Split signing process from building

Author: CosmoCreeper

.github/workflows/build.yml

@@ -168,7 +168,7 @@ jobs:
         if: runner.os == 'Windows'
         shell: pwsh
         run: |
-          Copy-Item "build/Release/sine-win-$env:ARCH.exe" -Destination "unsigned/sine-installer.exe"
+          Copy-Item "build/Release/sine-win-$env:ARCH.exe" -Destination "unsigned/sine-win-$env:ARCH-unsigned.exe"
         env:
           ARCH: ${{ matrix.arch }}
 
@@ -178,49 +178,85 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: sine-win-${{ matrix.arch }}-unsigned
-          path: unsigned/sine-installer.exe
+          path: unsigned/sine-win-${{ matrix.arch }}-unsigned.exe
 
-      - name: Submit signing request
-        if: matrix.os == 'windows'
-        uses: signpath/github-action-submit-signing-request@b9d91eadd323de506c0c81cf0c7fe7438f3360fd # v2.2
+      - name: Upload Linux executable
+        if: matrix.os == 'linux'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          api-token: "${{ secrets.SIGNPATH_API_TOKEN }}"
-          organization-id: "1324b51a-cb3d-4d1e-aab7-27b1169bd402"
-          project-slug: "Sine"
-          signing-policy-slug: "release-signing"
-          github-artifact-id: "${{ steps.upload-unsigned-artifact.outputs.artifact-id }}"
-          wait-for-completion: true
-          output-artifact-directory: "artifacts"
+          name: sine-linux-${{ matrix.arch }}
+          path: artifacts/sine-linux-${{ matrix.arch }}
 
-      - name: Rename Windows signed artifact
-        if: matrix.os == 'windows'
-        shell: bash
-        run: mv "artifacts/sine-installer.exe" "artifacts/sine-win-${ARCH}.exe"
+      - name: Upload macOS executable
+        if: matrix.os == 'macos'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: sine-osx-${{ matrix.arch }}
+          path: artifacts/sine-osx-${{ matrix.arch }}
+
+  post-build:
+    runs-on: ubuntu-latest
+    name: Handle post-build steps
+    steps:
+      - name: Check signing requirements
+        id: status
         env:
-          ARCH: ${{ matrix.arch }}
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          if [[ "$REF_NAME" == "main" ]]; then
+            echo "should-sign=yes" >> $GITHUB_OUTPUT
+          else
+            echo "should-sign=no" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Download all artifacts
+        if: steps.status.outputs.should-sign == 'yes'
+        uses: actions/download-artifact@v8
 
       - name: Attest artifacts
         uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
         with:
           subject-path: artifacts/*
 
-      - name: Upload Windows executable
-        if: matrix.os == 'windows'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - name: Attest unsigned executables
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
         with:
-          name: sine-win-${{ matrix.arch }}
-          path: artifacts/sine-win-${{ matrix.arch }}.exe
+          subject-path: unsigned/*
 
-      - name: Upload Linux executable
-        if: matrix.os == 'linux'
+      - name: Upload Windows artifacts (for code signing)
+        if: steps.status.outputs.should-sign == 'yes'
+        id: upload-unsigned-zip
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: sine-linux-${{ matrix.arch }}
-          path: artifacts/sine-linux-${{ matrix.arch }}
+          name: sine-package-for-signing
+          path: ./unsigned
 
-      - name: Upload macOS executable
-        if: matrix.os == 'macos'
+      - name: Submit signing request
+        if: steps.status.outputs.should-sign == 'yes'
+        id: signpath-code-signing
+        uses: signpath/github-action-submit-signing-request@b9d91eadd323de506c0c81cf0c7fe7438f3360fd # v2.2
+        with:
+          api-token: "${{ secrets.SIGNPATH_API_TOKEN }}"
+          organization-id: "1324b51a-cb3d-4d1e-aab7-27b1169bd402"
+          project-slug: "Sine"
+          signing-policy-slug: "release-signing"
+          github-artifact-id: "${{ steps.upload-unsigned-zip.outputs.artifact-id }}"
+          wait-for-completion: false
+
+      - name: Save code signing info
+        if: steps.status.outputs.should-sign == 'yes'
+        run: |
+          mkdir -p artifacts/info
+          cp repo-info/* artifacts/info
+
+          echo "${{ steps.signpath-code-signing.outputs.signing-request-id }}" \
+            | tee artifacts/info/signing-request-id.txt
+          echo "${{ steps.signpath-code-signing.outputs.signing-request-web-url }}" \
+            | tee artifacts/info/signing-request-web-url.txt
+
+      - name: Upload Artifact (signing info)
+        if: steps.status.outputs.should-sign == 'yes'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: sine-osx-${{ matrix.arch }}
-          path: artifacts/sine-osx-${{ matrix.arch }}
+          name: info
+          path: ./artifacts/info

.github/workflows/release.yml

@@ -11,6 +11,10 @@ on:
         type: number
         description: "Version type (0: normal, 1: abnormal, 2: bootloader, see docs/updates.md)"
         required: true
+      run_id:
+        description: "GitHub Actions run_id when created the corresponding release"
+        required: false
+        type: string
 
 permissions:
   id-token: write
@@ -114,43 +118,65 @@ jobs:
           subject-path: artifacts/*
 
       - name: Trigger build workflow
+        if: steps.extract_branch.outputs.suffix == 'c'
         id: build_job
         uses: benc-uk/workflow-dispatch@31e2b3319479a63f0ab15bf800eff9e913504e26 # v1.3.2
         with:
           workflow: build.yml
           inputs: '{ "sine_version": "${{ steps.format_inputs.outputs.sine_version }}", "boot_version": "${{ steps.format_inputs.outputs.boot_version }}" }'
           wait-for-completion: true
 
+      - name: Trigger upload workflow
+        if: steps.extract_branch.outputs.suffix != 'c'
+        id: build_job
+        uses: benc-uk/workflow-dispatch@31e2b3319479a63f0ab15bf800eff9e913504e26 # v1.3.2
+        with:
+          workflow: upload-signed-files.yml
+          inputs: '{ "run_id": "${{ inputs.run_id }}" }'
+          wait-for-completion: true
+
       - name: Download artifacts
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           RUN_ID: ${{ steps.build_job.outputs.runId }}
+          INPUT_RUN_ID: ${{ inputs.run_id }}
         run: |
           gh run download $RUN_ID -D build/
 
+          if [[ "$INPUT_RUN_ID" != "" ]]; then
+            gh run download $INPUT_RUN_ID -D build/
+          fi
+
       - name: Organize and verify artifacts
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          for folder in build/*/; do
-            [ -d "$folder" ] || continue
-            file=$(find "$folder" -maxdepth 1 -type f)
+          if [ -d "build/signed-package" ]; then
+            echo "Signed package detected. Cleaning out old unsigned binaries..."
+            rm -rf build/sine-win-*-unsigned/
+          fi
+
+          find build/ -type f ! -path "*/info/*" -exec mv {} artifacts/ \;          
+          find build/ -type d -empty -delete
+
+          for file in artifacts/*; do
+            [ -f "$file" ] || continue
             filename=$(basename "$file")
-            foldername=$(basename "$folder")
-
-            if [ "$filename" = "$foldername" ]; then
-              extension="${filename##*.}"
-              tempname="${foldername}_file.$extension"
-              mv "$file" "artifacts/$tempname"
-              rmdir "$folder"
-              mv "artifacts/$tempname" "artifacts/$filename"
-            else
-              mv "$file" artifacts/
-              rmdir "$folder"
+
+            if [[ "$filename" == *"-unsigned.exe" ]]; then
+              new_name="${file/-unsigned/}"
+              mv "$file" "$new_name"
+              file="$new_name"
+              filename=$(basename "$file")
             fi
 
-            gh attestation verify "artifacts/$filename" --repo CosmoCreeper/Sine
-            echo "Processed 'artifacts/$filename' properly"
+            if [[ "$filename" =~ ^sine-(linux|osx|win)- ]]; then
+              gh attestation verify "$file" --repo CosmoCreeper/Sine
+              echo "Processed and verified 'artifacts/$filename' properly"
+            else
+              echo "Removing unwanted artifact asset: $filename"
+              rm -f "$file"
+            fi
           done
 
       - name: Upload artifacts to draft release

.github/workflows/upload-signed-files.yml

@@ -0,0 +1,89 @@
+name: Upload signed executables
+
+on:
+  workflow_dispatch:
+    inputs:
+      run_id:
+        description: "GitHub Actions run_id when created the corresponding release"
+        required: true
+        type: string
+
+permissions:
+  id-token: write
+  attestations: write
+
+jobs:
+  download:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Download build info
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RUN_ID: ${{ inputs.run_id }}
+        run: gh run download "${RUN_ID}" --name "info" --dir info
+
+      - name: Download signed files
+        shell: bash
+        timeout-minutes: 10
+        env:
+          SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }}
+          ORGANIZATION_ID: 1324b51a-cb3d-4d1e-aab7-27b1169bd402
+        run: |
+          SIGNING_REQUEST_ID=$(cat info/signing-request-id.txt)
+          REQUEST_URL=https://app.signpath.io/API/v1/${ORGANIZATION_ID}/SigningRequests/${SIGNING_REQUEST_ID}
+
+          # Check SignPath status
+          status=InProgress
+          while [ "$status" = "InProgress" ]; do
+            status=$(curl -f --silent -H "Authorization: Bearer ${SIGNPATH_API_TOKEN}" ${REQUEST_URL} \
+              | jq -r .status)
+
+            echo "SignPath status: $status"
+            case "$status" in
+              WaitingForApproval)
+                echo "Not approved yet. Approve it first:"
+                cat info/signing-request-web-url.txt
+                exit 1
+                ;;
+              InProgress)
+                ;;
+              Completed)
+                break
+                ;;
+              *)
+                exit 1
+                ;;
+            esac
+
+            sleep 10
+          done
+
+          # Download the signed files
+          curl -f -H "Authorization: Bearer ${SIGNPATH_API_TOKEN}" \
+               -o package.zip \
+               ${REQUEST_URL}/SignedArtifact
+          unzip package.zip -d package
+
+          rm -f package/*_pdb.*
+
+          for i in package/sine-win-*-unsigned.exe; do
+            [ -f "$i" ] || continue
+            mv "$i" "${i/-unsigned/}"
+          done
+
+          ls -l package
+
+      - name: Upload signed executables
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: signed-package
+          path: |
+            ./package/*
+
+      - name: Attest
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        with:
+          subject-path: ./package/*