From 10e78d617e3dd22358e23e85fa2b4a8b6cb5537c Mon Sep 17 00:00:00 2001 From: pengx17 Date: Wed, 31 Jul 2024 10:00:19 +0000 Subject: [PATCH] build(electron): re-enable windows signing (#7682) ref https://github.com/toeverything/AFFiNE/pull/7645 --- .github/workflows/release-desktop.yml | 277 ++++++++++---------------- 1 file changed, 103 insertions(+), 174 deletions(-) diff --git a/.github/workflows/release-desktop.yml b/.github/workflows/release-desktop.yml index 2569e104d..f64f1e01d 100644 --- a/.github/workflows/release-desktop.yml +++ b/.github/workflows/release-desktop.yml @@ -181,7 +181,7 @@ jobs: name: affine-${{ matrix.spec.platform }}-${{ matrix.spec.arch }}-builds path: builds - make-distribution-windows-skip-signing: + package-distribution-windows: strategy: matrix: spec: @@ -191,6 +191,8 @@ jobs: target: x86_64-pc-windows-msvc runs-on: ${{ matrix.spec.runner }} needs: before-make + outputs: + FILES_TO_BE_SIGNED: ${{ steps.get_files_to_be_signed.outputs.FILES_TO_BE_SIGNED }} env: SKIP_GENERATE_ASSETS: 1 SENTRY_ORG: ${{ secrets.SENTRY_ORG }} @@ -230,12 +232,111 @@ jobs: SKIP_WEB_BUILD: 1 HOIST_NODE_MODULES: 1 + - name: get all files to be signed + id: get_files_to_be_signed + run: | + Set-Variable -Name FILES_TO_BE_SIGNED -Value ((Get-ChildItem -Path packages/frontend/electron/out -Recurse -File | Where-Object { $_.Extension -in @(".exe", ".node", ".dll", ".msi") } | ForEach-Object { '"' + $_.FullName.Replace((Get-Location).Path + '\packages\frontend\electron\out\', '') + '"' }) -join ' ') + "FILES_TO_BE_SIGNED=$FILES_TO_BE_SIGNED" >> $env:GITHUB_OUTPUT + echo $FILES_TO_BE_SIGNED + + - name: Zip artifacts for faster upload + run: Compress-Archive -CompressionLevel Fastest -Path packages/frontend/electron/out/* -DestinationPath archive.zip + + - name: Save packaged artifacts for signing + uses: actions/upload-artifact@v4 + with: + name: packaged-${{ matrix.spec.platform }}-${{ matrix.spec.arch }} + path: | + archive.zip + !**/*.map + + sign-packaged-artifacts-windows: + needs: package-distribution-windows + uses: ./.github/workflows/windows-signer.yml + with: + files: ${{ needs.package-distribution-windows.outputs.FILES_TO_BE_SIGNED }} + artifact-name: packaged-win32-x64 + + make-windows-installer: + needs: sign-packaged-artifacts-windows + strategy: + matrix: + spec: + - runner: windows-latest + platform: win32 + arch: x64 + target: x86_64-pc-windows-msvc + runs-on: ${{ matrix.spec.runner }} + outputs: + FILES_TO_BE_SIGNED: ${{ steps.get_files_to_be_signed.outputs.FILES_TO_BE_SIGNED }} + steps: + - uses: actions/checkout@v4 + - name: Setup Version + id: version + uses: ./.github/actions/setup-version + - name: Setup Node.js + timeout-minutes: 10 + uses: ./.github/actions/setup-node + with: + extra-flags: workspaces focus @affine/electron @affine/monorepo + hard-link-nm: false + nmHoistingLimits: workspaces + - name: Download and overwrite packaged artifacts + uses: actions/download-artifact@v4 + with: + name: signed-packaged-${{ matrix.spec.platform }}-${{ matrix.spec.arch }} + path: . + - name: unzip file + run: Expand-Archive -Path signed.zip -DestinationPath packages/frontend/electron/out + - name: Make squirrel.windows installer run: yarn workspace @affine/electron make-squirrel --platform=${{ matrix.spec.platform }} --arch=${{ matrix.spec.arch }} - name: Make nsis.windows installer run: yarn workspace @affine/electron make-nsis --platform=${{ matrix.spec.platform }} --arch=${{ matrix.spec.arch }} + - name: Zip artifacts for faster upload + run: Compress-Archive -CompressionLevel Fastest -Path packages/frontend/electron/out/${{ env.BUILD_TYPE }}/make/* -DestinationPath archive.zip + + - name: get all files to be signed + id: get_files_to_be_signed + run: | + Set-Variable -Name FILES_TO_BE_SIGNED -Value ((Get-ChildItem -Path packages/frontend/electron/out/${{ env.BUILD_TYPE }}/make -Recurse -File | Where-Object { $_.Extension -in @(".exe", ".node", ".dll", ".msi") } | ForEach-Object { '"' + $_.FullName.Replace((Get-Location).Path + '\packages\frontend\electron\out\${{ env.BUILD_TYPE }}\make\', '') + '"' }) -join ' ') + "FILES_TO_BE_SIGNED=$FILES_TO_BE_SIGNED" >> $env:GITHUB_OUTPUT + echo $FILES_TO_BE_SIGNED + + - name: Save installer for signing + uses: actions/upload-artifact@v4 + with: + name: installer-${{ matrix.spec.platform }}-${{ matrix.spec.arch }} + path: archive.zip + + sign-installer-artifacts-windows: + needs: make-windows-installer + uses: ./.github/workflows/windows-signer.yml + with: + files: ${{ needs.make-windows-installer.outputs.FILES_TO_BE_SIGNED }} + artifact-name: installer-win32-x64 + + finalize-installer-windows: + needs: [sign-installer-artifacts-windows, before-make] + strategy: + matrix: + spec: + - runner: windows-latest + platform: win32 + arch: x64 + target: x86_64-pc-windows-msvc + runs-on: ${{ matrix.spec.runner }} + steps: + - name: Download and overwrite installer artifacts + uses: actions/download-artifact@v4 + with: + name: signed-installer-${{ matrix.spec.platform }}-${{ matrix.spec.arch }} + path: . + - name: unzip file + run: Expand-Archive -Path signed.zip -DestinationPath packages/frontend/electron/out/${{ env.BUILD_TYPE }}/make + - name: Save artifacts run: | mkdir -p builds @@ -256,180 +357,8 @@ jobs: name: affine-${{ matrix.spec.platform }}-${{ matrix.spec.arch }}-builds path: builds - # package-distribution-windows: - # strategy: - # matrix: - # spec: - # - runner: windows-latest - # platform: win32 - # arch: x64 - # target: x86_64-pc-windows-msvc - # runs-on: ${{ matrix.spec.runner }} - # needs: before-make - # outputs: - # FILES_TO_BE_SIGNED: ${{ steps.get_files_to_be_signed.outputs.FILES_TO_BE_SIGNED }} - # env: - # SKIP_GENERATE_ASSETS: 1 - # SENTRY_ORG: ${{ secrets.SENTRY_ORG }} - # SENTRY_PROJECT: 'affine' - # SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} - # SENTRY_DSN: ${{ secrets.SENTRY_DSN }} - # MIXPANEL_TOKEN: ${{ secrets.MIXPANEL_TOKEN }} - # steps: - # - uses: actions/checkout@v4 - # - name: Setup Version - # id: version - # uses: ./.github/actions/setup-version - # - name: Setup Node.js - # timeout-minutes: 10 - # uses: ./.github/actions/setup-node - # with: - # extra-flags: workspaces focus @affine/electron @affine/monorepo - # hard-link-nm: false - # nmHoistingLimits: workspaces - # - name: Build AFFiNE native - # uses: ./.github/actions/build-rust - # with: - # target: ${{ matrix.spec.target }} - # package: '@affine/native' - # nx_token: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }} - # - uses: actions/download-artifact@v4 - # with: - # name: web - # path: packages/frontend/electron/resources/web-static - - # - name: Build Desktop Layers - # run: yarn workspace @affine/electron build - - # - name: package - # run: yarn workspace @affine/electron package --platform=${{ matrix.spec.platform }} --arch=${{ matrix.spec.arch }} - # env: - # SKIP_WEB_BUILD: 1 - # HOIST_NODE_MODULES: 1 - - # - name: get all files to be signed - # id: get_files_to_be_signed - # run: | - # Set-Variable -Name FILES_TO_BE_SIGNED -Value ((Get-ChildItem -Path packages/frontend/electron/out -Recurse -File | Where-Object { $_.Extension -in @(".exe", ".node", ".dll", ".msi") } | ForEach-Object { '"' + $_.FullName.Replace((Get-Location).Path + '\packages\frontend\electron\out\', '') + '"' }) -join ' ') - # "FILES_TO_BE_SIGNED=$FILES_TO_BE_SIGNED" >> $env:GITHUB_OUTPUT - # echo $FILES_TO_BE_SIGNED - - # - name: Zip artifacts for faster upload - # run: Compress-Archive -CompressionLevel Fastest -Path packages/frontend/electron/out/* -DestinationPath archive.zip - - # - name: Save packaged artifacts for signing - # uses: actions/upload-artifact@v4 - # with: - # name: packaged-${{ matrix.spec.platform }}-${{ matrix.spec.arch }} - # path: | - # archive.zip - # !**/*.map - - # sign-packaged-artifacts-windows: - # needs: package-distribution-windows - # uses: ./.github/workflows/windows-signer.yml - # with: - # files: ${{ needs.package-distribution-windows.outputs.FILES_TO_BE_SIGNED }} - # artifact-name: packaged-win32-x64 - - # make-windows-installer: - # needs: sign-packaged-artifacts-windows - # strategy: - # matrix: - # spec: - # - runner: windows-latest - # platform: win32 - # arch: x64 - # target: x86_64-pc-windows-msvc - # runs-on: ${{ matrix.spec.runner }} - # outputs: - # FILES_TO_BE_SIGNED: ${{ steps.get_files_to_be_signed.outputs.FILES_TO_BE_SIGNED }} - # steps: - # - uses: actions/checkout@v4 - # - name: Setup Version - # id: version - # uses: ./.github/actions/setup-version - # - name: Setup Node.js - # timeout-minutes: 10 - # uses: ./.github/actions/setup-node - # with: - # extra-flags: workspaces focus @affine/electron @affine/monorepo - # hard-link-nm: false - # nmHoistingLimits: workspaces - # - name: Download and overwrite packaged artifacts - # uses: actions/download-artifact@v4 - # with: - # name: signed-packaged-${{ matrix.spec.platform }}-${{ matrix.spec.arch }} - # path: . - # - name: unzip file - # run: Expand-Archive -Path signed.zip -DestinationPath packages/frontend/electron/out - - # - name: Make squirrel.windows installer - # run: yarn workspace @affine/electron make-squirrel --platform=${{ matrix.spec.platform }} --arch=${{ matrix.spec.arch }} - - # - name: Make nsis.windows installer - # run: yarn workspace @affine/electron make-nsis --platform=${{ matrix.spec.platform }} --arch=${{ matrix.spec.arch }} - - # - name: Zip artifacts for faster upload - # run: Compress-Archive -CompressionLevel Fastest -Path packages/frontend/electron/out/${{ env.BUILD_TYPE }}/make/* -DestinationPath archive.zip - - # - name: get all files to be signed - # id: get_files_to_be_signed - # run: | - # Set-Variable -Name FILES_TO_BE_SIGNED -Value ((Get-ChildItem -Path packages/frontend/electron/out/${{ env.BUILD_TYPE }}/make -Recurse -File | Where-Object { $_.Extension -in @(".exe", ".node", ".dll", ".msi") } | ForEach-Object { '"' + $_.FullName.Replace((Get-Location).Path + '\packages\frontend\electron\out\${{ env.BUILD_TYPE }}\make\', '') + '"' }) -join ' ') - # "FILES_TO_BE_SIGNED=$FILES_TO_BE_SIGNED" >> $env:GITHUB_OUTPUT - # echo $FILES_TO_BE_SIGNED - - # - name: Save installer for signing - # uses: actions/upload-artifact@v4 - # with: - # name: installer-${{ matrix.spec.platform }}-${{ matrix.spec.arch }} - # path: archive.zip - - # sign-installer-artifacts-windows: - # needs: make-windows-installer - # uses: ./.github/workflows/windows-signer.yml - # with: - # files: ${{ needs.make-windows-installer.outputs.FILES_TO_BE_SIGNED }} - # artifact-name: installer-win32-x64 - - # finalize-installer-windows: - # needs: [sign-installer-artifacts-windows, before-make] - # strategy: - # matrix: - # spec: - # - runner: windows-latest - # platform: win32 - # arch: x64 - # target: x86_64-pc-windows-msvc - # runs-on: ${{ matrix.spec.runner }} - # steps: - # - name: Download and overwrite installer artifacts - # uses: actions/download-artifact@v4 - # with: - # name: signed-installer-${{ matrix.spec.platform }}-${{ matrix.spec.arch }} - # path: . - # - name: unzip file - # run: Expand-Archive -Path signed.zip -DestinationPath packages/frontend/electron/out/${{ env.BUILD_TYPE }}/make - - # - name: Save artifacts - # run: | - # mkdir -p builds - # mv packages/frontend/electron/out/*/make/zip/win32/x64/AFFiNE*-win32-x64-*.zip ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-windows-x64.zip - # mv packages/frontend/electron/out/*/make/squirrel.windows/x64/*.exe ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-windows-x64.exe - # mv packages/frontend/electron/out/*/make/nsis.windows/x64/*.exe ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-windows-x64.nsis.exe - - # - name: Upload Artifact - # uses: actions/upload-artifact@v4 - # with: - # name: affine-${{ matrix.spec.platform }}-${{ matrix.spec.arch }}-builds - # path: builds - release: - needs: - - before-make - - make-distribution - - make-distribution-windows-skip-signing + needs: [before-make, make-distribution, finalize-installer-windows] runs-on: ubuntu-latest steps: