forked from git-ecosystem/git-credential-manager
-
Notifications
You must be signed in to change notification settings - Fork 6
133 lines (113 loc) · 3.73 KB
/
release.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
name: release
on:
workflow_dispatch:
permissions:
id-token: write
contents: write
jobs:
prereqs:
name: Prerequisites
runs-on: ubuntu-latest
outputs:
version: ${{ steps.version.outputs.version }}
steps:
- uses: actions/checkout@v4
- name: Set version
run: echo "version=$(cat VERSION | sed -E 's/.[0-9]+$//')" >> $GITHUB_OUTPUT
id: version
# ================================
# .NET Tool
# ================================
dotnet-tool-build:
name: Build .NET tool
runs-on: ubuntu-latest
needs: prereqs
steps:
- uses: actions/checkout@v4
- name: Set up .NET
uses: actions/[email protected]
with:
dotnet-version: 7.0.x
- name: Build .NET tool
run: |
src/shared/DotnetTool/layout.sh --configuration=Release
- name: Upload .NET tool artifacts
uses: actions/upload-artifact@v4
with:
name: tmp.dotnet-tool-build
path: |
out/shared/DotnetTool/nupkg/Release
dotnet-tool-payload-sign:
name: Sign .NET tool payload
# ESRP service requires signing to run on Windows
runs-on: windows-latest
environment: release
needs: dotnet-tool-build
steps:
- uses: actions/checkout@v4
- name: Download payload
uses: actions/download-artifact@v4
with:
name: tmp.dotnet-tool-build
- name: Log into Azure
uses: azure/login@v1
with:
client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
- name: Download/extract Sign CLI tool
shell: pwsh
run: |
az storage blob download --file sign-cli.zip --auth-mode login `
--account-name $env:AZURE_STORAGE_ACCOUNT --container `
$env:AZURE_STORAGE_CONTAINER --name $env:SIGN_CLI_TOOL
Expand-Archive -Path sign-cli.zip -DestinationPath .\sign-cli
- name: Sign payload
shell: pwsh
run: |
./sign-cli/sign.exe code azcodesign payload/* `
-acsu https://wus2.codesigning.azure.net/ `
-acsa git-fundamentals-signing `
-acscp git-fundamentals-windows-signing `
-d "Git Fundamentals Windows Signing Certificate" `
-u "https://github.com/git-ecosystem/git-credential-manager" `
-acsm true
- name: Lay out signed payload, images, and symbols
shell: bash
run: |
mkdir dotnet-tool-payload-sign
rm -rf payload
mv images payload.sym -t dotnet-tool-payload-sign
unzip signed/payload.zip -d dotnet-tool-payload-sign
- name: Upload signed payload
uses: actions/upload-artifact@v4
with:
name: dotnet-tool-payload-sign
path: |
dotnet-tool-payload-sign
dotnet-tool-pack:
name: Package .NET tool
runs-on: ubuntu-latest
needs: [prereqs, dotnet-tool-payload-sign]
steps:
- uses: actions/checkout@v4
- name: Download signed payload
uses: actions/download-artifact@v4
with:
name: dotnet-tool-payload-sign
path: signed
- name: Set up .NET
uses: actions/[email protected]
with:
dotnet-version: 7.0.x
- name: Package tool
run: |
src/shared/DotnetTool/pack.sh --configuration=Release \
--version="${{ needs.prereqs.outputs.version }}" \
--publish-dir=$(pwd)/signed
- name: Upload unsigned package
uses: actions/upload-artifact@v4
with:
name: tmp.dotnet-tool-package-unsigned
path: |
out/shared/DotnetTool/nupkg/Release/*.nupkg