Skip to content

Commit 08f1dad

Browse files
jasonleenaylorjasonleenaylor
committed
Refactor ci/cd to use new signing action
1 parent f3560e7 commit 08f1dad

File tree

1 file changed

+44
-194
lines changed

1 file changed

+44
-194
lines changed

‎.github/workflows/ci-cd.yml‎

Lines changed: 44 additions & 194 deletions
Original file line numberDiff line numberDiff line change
@@ -113,75 +113,25 @@ jobs:
113113

114114
# All the following are used only when building an installer after a merge
115115
- name: Build Msi
116+
if: github.event_name != 'pull_request'
116117
id: build_msi
117118
shell: cmd
118119
run: |
119120
msbuild build/FLExBridge.proj /t:CleanMasterOutputDir;PreparePublishingArtifactsInternal;BuildProductBaseMsi /p:UploadFolder=${{ inputs.environment || 'Alpha' }}
120-
if: github.event_name != 'pull_request'
121-
122-
# REVIEW: The .msi file is named with the version, there is probably a cleaner way to generate the correct filename
123-
# and after completing the work to do signing of the bundles it became clear that capturing the files in the signtool wasn't necessary
124-
- name: Prepare for msi signing
125-
shell: bash
126-
run: |
127-
echo "FILES_TO_SIGN=$(cat $FILESTOSIGNLATER)" >> $GITHUB_OUTPUT
128-
id: gathered_files
129-
if: github.event_name != 'pull_request'
130121
131-
- name: upload-msi
132-
id: upload
133-
uses: actions/upload-artifact@v4
134-
with:
135-
name: FlexBridge.msi
136-
path: ${{ steps.gathered_files.outputs.FILES_TO_SIGN }}
137-
if-no-files-found: error
138-
overwrite: true
122+
- name: Sign FlexBridge msi
123+
uses: sillsdev/codesign/trusted-signing-action@v3
139124
if: github.event_name != 'pull_request'
140-
141-
sign-msi:
142-
name: Sign FlexBridge Installer
143-
needs: build_and_test
144-
if: github.event_name != 'pull_request'
145-
uses: sillsdev/codesign/.github/workflows/[email protected]
146-
with:
147-
artifact: FlexBridge.msi
148-
description: 'FLEx Bridge Installer'
149-
secrets:
150-
certificate: ${{ secrets.CODESIGN_LSDEVSECTIGOEV }}
151-
152-
build-bundles:
153-
name: Build Installer Bundles
154-
needs: sign-msi
155-
if: github.event_name != 'pull_request'
156-
runs-on: windows-latest
157-
env:
158-
FILESTOSIGNLATER: "${{ github.workspace }}\\filesToSign"
159-
steps:
160-
- name: Checkout Files
161-
uses: actions/checkout@v4
162-
id: checkout
163125
with:
164-
fetch-depth: 0
165-
submodules: true
166-
167-
- name: Downgrade Wix Toolset - remove when runner has 3.14.2
168-
# See: https://github.com/actions/runner-images/issues/9667
169-
run: |
170-
choco uninstall wixtoolset
171-
choco install wixtoolset --version 3.11.2 --allow-downgrade --force
172-
echo "C:\Program Files (x86)\WiX Toolset v3.11\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
173-
174-
- name: Add msbuild to PATH
175-
uses: microsoft/setup-msbuild@v2
176-
177-
- name: Download FlexBridge artifact
178-
uses: actions/download-artifact@v4
179-
with:
180-
name: FlexBridge.msi
181-
path: src/WiXInstaller/BaseInstallerBuild # Target directory for the downloaded artifact
126+
credentials: ${{ secrets.TRUSTED_SIGNING_CREDENTIALS }}
127+
files-folder: src/WiXInstaller/BaseInstallerBuild
128+
files-folder-filter: FlexBridge*.msi
129+
description: 'FLExBridge installer - SIL Global'
130+
description-url: 'https://software.sil.org/fieldworks/help/using-sendreceive/flex-bridge/'
182131

183132
- name: Build Bundles
184133
id: build_bundles
134+
if: github.event_name != 'pull_request'
185135
working-directory: build
186136
shell: cmd
187137
run: |
@@ -190,156 +140,56 @@ jobs:
190140
191141
- name: Extract burn engines
192142
id: extract_engines
143+
if: github.event_name != 'pull_request'
193144
working-directory: BuildDir
194145
shell: cmd
195146
run: |
196147
insignia -ib FlexBridge_Offline.exe -o offline-engine.exe
197148
insignia -ib FlexBridge_Online.exe -o online-engine.exe
198149
199-
- name: Upload Offline Engine
200-
id: upload-offline-engine
201-
uses: actions/upload-artifact@v4
202-
with:
203-
name: offline-engine
204-
path: BuildDir/offline-engine.exe
205-
if-no-files-found: error
206-
overwrite: true
150+
- name: Sign Engines
207151
if: github.event_name != 'pull_request'
208-
209-
- name: Upload Offline Bundle(detatched)
210-
id: upload-offline-bundle
211-
uses: actions/upload-artifact@v4
212-
with:
213-
name: FlexBridge_Offline.exe
214-
path: BuildDir/FlexBridge_Offline.exe
215-
if-no-files-found: error
216-
overwrite: true
217-
if: github.event_name != 'pull_request'
218-
219-
- name: Upload Online Engine
220-
id: upload-online-engine
221-
uses: actions/upload-artifact@v4
222-
with:
223-
name: online-engine
224-
path: BuildDir/online-engine.exe
225-
if-no-files-found: error
226-
overwrite: true
227-
if: github.event_name != 'pull_request'
228-
229-
- name: Upload Online Bundle(detached)
230-
id: upload-online-bundle
231-
uses: actions/upload-artifact@v4
232-
with:
233-
name: FlexBridge_Online.exe
234-
path: BuildDir/FlexBridge_Online.exe
235-
if-no-files-found: error
236-
overwrite: true
237-
if: github.event_name != 'pull_request'
238-
239-
sign-offline-engine:
240-
name: Sign Offline Engine
241-
needs: build-bundles
242-
if: github.event_name != 'pull_request'
243-
uses: sillsdev/codesign/.github/workflows/[email protected]
244-
with:
245-
artifact: offline-engine
246-
description: 'FLEx Bridge Installer'
247-
secrets:
248-
certificate: ${{ secrets.CODESIGN_LSDEVSECTIGOEV }}
249-
250-
sign-online-engine:
251-
name: Sign Online Engine
252-
needs: build-bundles
253-
if: github.event_name != 'pull_request'
254-
uses: sillsdev/codesign/.github/workflows/[email protected]
255-
with:
256-
artifact: online-engine
257-
description: 'FLEx Bridge Installer'
258-
secrets:
259-
certificate: ${{ secrets.CODESIGN_LSDEVSECTIGOEV }}
260-
261-
reattach-engines:
262-
runs-on: windows-latest
263-
needs: [sign-offline-engine, sign-online-engine]
264-
steps:
265-
- name: Downgrade Wix Toolset - remove when runner has 3.14.2
266-
run: |
267-
choco uninstall wixtoolset
268-
choco install wixtoolset --version 3.11.2 --allow-downgrade --force
269-
echo "C:\Program Files (x86)\WiX Toolset v3.11\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
270-
271-
- name: Download signed online engine
272-
uses: actions/download-artifact@v4
273-
with:
274-
name: online-engine
275-
- name: Download signed offline engine
276-
uses: actions/download-artifact@v4
277-
with:
278-
name: offline-engine
279-
- name: Download Online Bundle
280-
uses: actions/download-artifact@v4
281-
with:
282-
name: FlexBridge_Online.exe
283-
- name: Download Offline Bundle
284-
uses: actions/download-artifact@v4
285-
with:
286-
name: FlexBridge_Offline.exe
287-
152+
uses: sillsdev/codesign/trusted-signing-action@v3
153+
with:
154+
credentials: ${{ secrets.TRUSTED_SIGNING_CREDENTIALS }}
155+
files-folder: BuildDir
156+
files-folder-filter: '*-engine.exe'
157+
description: 'FLExBridge installer burn engine - SIL Global'
158+
description-url: 'https://software.sil.org/fieldworks/help/using-sendreceive/flex-bridge/'
159+
288160
- name: Reattach Engines
161+
if: github.event_name != 'pull_request'
162+
working-directory: BuildDir
289163
shell: cmd
290164
run: |
291165
insignia -ab online-engine.exe FlexBridge_Online.exe -o FlexBridge_Online.exe
292166
insignia -ab offline-engine.exe FlexBridge_Offline.exe -o FlexBridge_Offline.exe
293167
294-
- name: Upload Online Bundle(attached)
295-
id: upload-online-bundle
296-
uses: actions/upload-artifact@v4
297-
with:
298-
name: FlexBridge_Online.exe
299-
path: FlexBridge_Online.exe
300-
if-no-files-found: error
301-
overwrite: true
168+
- name: Sign Offline Bundle
302169
if: github.event_name != 'pull_request'
303-
304-
- name: Upload Offline Bundle(attached)
305-
id: upload-offline-bundle
170+
uses: sillsdev/codesign/trusted-signing-action@v3
171+
with:
172+
credentials: ${{ secrets.TRUSTED_SIGNING_CREDENTIALS }}
173+
files-folder: src/WiXInstaller/BaseInstallerBuild
174+
files-folder-filter: FlexBridge_*.exe
175+
description: 'FLExBridge installer - SIL Global'
176+
description-url: 'https://software.sil.org/fieldworks/help/using-sendreceive/flex-bridge/'
177+
178+
- name: Sign Offline Bundle
179+
needs: reattach-engines
180+
if: github.event_name != 'pull_request'
181+
uses: sillsdev/codesign/.github/workflows/[email protected]
182+
with:
183+
artifact: FlexBridge_Offline.exe
184+
description: 'FLEx Bridge Installer'
185+
secrets:
186+
certificate: ${{ secrets.CODESIGN_LSDEVSECTIGOEV }}
187+
188+
- name: Upload Signed Installers
306189
uses: actions/upload-artifact@v4
307-
with:
308-
name: FlexBridge_Offline.exe
309-
path: FlexBridge_Offline.exe
310-
if-no-files-found: error
311-
overwrite: true
312190
if: github.event_name != 'pull_request'
313-
314-
- name: Cleanup Offline Engine
315-
uses: geekyeggo/delete-artifact@v5
316191
with:
317-
name: offline-engine
318-
319-
- name: Cleanup Online Engine
320-
uses: geekyeggo/delete-artifact@v5
321-
with:
322-
name: online-engine
323-
324-
sign-offline-bundle:
325-
name: Sign Offline Bundle
326-
needs: reattach-engines
327-
if: github.event_name != 'pull_request'
328-
uses: sillsdev/codesign/.github/workflows/[email protected]
329-
with:
330-
artifact: FlexBridge_Offline.exe
331-
description: 'FLEx Bridge Installer'
332-
secrets:
333-
certificate: ${{ secrets.CODESIGN_LSDEVSECTIGOEV }}
334-
335-
sign-online-bundle:
336-
name: Sign Online Bundle
337-
needs: reattach-engines
338-
if: github.event_name != 'pull_request'
339-
uses: sillsdev/codesign/.github/workflows/[email protected]
340-
with:
341-
artifact: FlexBridge_Online.exe
342-
description: 'FLEx Bridge Installer'
343-
secrets:
344-
certificate: ${{ secrets.CODESIGN_LSDEVSECTIGOEV }}
192+
name: nuget-packages
193+
path: output/*nupkg
194+
if-no-files-found: warn
345195

0 commit comments

Comments
 (0)