96 lines
4.1 KiB
YAML
96 lines
4.1 KiB
YAML
name: ForgeFlow signed release
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- package.json
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
code: read
|
|
releases: write
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: windows-native
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 2
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
- name: Build, sign and publish version bump
|
|
shell: powershell
|
|
env:
|
|
GITEA_EVENT_NAME: ${{ gitea.event_name }}
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
FORGEFLOW_RELEASE_BASE_URL: ${{ gitea.server_url }}
|
|
FORGEFLOW_RELEASE_OWNER: Jens
|
|
FORGEFLOW_RELEASE_REPO: ForgeFlow
|
|
FORGEFLOW_RELEASE_BRANCH: main
|
|
FORGEFLOW_RELEASE_SIGNING_KEY_PEM: ${{ secrets.FORGEFLOW_RELEASE_SIGNING_KEY_PEM }}
|
|
run: |
|
|
$ErrorActionPreference = "Stop"
|
|
Set-StrictMode -Version Latest
|
|
|
|
$manifest = Get-Content -LiteralPath "package.json" -Raw | ConvertFrom-Json
|
|
$version = [string]$manifest.version
|
|
$previousVersion = ""
|
|
try {
|
|
$previousJson = (& git show "HEAD^:package.json" 2>$null | Out-String)
|
|
if ($LASTEXITCODE -eq 0 -and $previousJson.Trim()) {
|
|
$previousVersion = [string](ConvertFrom-Json $previousJson).version
|
|
}
|
|
} catch {
|
|
$previousVersion = ""
|
|
}
|
|
|
|
if ($env:GITEA_EVENT_NAME -eq "push" -and $previousVersion -eq $version) {
|
|
Write-Host "package.json changed without a version bump ($version); no release will be published."
|
|
exit 0
|
|
}
|
|
if ($version -notmatch '^\d+\.\d+\.\d+$') {
|
|
throw "ForgeFlow version '$version' is not a stable semantic version."
|
|
}
|
|
|
|
if ($env:FORGEFLOW_RELEASE_SIGNING_KEY_PEM) {
|
|
$privateKeyPath = Join-Path $env:RUNNER_TEMP "forgeflow-release-signing-private.pem"
|
|
$utf8NoBom = New-Object System.Text.UTF8Encoding($false)
|
|
[System.IO.File]::WriteAllText($privateKeyPath, $env:FORGEFLOW_RELEASE_SIGNING_KEY_PEM, $utf8NoBom)
|
|
$env:FORGEFLOW_UPDATE_SIGNING_PRIVATE_KEY = $privateKeyPath
|
|
}
|
|
|
|
$effectiveKeyPath = if ($env:FORGEFLOW_UPDATE_SIGNING_PRIVATE_KEY) {
|
|
$env:FORGEFLOW_UPDATE_SIGNING_PRIVATE_KEY
|
|
} else {
|
|
Join-Path $env:APPDATA "forgeflow\release-signing-private.pem"
|
|
}
|
|
if (-not (Test-Path -LiteralPath $effectiveKeyPath)) {
|
|
throw "ForgeFlow release signing key is not provisioned for the windows-native runner. Provision the existing Ed25519 private key as FORGEFLOW_RELEASE_SIGNING_KEY_PEM or at $effectiveKeyPath."
|
|
}
|
|
if (-not $env:GITEA_TOKEN) {
|
|
throw "Gitea Actions did not provide GITEA_TOKEN to the release job."
|
|
}
|
|
|
|
& cmd.exe /d /s /c "npm ci --no-audit --no-fund"
|
|
if ($LASTEXITCODE -ne 0) { throw "npm ci failed." }
|
|
& cmd.exe /d /s /c "npx electron --version"
|
|
if ($LASTEXITCODE -ne 0) { throw "Electron preflight failed." }
|
|
& cmd.exe /d /s /c "npm run quality"
|
|
if ($LASTEXITCODE -ne 0) { throw "ForgeFlow release quality gate failed." }
|
|
& cmd.exe /d /s /c "npx playwright install chromium"
|
|
if ($LASTEXITCODE -ne 0) { throw "Playwright Chromium installation failed." }
|
|
& cmd.exe /d /s /c "npm run test:browser:ci"
|
|
if ($LASTEXITCODE -ne 0) { throw "ForgeFlow browser acceptance suite failed." }
|
|
& cmd.exe /d /s /c "npm audit --omit=dev --audit-level=high"
|
|
if ($LASTEXITCODE -ne 0) { throw "ForgeFlow production dependency audit failed." }
|
|
& cmd.exe /d /s /c "npm run dist:win"
|
|
if ($LASTEXITCODE -ne 0) { throw "ForgeFlow Windows build/signing failed." }
|
|
& cmd.exe /d /s /c "npm run release:binary"
|
|
if ($LASTEXITCODE -ne 0) { throw "ForgeFlow Gitea release publication failed." }
|
|
|
|
Write-Host "ForgeFlow $version was fully validated, built, signed and published from exact main HEAD $env:GITEA_SHA."
|