|
| 1 | +name: Release |
| 2 | + |
| 3 | +on: |
| 4 | + push: |
| 5 | + tags: ['v*'] |
| 6 | + |
| 7 | +permissions: |
| 8 | + contents: write |
| 9 | + |
| 10 | +jobs: |
| 11 | + release: |
| 12 | + runs-on: windows-latest |
| 13 | + |
| 14 | + env: |
| 15 | + # Steps that need a certificate check this instead of `secrets` directly, |
| 16 | + # which is not available in every `if` context. |
| 17 | + HAS_CERT: ${{ secrets.CODE_SIGNING_PFX != '' }} |
| 18 | + |
| 19 | + steps: |
| 20 | + - uses: actions/checkout@v4 |
| 21 | + |
| 22 | + - uses: actions/setup-dotnet@v4 |
| 23 | + with: |
| 24 | + dotnet-version: '10.0.x' |
| 25 | + |
| 26 | + # The tag is the single source of the version number. There is deliberately no |
| 27 | + # version in any project file that could drift away from it. |
| 28 | + - name: Derive the version from the tag |
| 29 | + id: version |
| 30 | + shell: pwsh |
| 31 | + run: | |
| 32 | + $version = '${{ github.ref_name }}' -replace '^v', '' |
| 33 | + if ($version -notmatch '^\d+\.\d+\.\d+$') { |
| 34 | + throw "Tag '${{ github.ref_name }}' is not vMAJOR.MINOR.PATCH" |
| 35 | + } |
| 36 | + "value=$version" >> $env:GITHUB_OUTPUT |
| 37 | +
|
| 38 | + - name: Test |
| 39 | + run: dotnet test tests/MateFan.Tests --configuration Release |
| 40 | + |
| 41 | + # Self-contained but not single-file: the installer owns a folder, so there is |
| 42 | + # nothing to unpack at every start. |
| 43 | + - name: Publish the installer payload |
| 44 | + run: > |
| 45 | + dotnet publish src/MateFan.App --configuration Release --runtime win-x64 |
| 46 | + --self-contained true -p:PublishSingleFile=false |
| 47 | + -p:Version=${{ steps.version.outputs.value }} |
| 48 | + --output publish/installer |
| 49 | +
|
| 50 | + # Portable: here self-extraction is the fair price for being one file. |
| 51 | + - name: Publish the portable build |
| 52 | + run: > |
| 53 | + dotnet publish src/MateFan.App --configuration Release --runtime win-x64 |
| 54 | + --self-contained true -p:PublishSingleFile=true |
| 55 | + -p:IncludeNativeLibrariesForSelfExtract=true |
| 56 | + -p:Version=${{ steps.version.outputs.value }} |
| 57 | + --output publish/portable |
| 58 | +
|
| 59 | + - name: Build the installer |
| 60 | + shell: pwsh |
| 61 | + run: | |
| 62 | + # Inno Setup lands in a different place depending on how it was installed: the |
| 63 | + # runner image ships it under Program Files (x86), chocolatey agrees, but a |
| 64 | + # per-user winget install puts it under LOCALAPPDATA. Look in all three rather |
| 65 | + # than hard-coding one and finding out on release day. |
| 66 | + $candidates = @( |
| 67 | + "${env:ProgramFiles(x86)}\Inno Setup 6\ISCC.exe", |
| 68 | + "$env:ProgramFiles\Inno Setup 6\ISCC.exe", |
| 69 | + "$env:LOCALAPPDATA\Programs\Inno Setup 6\ISCC.exe" |
| 70 | + ) |
| 71 | + $iscc = $candidates | Where-Object { Test-Path $_ } | Select-Object -First 1 |
| 72 | + if (-not $iscc) { |
| 73 | + choco install innosetup -y --no-progress |
| 74 | + $iscc = $candidates | Where-Object { Test-Path $_ } | Select-Object -First 1 |
| 75 | + } |
| 76 | + if (-not $iscc) { |
| 77 | + throw "ISCC.exe not found in any of: $($candidates -join ', ')" |
| 78 | + } |
| 79 | + Write-Host "Using $iscc" |
| 80 | + & $iscc /DAppVersion=${{ steps.version.outputs.value }} installer\matefan.iss |
| 81 | + if ($LASTEXITCODE -ne 0) { throw "ISCC failed with $LASTEXITCODE" } |
| 82 | +
|
| 83 | + - name: Collect the release files |
| 84 | + shell: pwsh |
| 85 | + run: | |
| 86 | + New-Item -ItemType Directory -Force dist | Out-Null |
| 87 | + $v = '${{ steps.version.outputs.value }}' |
| 88 | + Copy-Item "installer\Output\MateFan-Setup-$v.exe" dist\ |
| 89 | + Copy-Item "publish\portable\MateFan.exe" "dist\MateFan-$v-portable.exe" |
| 90 | +
|
| 91 | + - name: Sign |
| 92 | + if: env.HAS_CERT == 'true' |
| 93 | + shell: pwsh |
| 94 | + env: |
| 95 | + PFX: ${{ secrets.CODE_SIGNING_PFX }} |
| 96 | + PFX_PASSWORD: ${{ secrets.CODE_SIGNING_PASSWORD }} |
| 97 | + run: | |
| 98 | + [IO.File]::WriteAllBytes('cert.pfx', [Convert]::FromBase64String($env:PFX)) |
| 99 | + Get-ChildItem dist\*.exe | ForEach-Object { |
| 100 | + & signtool sign /f cert.pfx /p $env:PFX_PASSWORD /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 $_.FullName |
| 101 | + if ($LASTEXITCODE -ne 0) { throw "signtool failed for $($_.Name)" } |
| 102 | + } |
| 103 | + Remove-Item cert.pfx |
| 104 | +
|
| 105 | + # Checksums come last so they cover the signed files when signing is on. |
| 106 | + - name: Write the checksums |
| 107 | + shell: pwsh |
| 108 | + run: | |
| 109 | + Get-ChildItem dist\*.exe | |
| 110 | + Get-FileHash -Algorithm SHA256 | |
| 111 | + ForEach-Object { "$($_.Hash.ToLower()) $(Split-Path $_.Path -Leaf)" } | |
| 112 | + Set-Content dist\SHA256SUMS.txt -Encoding ascii |
| 113 | +
|
| 114 | + - name: Create the release |
| 115 | + shell: pwsh |
| 116 | + env: |
| 117 | + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 118 | + run: | |
| 119 | + gh release create '${{ github.ref_name }}' (Get-ChildItem dist\* | ForEach-Object FullName) ` |
| 120 | + --title 'MateFan ${{ github.ref_name }}' ` |
| 121 | + --generate-notes |
0 commit comments