Skip to content

Harden CI: bind desktop-artifacts' version into env, not into the script #5913

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vivekchand merged 1 commit into from
Sep 12, 2026
Merged

Harden CI: bind desktop-artifacts' version into env, not into the script #5913

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 25 additions & 7 deletions .github/workflows/desktop-artifacts.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -455,8 +455,14 @@ jobs:
- name: Zip distribution folder
working-directory: dist
shell: pwsh
# The resolved version reaches the script through the environment
# rather than being expanded into it: a `${{ }}` substitution is
# textual, so the runner splices the value into the script body
# before pwsh ever parses it. Reading $Env: keeps it a value.
env:
APP_VERSION: ${{ steps.ver.outputs.version }}
run: |
$version = "${{ steps.ver.outputs.version }}"
$version = $Env:APP_VERSION
Compress-Archive -Path ClawMetry -DestinationPath "ClawMetry-$version-windows.zip"
# Fixed-name copy so clawmetry.com/download/windows-zip can link a
# stable URL (GitHub's /releases/latest/download/<name>) instead
Expand All @@ -478,6 +484,9 @@ jobs:
# wrapper reads CLAWMETRY_SIGN_PW from this step's environment.
env:
CLAWMETRY_SIGN_PW: ${{ secrets.WINDOWS_CERT_PASSWORD }}
# Same reasoning as the zip step above: bound as a value, not
# spliced into the script text.
APP_VERSION: ${{ steps.ver.outputs.version }}
run: |
$makensis = (where.exe makensis 2>$null | Select-Object -First 1)
if (-not $makensis) {
Expand All @@ -487,15 +496,16 @@ jobs:
# VIVERSION must be numeric x.y.z.w for VIProductVersion; releases
# are x.y.z so append .0 (non-numeric dev versions fall back to
# the script's 0.0.0.0 default by passing nothing).
$nsisArgs = @("/DVERSION=${{ steps.ver.outputs.version }}")
if ("${{ steps.ver.outputs.version }}" -match '^\d+\.\d+\.\d+$') { $nsisArgs += "/DVIVERSION=${{ steps.ver.outputs.version }}.0" }
$version = $Env:APP_VERSION
$nsisArgs = @("/DVERSION=$version")
if ($version -match '^\d+\.\d+\.\d+$') { $nsisArgs += "/DVIVERSION=${version}.0" }
if ($Env:SIGN_ENABLED -eq 'true') { $nsisArgs += "/DSIGN_CMD=$Env:SIGN_CMD" }
$nsisArgs += @("/DSRC_DIR=$PWD\dist\ClawMetry", "desktop\installer\windows.nsi")
& $makensis @nsisArgs
if ($LASTEXITCODE -ne 0) { throw "makensis failed with exit code $LASTEXITCODE" }
Move-Item "desktop\installer\ClawMetry-Setup-${{ steps.ver.outputs.version }}.exe" "dist\ClawMetry-Setup-${{ steps.ver.outputs.version }}.exe"
Move-Item "desktop\installer\ClawMetry-Setup-${version}.exe" "dist\ClawMetry-Setup-${version}.exe"
# Fixed-name copy — same stable-URL convention as the zip above.
Copy-Item "dist\ClawMetry-Setup-${{ steps.ver.outputs.version }}.exe" "dist\ClawMetry-windows-setup.exe" -Force
Copy-Item "dist\ClawMetry-Setup-${version}.exe" "dist\ClawMetry-windows-setup.exe" -Force

# Verify the artifact, not the build log (FLYWHEEL §0b.5): a chained
# Authenticode signature must actually be on the setup exe and the
Expand Down Expand Up @@ -632,8 +642,12 @@ jobs:

- name: Tarball distribution folder
working-directory: dist
# Bound through the environment rather than expanded into the script
# body — see the Windows zip step for the reasoning.
env:
APP_VERSION: ${{ steps.ver.outputs.version }}
run: |
VERSION="${{ steps.ver.outputs.version }}"
VERSION="$APP_VERSION"
tar czf "clawmetry-${VERSION}-linux-x86_64.tar.gz" clawmetry
# Fixed-name copy so clawmetry.com/download/linux-tarball can link
# a stable URL (GitHub's /releases/latest/download/<name>) instead
Expand All @@ -649,9 +663,13 @@ jobs:
# containers).
- name: Build AppImage
working-directory: dist
# Bound through the environment rather than expanded into the script
# body — see the Windows zip step for the reasoning.
env:
APP_VERSION: ${{ steps.ver.outputs.version }}
run: |
set -e
VERSION="${{ steps.ver.outputs.version }}"
VERSION="$APP_VERSION"
APPDIR="ClawMetry.AppDir"
mkdir -p "$APPDIR/usr/bin"
cp -r clawmetry/. "$APPDIR/usr/bin/"
Expand Down
Loading