CI: skip Windows signing cleanly when Trusted Signing is unconfigured #21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| build-test: | |
| name: build + test (${{ matrix.cc }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| cc: [gcc, clang] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Build library + CLI | |
| run: make CC=${{ matrix.cc }} | |
| - name: Run test suite | |
| run: make test CC=${{ matrix.cc }} | |
| - name: Build example | |
| run: make example CC=${{ matrix.cc }} | |
| - name: Run example | |
| run: | | |
| LD_LIBRARY_PATH=. ./examples/example | |
| - name: Directory archive round-trip | |
| run: | | |
| mkdir -p tree/sub tree/empty | |
| cp README.md tree/a.txt | |
| printf 'nested\n' > tree/sub/b.txt | |
| ./squish c tree tree.sq | |
| ./squish d tree.sq tree-out | |
| diff -r tree tree-out | |
| test -d tree-out/empty | |
| windows-cross: | |
| name: cross-compile Windows DLL + CLI | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install mingw-w64 | |
| run: sudo apt-get update && sudo apt-get install -y gcc-mingw-w64-x86-64 | |
| - name: Build squish.dll + squish.exe | |
| run: make dll MINGW=x86_64-w64-mingw32-gcc MINGW_AR=x86_64-w64-mingw32-ar | |
| - name: Check artifacts exist | |
| run: test -f squish.dll && test -f squish.exe && test -f libsquish.dll.a | |
| windows-msvc: | |
| name: native Windows MSVC build (build-windows.bat) | |
| runs-on: windows-latest | |
| permissions: | |
| id-token: write # request the OIDC federated token for Azure login | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Build squish.dll + squish.exe | |
| shell: cmd | |
| run: build-windows.bat | |
| - name: Round-trip smoke test | |
| shell: cmd | |
| run: | | |
| squish.exe c README.md readme.sq | |
| squish.exe d readme.sq readme.out | |
| fc /b README.md readme.out | |
| - name: Directory archive round-trip | |
| shell: cmd | |
| run: | | |
| mkdir tree\sub | |
| copy README.md tree\a.txt | |
| echo nested> tree\sub\b.txt | |
| squish.exe c tree tree.sq | |
| squish.exe d tree.sq tree-out | |
| fc /b tree\a.txt tree-out\a.txt | |
| fc /b tree\sub\b.txt tree-out\sub\b.txt | |
| # --- Azure Trusted Signing ------------------------------------------------ | |
| # Sign the built binaries only on pushes to main: pull requests (especially | |
| # from forks) cannot access OIDC tokens or secrets, so signing would fail | |
| # there. Authentication is OIDC federated — azure/login exchanges the | |
| # GitHub id-token for an Azure credential, so no long-lived secret is | |
| # stored. Configure in the repo settings: | |
| # Secrets: AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_SUBSCRIPTION_ID | |
| # (the app registration must have a federated credential trusting this | |
| # repo, and a role granting access to the Trusted Signing account) | |
| # Variables: TRUSTED_SIGNING_ENDPOINT, TRUSTED_SIGNING_ACCOUNT, | |
| # TRUSTED_SIGNING_PROFILE | |
| # | |
| # Until those are configured the signing steps below are skipped (not | |
| # failed), so main stays green. The check reads the values via env — the | |
| # secrets context can't be tested directly in an `if:` — and gates the | |
| # rest on its `enabled` output. | |
| - name: Check Trusted Signing config | |
| id: signcfg | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| shell: bash | |
| env: | |
| AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }} | |
| AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }} | |
| AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | |
| TS_ENDPOINT: ${{ vars.TRUSTED_SIGNING_ENDPOINT }} | |
| TS_ACCOUNT: ${{ vars.TRUSTED_SIGNING_ACCOUNT }} | |
| TS_PROFILE: ${{ vars.TRUSTED_SIGNING_PROFILE }} | |
| run: | | |
| if [ -n "$AZURE_CLIENT_ID" ] && [ -n "$AZURE_TENANT_ID" ] && \ | |
| [ -n "$AZURE_SUBSCRIPTION_ID" ] && [ -n "$TS_ENDPOINT" ] && \ | |
| [ -n "$TS_ACCOUNT" ] && [ -n "$TS_PROFILE" ]; then | |
| echo "enabled=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "enabled=false" >> "$GITHUB_OUTPUT" | |
| echo "::notice::Azure Trusted Signing not configured (secrets/variables unset); skipping signing." | |
| fi | |
| - name: Azure login (OIDC federated) | |
| if: steps.signcfg.outputs.enabled == 'true' | |
| uses: azure/login@v2 | |
| with: | |
| client-id: ${{ secrets.AZURE_CLIENT_ID }} | |
| tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
| subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | |
| - name: Sign squish.exe + squish.dll (Azure Trusted Signing) | |
| if: steps.signcfg.outputs.enabled == 'true' | |
| uses: azure/trusted-signing-action@v0 | |
| with: | |
| endpoint: ${{ vars.TRUSTED_SIGNING_ENDPOINT }} | |
| trusted-signing-account-name: ${{ vars.TRUSTED_SIGNING_ACCOUNT }} | |
| certificate-profile-name: ${{ vars.TRUSTED_SIGNING_PROFILE }} | |
| files: | | |
| ${{ github.workspace }}\squish.exe | |
| ${{ github.workspace }}\squish.dll | |
| - name: Upload signed binaries | |
| if: steps.signcfg.outputs.enabled == 'true' | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: squish-windows-signed | |
| path: | | |
| squish.exe | |
| squish.dll |