chore(ci): windows signing

2026-03-04 15:30:50 +08:00
parent d0b67ab639
commit db8952234f
1 changed files with 115 additions and 4 deletions
@@ -2,6 +2,7 @@ name: Release Tamagotchi

 permissions:
  contents: write
+  actions: read

 env:
  BUNDLE_NAME: ''
@@ -214,6 +215,7 @@ jobs:

      - name: Upload Artifacts (Nightly + Non-Linux)
        if: ${{ github.event_name == 'schedule' && (matrix.os != 'ubuntu-latest' && matrix.os != 'ubuntu-24.04-arm') }}
+        id: unsigned-artifacts-nightly
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.BUNDLE_NAME }}
@@ -240,6 +242,31 @@ jobs:
          name: ${{ env.FLATPAK_BUNDLE_NAME }}
          path: apps/stage-tamagotchi/bundle/${{ env.FLATPAK_BUNDLE_NAME }}

+      - name: Sign Windows Artifacts with SignPath (Nightly + Windows Only)
+        uses: signpath/github-action-submit-signing-request@v2
+        if: ${{ github.event_name == 'schedule' && (matrix.os == 'windows-latest' && github.repository == 'moeru-ai/airi') }}
+        with:
+          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
+          organization-id: '${{ vars.SIGNPATH_ORGANIZATION_ID }}'
+          project-slug: 'airi'
+          github-artifact-id: '${{ steps.unsigned-artifacts-nightly.outputs.artifact-id }}'
+          signing-policy-slug: 'test-signing'
+          wait-for-completion: true
+          output-artifact-directory: apps/stage-tamagotchi/bundle/signed/windows/
+
+      - name: Debug Windows Signed Artifacts (Nightly + Windows Only)
+        if: ${{ github.event_name == 'schedule' && matrix.os == 'windows-latest' }}
+        run: |
+          ls apps/stage-tamagotchi/bundle/signed/windows/
+
+      - name: Upload Signed Artifacts (Nightly + Non-Linux)
+        if: ${{ github.event_name == 'schedule' && (matrix.os == 'windows-latest') }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: ${{ env.BUNDLE_NAME }}
+          path: apps/stage-tamagotchi/bundle/signed/windows/${{ env.BUNDLE_NAME }}
+          overwrite: true
+
      # ---------
      # Workflow Dispatch only
      # ---------
@@ -278,6 +305,7 @@ jobs:

      - name: Upload Artifacts (Manual + Non-Release + Non-Linux)
        if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && inputs.artifacts_only && (matrix.os != 'ubuntu-latest' && matrix.os != 'ubuntu-24.04-arm') }}
+        id: unsigned-artifacts-workflow-dispatch
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.BUNDLE_NAME }}
@@ -304,17 +332,63 @@ jobs:
          name: ${{ env.FLATPAK_BUNDLE_NAME }}
          path: apps/stage-tamagotchi/bundle/${{ env.FLATPAK_BUNDLE_NAME }}

+      - name: Upload Artifacts (Manual + Release + Windows Only)
+        if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && !inputs.artifacts_only && matrix.os == 'windows-latest' }}
+        id: unsigned-artifacts-workflow-dispatch-release
+        uses: actions/upload-artifact@v7
+        with:
+          name: ${{ env.BUNDLE_NAME }}
+          path: apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}
+
+      - name: Sign Windows Artifacts with SignPath (Nightly + Windows Only)
+        uses: signpath/github-action-submit-signing-request@v2
+        if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && !inputs.artifacts_only && (matrix.os == 'windows-latest' && github.repository == 'moeru-ai/airi') }}
+        with:
+          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
+          organization-id: '${{ vars.SIGNPATH_ORGANIZATION_ID }}'
+          project-slug: 'airi'
+          github-artifact-id: '${{ steps.unsigned-artifacts-workflow-dispatch-release.outputs.artifact-id }}'
+          signing-policy-slug: 'test-signing'
+          wait-for-completion: true
+          output-artifact-directory: apps/stage-tamagotchi/bundle/signed/windows/
+
+      - name: Debug Windows Signed Artifacts (Nightly + Windows Only)
+        if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && !inputs.artifacts_only && matrix.os == 'windows-latest' }}
+        run: |
+          ls apps/stage-tamagotchi/bundle/signed/windows/
+
+      - name: Upload Signed Artifacts (Nightly + Non-Linux)
+        if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && !inputs.artifacts_only && (matrix.os == 'windows-latest') }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: ${{ env.BUNDLE_NAME }}
+          path: apps/stage-tamagotchi/bundle/signed/windows/${{ env.BUNDLE_NAME }}
+          overwrite: true
+
+      - name: Move Signed Artifacts (Manual + Release + Windows Only)
+        if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && !inputs.artifacts_only && matrix.os == 'windows-latest' }}
+        run: |
+          mv apps/stage-tamagotchi/bundle/signed/windows/${{ env.BUNDLE_NAME }} apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}
+
      - name: Upload To GitHub Releases (Manual + Overwrite Release)
        if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && !inputs.artifacts_only }}
        uses: softprops/action-gh-release@v2
        with:
-          files: apps/stage-tamagotchi/bundle/${{ env.PRODUCT_NAME }}_*
+          files: |
+            apps/stage-tamagotchi/bundle/${{ env.PRODUCT_NAME }}-*.exe
+            apps/stage-tamagotchi/bundle/${{ env.PRODUCT_NAME }}-*.zip
+            apps/stage-tamagotchi/bundle/${{ env.PRODUCT_NAME }}-*.dmg
+            apps/stage-tamagotchi/bundle/${{ env.PRODUCT_NAME }}-*.deb
+            apps/stage-tamagotchi/bundle/${{ env.PRODUCT_NAME }}-*.rpm
+            apps/stage-tamagotchi/bundle/${{ env.PRODUCT_NAME }}-*.flatpak
+            apps/stage-tamagotchi/bundle/latest.yml
+            apps/stage-tamagotchi/bundle/latest-*.yml
          append_body: true
          tag_name: ${{ inputs.tag }}

-        # ---------
-        # Version push
-        # ---------
+      # ---------
+      # Version push
+      # ---------

      - name: Rename Artifacts (Automatic)
        if: ${{ github.event_name == 'release' }}
@@ -329,6 +403,43 @@ jobs:
          path: apps/stage-tamagotchi/bundle/latest-mac.yml
          if-no-files-found: error

+      - name: Get Artifacts Envs (Automatic + Windows Only)
+        if: ${{ github.event_name == 'release' && matrix.os == 'windows-latest' }}
+        working-directory: ./apps/stage-tamagotchi
+        run: |
+          echo "BUNDLE_NAME=$(pnpm exec tsx scripts/artifacts-metadata.ts ${{ matrix.target }} --get-bundle-name --release ${{ !inputs.build_only && !inputs.artifacts_only }} --tag ${{ inputs.tag }} --auto-tag ${{ !inputs.build_only }})" >> $env:GITHUB_ENV
+          echo "VERSION=$(pnpm exec tsx scripts/artifacts-metadata.ts ${{ matrix.target }} --get-version --release ${{ !inputs.build_only && !inputs.artifacts_only }} --tag ${{ inputs.tag }} --auto-tag ${{ !inputs.build_only }})" >> $env:GITHUB_ENV
+
+      - name: Upload Artifacts (Automatic + Windows Only)
+        if: ${{ github.event_name == 'release' && matrix.os == 'windows-latest' }}
+        id: unsigned-artifacts-release
+        uses: actions/upload-artifact@v7
+        with:
+          name: ${{ env.BUNDLE_NAME }}
+          path: apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}
+
+      - name: Sign Windows Artifacts with SignPath (Nightly + Windows Only)
+        uses: signpath/github-action-submit-signing-request@v2
+        if: ${{ github.event_name == 'release' && (matrix.os == 'windows-latest' && github.repository == 'moeru-ai/airi') }}
+        with:
+          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
+          organization-id: '${{ vars.SIGNPATH_ORGANIZATION_ID }}'
+          project-slug: 'airi'
+          github-artifact-id: '${{ steps.unsigned-artifacts-release.outputs.artifact-id }}'
+          signing-policy-slug: 'test-signing'
+          wait-for-completion: true
+          output-artifact-directory: apps/stage-tamagotchi/bundle/signed/windows/
+
+      - name: Debug Windows Signed Artifacts (Nightly + Windows Only)
+        if: ${{ github.event_name == 'release' && matrix.os == 'windows-latest' }}
+        run: |
+          ls apps/stage-tamagotchi/bundle/signed/windows/
+
+      - name: Move Signed Artifacts (Automatic + Windows Only)
+        if: ${{ github.event_name == 'release' && matrix.os == 'windows-latest' }}
+        run: |
+          mv apps/stage-tamagotchi/bundle/signed/windows/${{ env.BUNDLE_NAME }} apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}
+
      - name: Upload To GitHub Releases (Automatic)
        if: ${{ github.event_name == 'release' }}
        uses: softprops/action-gh-release@v2