From a9359a3924494eada957cbaf8ea30b6b93da9b39 Mon Sep 17 00:00:00 2001 From: Neko Ayaka Date: Sun, 26 Apr 2026 05:43:57 +0800 Subject: [PATCH] chore(ci): skip windows if signpath.io failed to sign us --- .github/workflows/release-tamagotchi.yml | 42 +++++++++++++++++++++--- 1 file changed, 38 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release-tamagotchi.yml b/.github/workflows/release-tamagotchi.yml index cd2cd2716..cda028786 100644 --- a/.github/workflows/release-tamagotchi.yml +++ b/.github/workflows/release-tamagotchi.yml @@ -245,6 +245,8 @@ jobs: path: apps/stage-tamagotchi/bundle/${{ env.FLATPAK_BUNDLE_NAME }} - name: Sign Windows Artifacts with SignPath (Nightly + Windows Only) + id: signpath-nightly-windows + continue-on-error: true uses: signpath/github-action-submit-signing-request@v2 if: ${{ github.event_name == 'schedule' && (matrix.os == 'windows-latest' && github.repository == 'moeru-ai/airi') }} with: @@ -259,23 +261,41 @@ jobs: download-signed-artifact-timeout-in-seconds: 900 # 15 minutes output-artifact-directory: apps/stage-tamagotchi/bundle/signed/windows/ + - name: Warn When Windows Signing Fails (Nightly) + if: ${{ github.event_name == 'schedule' && matrix.os == 'windows-latest' && steps.signpath-nightly-windows.outcome != 'success' }} + run: | + echo "::warning::SignPath Windows signing failed for nightly build. Continuing with unsigned artifact at apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}." + - name: Upload Signed Artifacts (Nightly + Non-Linux) - if: ${{ github.event_name == 'schedule' && (matrix.os == 'windows-latest') }} + if: ${{ github.event_name == 'schedule' && matrix.os == 'windows-latest' && steps.signpath-nightly-windows.outcome == 'success' }} uses: actions/upload-artifact@v7 with: name: ${{ env.BUNDLE_NAME }} path: apps/stage-tamagotchi/bundle/signed/windows/${{ env.BUNDLE_NAME }} overwrite: true + - name: Upload Unsigned Windows Artifacts Fallback (Nightly) + if: ${{ github.event_name == 'schedule' && matrix.os == 'windows-latest' && steps.signpath-nightly-windows.outcome != 'success' }} + uses: actions/upload-artifact@v7 + with: + name: ${{ env.BUNDLE_NAME }} + path: apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }} + overwrite: true + # NOTICE: Electron Builder generates latest-x64.yml during the build step, before this workflow # submits the Windows installer to SignPath. SignPath re-signs the .exe and changes its bytes, # which changes the updater hashes too. Regenerating latest-x64.yml from the signed installer keeps # the published Windows update metadata aligned with the final released artifact. - name: Regenerate Windows latest-x64.yml (Nightly + Windows Only) - if: ${{ github.event_name == 'schedule' && matrix.os == 'windows-latest' }} + if: ${{ github.event_name == 'schedule' && matrix.os == 'windows-latest' && steps.signpath-nightly-windows.outcome == 'success' }} run: | pnpm -F @proj-airi/stage-tamagotchi run regenerate-windows-latest --input apps/stage-tamagotchi/bundle/signed/windows/${{ env.BUNDLE_NAME }} --output apps/stage-tamagotchi/bundle/latest-x64.yml --version ${{ env.VERSION }} + - name: Regenerate Windows latest-x64.yml From Unsigned Artifact (Nightly Fallback) + if: ${{ github.event_name == 'schedule' && matrix.os == 'windows-latest' && steps.signpath-nightly-windows.outcome != 'success' }} + run: | + pnpm -F @proj-airi/stage-tamagotchi run regenerate-windows-latest --input apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }} --output apps/stage-tamagotchi/bundle/latest-x64.yml --version ${{ env.VERSION }} + # --------- # Workflow Dispatch only # --------- @@ -342,6 +362,8 @@ jobs: path: apps/stage-tamagotchi/bundle/${{ env.FLATPAK_BUNDLE_NAME }} - name: Sign Windows Artifacts with SignPath (Manual + Windows Only) + id: signpath-manual-windows + continue-on-error: true uses: signpath/github-action-submit-signing-request@v2 if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && inputs.artifacts_only && (matrix.os == 'windows-latest' && github.repository == 'moeru-ai/airi') }} with: @@ -356,8 +378,13 @@ jobs: download-signed-artifact-timeout-in-seconds: 900 # 15 minutes output-artifact-directory: apps/stage-tamagotchi/bundle/signed/windows/ + - name: Warn When Windows Signing Fails (Manual) + if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && inputs.artifacts_only && matrix.os == 'windows-latest' && steps.signpath-manual-windows.outcome != 'success' }} + run: | + echo "::warning::SignPath Windows signing failed for workflow_dispatch artifact build. Continuing with unsigned artifact at apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}." + - name: Move Signed Artifacts (Manual + Release + Windows Only) - if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && inputs.artifacts_only && matrix.os == 'windows-latest' }} + if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && inputs.artifacts_only && matrix.os == 'windows-latest' && steps.signpath-manual-windows.outcome == 'success' }} run: | Move-Item -Force apps/stage-tamagotchi/bundle/signed/windows/${{ env.BUNDLE_NAME }} apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }} @@ -423,6 +450,8 @@ jobs: path: apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }} - name: Sign Windows Artifacts with SignPath (Nightly + Windows Only) + id: signpath-release-windows + continue-on-error: true uses: signpath/github-action-submit-signing-request@v2 if: ${{ github.event_name == 'release' && (matrix.os == 'windows-latest' && github.repository == 'moeru-ai/airi') }} with: @@ -437,8 +466,13 @@ jobs: download-signed-artifact-timeout-in-seconds: 900 # 15 minutes output-artifact-directory: apps/stage-tamagotchi/bundle/signed/windows/ + - name: Warn When Windows Signing Fails (Release) + if: ${{ github.event_name == 'release' && matrix.os == 'windows-latest' && steps.signpath-release-windows.outcome != 'success' }} + run: | + echo "::warning::SignPath Windows signing failed for release build. Continuing with unsigned artifact at apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}." + - name: Move Signed Artifacts (Automatic + Windows Only) - if: ${{ github.event_name == 'release' && matrix.os == 'windows-latest' }} + if: ${{ github.event_name == 'release' && matrix.os == 'windows-latest' && steps.signpath-release-windows.outcome == 'success' }} run: | Move-Item -Force apps/stage-tamagotchi/bundle/signed/windows/${{ env.BUNDLE_NAME }} apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}