gmail-cli/.github/workflows/release.yml at main · nks-hub/gmail-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Set up Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Run tests
        run: bun test

      - name: Build cross-platform binaries
        run: |
          mkdir -p dist
          build() {
            echo "Building $2"
            bun build src/index.ts --compile --target="$1" --outfile "dist/$2"
          }
          build bun-windows-x64  gmail-windows-x64.exe
          build bun-darwin-x64   gmail-darwin-x64
          build bun-darwin-arm64 gmail-darwin-arm64
          build bun-linux-x64    gmail-linux-x64
          build bun-linux-arm64  gmail-linux-arm64

      # Optional Authenticode signing of the Windows binary. Inactive until the
      # repository is enrolled in the SignPath Foundation open-source program
      # and the SIGNPATH_ORGANIZATION_ID variable and SIGNPATH_API_TOKEN secret
      # are configured. Until then the release ships unsigned binaries plus
      # SHA-256 checksums.
      - name: Upload Windows binary for signing
        if: ${{ vars.SIGNPATH_ORGANIZATION_ID != '' }}
        id: unsigned-artifact
        uses: actions/upload-artifact@v7
        with:
          name: gmail-windows-x64-unsigned
          path: dist/gmail-windows-x64.exe

      - name: Submit SignPath signing request
        if: ${{ vars.SIGNPATH_ORGANIZATION_ID != '' }}
        uses: signpath/github-action-submit-signing-request@v2
        with:
          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
          organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
          project-slug: gmail-cli
          signing-policy-slug: release-signing
          artifact-configuration-slug: windows-binary
          github-artifact-id: ${{ steps.unsigned-artifact.outputs.artifact-id }}
          wait-for-completion: true
          output-artifact-directory: dist

      - name: Generate checksums
        run: |
          cd dist
          sha256sum gmail-* > SHA256SUMS
          cat SHA256SUMS

      - name: Publish GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          files: |
            dist/gmail-*
            dist/SHA256SUMS
          generate_release_notes: true