencies:
- dependency-name: softprops/action-gh-release
dependency-version: 3.0.2
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
95 lines
4.1 KiB
YAML
95 lines
4.1 KiB
YAML
name: Windows installer release
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
package:
|
|
runs-on: windows-latest
|
|
permissions:
|
|
contents: write
|
|
env:
|
|
SIGNING_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_BASE64 }}
|
|
SIGNING_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_PASSWORD }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
|
|
- name: Set up .NET 10
|
|
uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
|
|
with:
|
|
dotnet-version: 10.0.x
|
|
|
|
- name: Prepare signing certificate
|
|
id: signing
|
|
shell: pwsh
|
|
run: |
|
|
$directory = Join-Path $env:RUNNER_TEMP 'smm-signing'
|
|
New-Item -ItemType Directory -Path $directory -Force | Out-Null
|
|
if ($env:SIGNING_CERTIFICATE_BASE64 -and $env:SIGNING_CERTIFICATE_PASSWORD) {
|
|
Write-Output "::add-mask::$env:SIGNING_CERTIFICATE_PASSWORD"
|
|
$pfx = Join-Path $directory 'trusted-signing.pfx'
|
|
[IO.File]::WriteAllBytes($pfx, [Convert]::FromBase64String($env:SIGNING_CERTIFICATE_BASE64))
|
|
"certificate=$pfx" >> $env:GITHUB_OUTPUT
|
|
"password=$env:SIGNING_CERTIFICATE_PASSWORD" >> $env:GITHUB_OUTPUT
|
|
"test_certificate=false" >> $env:GITHUB_OUTPUT
|
|
} else {
|
|
$password = [Convert]::ToBase64String([Security.Cryptography.RandomNumberGenerator]::GetBytes(24))
|
|
Write-Output "::add-mask::$password"
|
|
./build/windows/New-TestSigningCertificate.ps1 -OutputDirectory $directory -Password $password
|
|
"certificate=$(Join-Path $directory 'server-monitor-manager-test-signing.pfx')" >> $env:GITHUB_OUTPUT
|
|
"public_certificate=$(Join-Path $directory 'server-monitor-manager-test-signing.cer')" >> $env:GITHUB_OUTPUT
|
|
"password=$password" >> $env:GITHUB_OUTPUT
|
|
"test_certificate=true" >> $env:GITHUB_OUTPUT
|
|
}
|
|
|
|
- name: Build signed MSIX
|
|
shell: pwsh
|
|
run: ./build/windows/Build-Installer.ps1 -CertificatePath '${{ steps.signing.outputs.certificate }}' -CertificatePassword '${{ steps.signing.outputs.password }}'
|
|
|
|
- name: Include test certificate
|
|
if: steps.signing.outputs.test_certificate == 'true'
|
|
shell: pwsh
|
|
run: Copy-Item -LiteralPath '${{ steps.signing.outputs.public_certificate }}' -Destination artifacts/windows-installer/ServerMonitorManager-test-signing.cer
|
|
|
|
- name: Verify checksum
|
|
shell: pwsh
|
|
run: |
|
|
$line = Get-Content artifacts/windows-installer/SHA256SUMS
|
|
$expected = ($line -split ' ')[0]
|
|
$actual = (Get-FileHash artifacts/windows-installer/ServerMonitorManager-win-x64.msix -Algorithm SHA256).Hash.ToLowerInvariant()
|
|
if ($actual -ne $expected) { throw 'Windows installer checksum mismatch.' }
|
|
|
|
- name: Generate SBOM
|
|
shell: bash
|
|
run: |
|
|
dotnet tool install --global CycloneDX
|
|
dotnet CycloneDX ServerMonitorManager.slnx -o . -j --filename server-monitor-manager-win-x64-sbom
|
|
|
|
- name: Upload installer artifact
|
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
|
with:
|
|
name: ServerMonitorManager-win-x64
|
|
path: |
|
|
artifacts/windows-installer/ServerMonitorManager-win-x64.msix
|
|
artifacts/windows-installer/ServerMonitorManager-test-signing.cer
|
|
artifacts/windows-installer/SHA256SUMS
|
|
server-monitor-manager-win-x64-sbom.json
|
|
if-no-files-found: error
|
|
|
|
- name: Attach installer to GitHub Release
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
|
|
with:
|
|
prerelease: ${{ contains(github.ref_name, '-') }}
|
|
files: |
|
|
artifacts/windows-installer/ServerMonitorManager-win-x64.msix
|
|
artifacts/windows-installer/ServerMonitorManager-test-signing.cer
|
|
artifacts/windows-installer/SHA256SUMS
|
|
server-monitor-manager-win-x64-sbom.json
|