Release Windows installer #5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Windows installer | |
| on: | |
| push: | |
| tags: | |
| - 'V*' | |
| workflow_dispatch: | |
| inputs: | |
| ref: | |
| description: 'Git ref (branch or tag) to build' | |
| required: true | |
| default: 'master' | |
| env: | |
| IMAGE: ghcr.io/swi-prolog/swipl-mingw-build:latest | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| packages: read | |
| steps: | |
| - name: Free disk space | |
| uses: jlumbroso/free-disk-space@main | |
| with: | |
| tool-cache: true | |
| android: true | |
| dotnet: true | |
| haskell: true | |
| large-packages: true | |
| docker-images: false | |
| swap-storage: true | |
| - name: Resolve build ref | |
| id: ref | |
| run: | | |
| if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then | |
| echo "ref=${{ inputs.ref }}" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "ref=${{ github.ref_name }}" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Pull build image | |
| run: docker pull "$IMAGE" | |
| - name: Cross-build Windows installer | |
| run: | | |
| docker run --name swipl-build \ | |
| --cap-add=SYS_PTRACE \ | |
| --security-opt seccomp=unconfined \ | |
| "$IMAGE" \ | |
| --win64-from-git \ | |
| https://github.com/${{ github.repository }}.git \ | |
| "${{ steps.ref.outputs.ref }}" | |
| - name: Extract installer | |
| id: extract | |
| run: | | |
| mkdir -p out | |
| # docker cp <container>:<dir> - streams the directory as a tar | |
| # to stdout. Extract only the installer to sidestep the | |
| # safety check that rejects escaping symlinks elsewhere in | |
| # build.win64/. | |
| docker cp swipl-build:/home/swipl/src/swipl-devel/build.win64 - | \ | |
| tar -x -C out/ --strip-components=1 --wildcards \ | |
| 'build.win64/swipl-*-*.x64.exe' | |
| docker rm swipl-build | |
| installer=$(ls out/swipl-*.x64.exe 2>/dev/null | head -n1) | |
| if [ -z "$installer" ]; then | |
| echo "No installer produced" >&2 | |
| ls -la out/ >&2 | |
| exit 1 | |
| fi | |
| echo "path=$installer" >> "$GITHUB_OUTPUT" | |
| echo "name=$(basename "$installer")" >> "$GITHUB_OUTPUT" | |
| sha256sum "$installer" | tee "$installer.sha256" | |
| - name: Upload unsigned installer for signing | |
| id: upload-unsigned | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: unsigned-installer | |
| path: ${{ steps.extract.outputs.path }} | |
| - name: Submit signing request to SignPath | |
| uses: signpath/github-action-submit-signing-request@v2 | |
| with: | |
| api-token: ${{ secrets.SIGNPATH_API_TOKEN }} | |
| organization-id: '850aee92-c331-4e54-a97d-64cf5f08080a' | |
| project-slug: 'swipl-devel' | |
| signing-policy-slug: 'test-signing' | |
| github-artifact-id: ${{ steps.upload-unsigned.outputs.artifact-id }} | |
| wait-for-completion: true | |
| output-artifact-directory: signed/ | |
| - name: Recompute checksum on signed installer | |
| id: signed | |
| run: | | |
| installer=$(ls signed/swipl-*.x64.exe 2>/dev/null | head -n1) | |
| if [ -z "$installer" ]; then | |
| echo "No signed installer produced" >&2 | |
| ls -la signed/ >&2 | |
| exit 1 | |
| fi | |
| sha256sum "$installer" | tee "$installer.sha256" | |
| echo "path=$installer" >> "$GITHUB_OUTPUT" | |
| echo "name=$(basename "$installer")" >> "$GITHUB_OUTPUT" | |
| - name: Upload signed installer as workflow artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ${{ steps.signed.outputs.name }} | |
| path: | | |
| ${{ steps.signed.outputs.path }} | |
| ${{ steps.signed.outputs.path }}.sha256 | |
| - name: Publish to GitHub Release | |
| if: startsWith(github.ref, 'refs/tags/V') | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| tag_name: ${{ github.ref_name }} | |
| generate_release_notes: true | |
| fail_on_unmatched_files: true | |
| files: | | |
| ${{ steps.signed.outputs.path }} | |
| ${{ steps.signed.outputs.path }}.sha256 |