FlowAD/.github/workflows/release.yml at main · flowdevs-io/FlowAD · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
name: Release FlowAD

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: write

jobs:
  build-and-sign:
    name: Build & Sign FlowAD Executables
    runs-on: windows-latest

    steps:
    - name: Checkout Repository
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 pinned SHA

    - name: Setup .NET 10 SDK
      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v4 pinned SHA
      with:
        dotnet-version: '10.0.x'

    - name: Restore Dependencies
      run: dotnet restore FlowAD.slnx

    - name: Run Test Suite
      run: dotnet test FlowAD.slnx --configuration Release

    - name: Publish Windows Standalone Executable (win-x64)
      run: |
        dotnet publish src/FlowAD/FlowAD.csproj `
          -c Release `
          -r win-x64 `
          --self-contained true `
          -p:PublishSingleFile=true `
          -p:PublishTrimmed=true `
          -p:TrimMode=partial `
          -p:EnableCompressionInSingleFile=true `
          -p:IncludeNativeLibrariesForSelfExtract=true `
          -o publish/win-x64

    - name: Sign Executable with FlowDevs Code Signing Certificate
      shell: pwsh
      env:
        FLOWDEVS_AZURE_SIGN_VAULT_URL: ${{ secrets.FLOWDEVS_AZURE_SIGN_VAULT_URL || secrets.FLOWRMM_AZURE_SIGN_VAULT_URL }}
        FLOWDEVS_AZURE_SIGN_CERT_NAME: ${{ secrets.FLOWDEVS_AZURE_SIGN_CERT_NAME || secrets.FLOWRMM_AZURE_SIGN_CERT_NAME }}
        FLOWDEVS_AZURE_SIGN_CLIENT_ID: ${{ secrets.FLOWDEVS_AZURE_SIGN_CLIENT_ID || secrets.FLOWRMM_AZURE_SIGN_CLIENT_ID }}
        FLOWDEVS_AZURE_SIGN_CLIENT_SECRET: ${{ secrets.FLOWDEVS_AZURE_SIGN_CLIENT_SECRET || secrets.FLOWRMM_AZURE_SIGN_CLIENT_SECRET }}
        FLOWDEVS_AZURE_SIGN_TENANT_ID: ${{ secrets.FLOWDEVS_AZURE_SIGN_TENANT_ID || secrets.FLOWRMM_AZURE_SIGN_TENANT_ID }}
        FLOWDEVS_AZURE_SIGN_TIMESTAMP_URL: ${{ vars.FLOWDEVS_AZURE_SIGN_TIMESTAMP_URL || vars.FLOWRMM_AZURE_SIGN_TIMESTAMP_URL || 'http://timestamp.globalsign.com/tsa/advanced' }}
      run: |
        ./scripts/Sign-FlowDomainArtifacts.ps1 -PublishDir publish/win-x64

    - name: Verify Authenticode Signature
      shell: pwsh
      run: |
        . ./scripts/_AuthenticodeValidation.ps1
        $exe = "publish/win-x64/flowad.exe"
        Write-Host "Verifying signature on $exe..."
        $sig = Get-AuthenticodeSignature -FilePath $exe
        if ($sig.Status -ne 'Valid') {
            throw "Authenticode signature verification failed: $($sig.StatusMessage)"
        }
        Write-Host "Authenticode Signature Valid. Signer: $($sig.SignerCertificate.Subject)"

    - name: Compress Release Archive
      shell: pwsh
      run: |
        Compress-Archive -Path "publish/win-x64/flowad.exe" -DestinationPath "flowad-win-x64.zip"

    - name: Create GitHub Release
      uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 pinned SHA
      with:
        files: |
          publish/win-x64/flowad.exe
          flowad-win-x64.zip
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}