wehub-resource-sync
8f10353f0c
CI / lint (push) Has been cancelled
CI / js-syntax (push) Successful in 10m24s
CI / deps-audit (push) Has been cancelled
CI / test (push) Failing after 24m55s
CI / sast-bandit (push) Failing after 11m13s
CI / trivy (push) Failing after 9m32s
Docker Publish / build-and-push (push) Failing after 34m3s
104 lines
4.0 KiB
YAML
104 lines
4.0 KiB
YAML
name: Windows Release
|
|
|
|
on:
|
|
release:
|
|
types: [published]
|
|
|
|
permissions: {}
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
build-and-upload:
|
|
# Runner must be windows/x64 with PowerShell, Docker, and rustup.
|
|
runs-on: [self-hosted, windows, x64]
|
|
timeout-minutes: 90
|
|
permissions:
|
|
contents: write
|
|
# Source the tag from the github context (evaluated by Actions) rather than
|
|
# $env:GITHUB_REF_NAME, which is only injected by runner >= 2.290. Keeps the
|
|
# build working on older self-hosted runners. (#212 follow-up)
|
|
env:
|
|
REF_NAME: ${{ github.ref_name }}
|
|
defaults:
|
|
run:
|
|
shell: powershell
|
|
steps:
|
|
- name: clean workspace
|
|
run: |
|
|
Remove-Item -Recurse -Force .build, dist -ErrorAction SilentlyContinue
|
|
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
|
|
- name: write version files
|
|
run: |
|
|
$tag = $env:REF_NAME
|
|
if (-not $tag) { throw "REF_NAME is not set" }
|
|
$version = $tag -replace '^v', ''
|
|
$json = "{`"version`": `"$version`"}"
|
|
Set-Content -Path "static/version.json" -Value $json -Encoding UTF8
|
|
(Get-Content "desktop/src-tauri/Cargo.toml") -replace '^version = ".*"', "version = `"$version`"" |
|
|
Set-Content "desktop/src-tauri/Cargo.toml"
|
|
(Get-Content "desktop/src-tauri/tauri.conf.json") -replace '"version": "[^"]*"', "`"version`": `"$version`"" |
|
|
Set-Content "desktop/src-tauri/tauri.conf.json"
|
|
(Get-Content "pyproject.toml") -replace '^version = ".*"', "version = `"$version`"" |
|
|
Set-Content "pyproject.toml"
|
|
(Get-Content "desktop/package.json") -replace '"version": "[^"]*"', "`"version`": `"$version`"" |
|
|
Set-Content "desktop/package.json"
|
|
Write-Host "Wrote version $version to all version files"
|
|
|
|
- name: build Windows NVIDIA
|
|
run: |
|
|
powershell -NoProfile -ExecutionPolicy Bypass -File scripts/windows/make-portable.ps1 `
|
|
-PackageName StemDeck-Windows-x64.NVIDIA `
|
|
-PackageVersion "$env:REF_NAME" `
|
|
-StripVenv
|
|
|
|
- name: build Windows CPU
|
|
run: |
|
|
powershell -NoProfile -ExecutionPolicy Bypass -File scripts/windows/make-portable.ps1 `
|
|
-PackageName StemDeck-Windows-x64 `
|
|
-PackageVersion "$env:REF_NAME" `
|
|
-CpuOnly `
|
|
-StripVenv
|
|
|
|
- name: scan artifacts
|
|
run: |
|
|
Write-Host "Preparing ClamAV scan for Windows release artifacts..."
|
|
Write-Host "Artifacts staged in: $PWD\dist"
|
|
Get-ChildItem -Path "dist" -File |
|
|
Sort-Object Name |
|
|
Select-Object Name,
|
|
@{Name="SizeMB"; Expression={ [math]::Round($_.Length / 1MB, 2) }} |
|
|
Format-Table -AutoSize
|
|
|
|
Write-Host "SHA256 checksums:"
|
|
Get-ChildItem -Path "dist" -Filter "*.zip" -File |
|
|
Sort-Object Name |
|
|
ForEach-Object {
|
|
$hash = Get-FileHash -Algorithm SHA256 $_.FullName
|
|
Write-Host " $($hash.Hash) $($_.Name)"
|
|
}
|
|
|
|
Write-Host "Pulling latest ClamAV scanner image..."
|
|
docker pull clamav/clamav:latest
|
|
|
|
Write-Host "Running ClamAV scan over dist/..."
|
|
docker run --rm -v "${PWD}/dist:/scan:ro" clamav/clamav:latest `
|
|
clamscan --recursive --infected --bell /scan
|
|
if ($LASTEXITCODE -ne 0) {
|
|
throw "ClamAV scan failed or reported infected files. Exit code: $LASTEXITCODE"
|
|
}
|
|
Write-Host "ClamAV scan completed successfully. No infected files reported."
|
|
|
|
- name: upload artifacts
|
|
uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
|
|
with:
|
|
files: |
|
|
dist/StemDeck-Windows-x64.NVIDIA.zip
|
|
dist/StemDeck-Windows-x64.NVIDIA.zip.sha256
|
|
dist/StemDeck-Windows-x64.zip
|
|
dist/StemDeck-Windows-x64.zip.sha256
|