Nightly builds #1337
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow will build a Java project with Maven and publish nightly builds | |
| # For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-maven | |
| name: Nightly builds | |
| on: | |
| schedule: | |
| - cron: "0 0 * * *" | |
| jobs: | |
| build: | |
| runs-on: macos-latest | |
| steps: | |
| - uses: actions/checkout@v2 | |
| - name: Set up JDK 21 | |
| uses: actions/setup-java@v2 | |
| with: | |
| java-version: '21' | |
| distribution: 'temurin' | |
| - name: Build with Maven | |
| run: | | |
| # We skip local signing because we will use Azure Cloud Signing next | |
| mvn -e -X clean install -Djarsigner.skip=true -DskipTests=true | |
| - name: Download Jsign | |
| run: | | |
| wget -q https://github.com/ebourg/jsign/releases/download/7.4/jsign-7.4.jar || \ | |
| curl -L -o jsign-7.4.jar https://github.com/ebourg/jsign/releases/download/7.4/jsign-7.4.jar | |
| echo "Downloaded Jsign 7.4" | |
| - name: Authenticate to Azure | |
| run: | | |
| az login --service-principal \ | |
| --username ${{ secrets.AZURE_CLIENT_ID }} \ | |
| --password ${{ secrets.AZURE_CLIENT_SECRET }} \ | |
| --tenant ${{ secrets.AZURE_TENANT_ID }} \ | |
| --allow-no-subscriptions | |
| - name: Get Azure Key Vault Access Token | |
| id: get-token | |
| run: | | |
| TOKEN=$(az account get-access-token --resource https://vault.azure.net --query accessToken -o tsv) | |
| echo "::add-mask::$TOKEN" | |
| echo "token=$TOKEN" >> $GITHUB_OUTPUT | |
| - name: Sign JAR files with Azure Key Vault | |
| env: | |
| AZURE_TOKEN: ${{ steps.get-token.outputs.token }} | |
| CERT_CHAIN: ${{ secrets.AZURE_KEYVAULT_CERTCHAIN }} | |
| run: | | |
| # Setup Certificate Chain | |
| CERTCHAIN_ARG="" | |
| if [ -n "$CERT_CHAIN" ]; then | |
| echo "$CERT_CHAIN" > certchain.p7b | |
| CERTCHAIN_ARG="-certchain certchain.p7b" | |
| fi | |
| REPO_DIR="releng/com.espressif.idf.update/target/repository" | |
| SIGFILE="ECLIPSE" | |
| echo "Signing IDF plugin JARs in $REPO_DIR..." | |
| # Find and sign specific Espressif JARs | |
| find "$REPO_DIR" -type f -name "*.jar" | while read -r file; do | |
| if [[ "$file" =~ (plugins|features)/com\.espressif\. ]]; then | |
| echo "Signing: $file" | |
| jarsigner \ | |
| -J-cp -Jjsign-7.4.jar \ | |
| -J--add-modules -Jjava.sql \ | |
| -providerClass net.jsign.jca.JsignJcaProvider \ | |
| -providerArg "${{ secrets.AZURE_KEYVAULT_URI }}" \ | |
| -keystore NONE \ | |
| -storetype AZUREKEYVAULT \ | |
| -storepass "$AZURE_TOKEN" \ | |
| -sigfile "$SIGFILE" \ | |
| -digestalg SHA-256 \ | |
| -tsa http://timestamp.digicert.com \ | |
| $CERTCHAIN_ARG \ | |
| -certs \ | |
| -verbose \ | |
| "$file" \ | |
| "${{ secrets.AZURE_KEYVAULT_CERT_NAME }}" | |
| if [ $? -ne 0 ]; then | |
| echo "Failed to sign: $file" | |
| exit 1 | |
| fi | |
| fi | |
| done | |
| - name: Regenerate P2 Metadata | |
| run: | | |
| # Signing changes file checksums, so we must fix the P2 metadata | |
| mvn -f releng/com.espressif.idf.update/pom.xml \ | |
| org.eclipse.tycho:tycho-p2-repository-plugin:fix-artifacts-metadata \ | |
| -DrepositoryPath="releng/com.espressif.idf.update/target/repository" \ | |
| -DskipTests=true | |
| - name: Cleanup | |
| if: always() | |
| run: | | |
| az logout || true | |
| rm -f jsign-7.4.jar || true | |
| rm -f certchain.p7b || true | |
| - name: Codesign Espressif-IDE | |
| env: | |
| MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }} | |
| MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }} | |
| run: | | |
| echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12 | |
| /usr/bin/security create-keychain -p espressif build.keychain | |
| /usr/bin/security default-keychain -s build.keychain | |
| /usr/bin/security unlock-keychain -p espressif build.keychain | |
| /usr/bin/security import certificate.p12 -k build.keychain -P $MACOS_CERTIFICATE_PWD -T /usr/bin/codesign | |
| /usr/bin/security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k espressif build.keychain | |
| echo "codesigning espressif-ide-macosx.cocoa.x86_64" | |
| /usr/bin/codesign --entitlements $PWD/releng/com.espressif.idf.product/entitlements/espressif-ide.entitlement --options runtime --force -s "ESPRESSIF SYSTEMS (SHANGHAI) CO., LTD. (QWXF6GB4AV)" $PWD/releng/com.espressif.idf.product/target/products/com.espressif.idf.product/macosx/cocoa/x86_64/Espressif-IDE.app -v | |
| /usr/bin/codesign -v -vvv --deep $PWD/releng/com.espressif.idf.product/target/products/com.espressif.idf.product/macosx/cocoa/x86_64/Espressif-IDE.app | |
| echo "codesigning espressif-ide-macosx.cocoa.aarch64" | |
| /usr/bin/codesign --entitlements $PWD/releng/com.espressif.idf.product/entitlements/espressif-ide.entitlement --options runtime --force -s "ESPRESSIF SYSTEMS (SHANGHAI) CO., LTD. (QWXF6GB4AV)" $PWD/releng/com.espressif.idf.product/target/products/com.espressif.idf.product/macosx/cocoa/aarch64/Espressif-IDE.app -v | |
| /usr/bin/codesign -v -vvv --deep $PWD/releng/com.espressif.idf.product/target/products/com.espressif.idf.product/macosx/cocoa/aarch64/Espressif-IDE.app | |
| echo "Creating dmg for espressif-ide-macosx.cocoa.x86_64" | |
| $PWD/releng/ide-dmg-builder/ide-dmg-builder.sh | |
| /usr/bin/codesign --entitlements $PWD/releng/com.espressif.idf.product/entitlements/espressif-ide.entitlement --options runtime --force -s "ESPRESSIF SYSTEMS (SHANGHAI) CO., LTD. (QWXF6GB4AV)" $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-x86_64.dmg -v | |
| /usr/bin/codesign -v -vvv --deep $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-x86_64.dmg | |
| echo "Creating dmg for espressif-ide-macosx.cocoa.aarch64" | |
| $PWD/releng/ide-dmg-builder/ide-dmg-builder-aarch64.sh | |
| /usr/bin/codesign --options runtime --force -s "ESPRESSIF SYSTEMS (SHANGHAI) CO., LTD. (QWXF6GB4AV)" $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg -v | |
| /usr/bin/codesign -v -vvv --deep $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg | |
| - name: Notarization of Espressif-IDE dmg files | |
| env: | |
| NOTARIZATION_USERNAME: ${{ secrets.NOTARIZATION_USERNAME }} | |
| NOTARIZATION_PASSWORD: ${{ secrets.NOTARIZATION_PASSWORD }} | |
| NOTARIZATION_TEAM_ID: ${{ secrets.NOTARIZATION_TEAM_ID }} | |
| run: | | |
| echo "Create notary keychain" | |
| /usr/bin/security create-keychain -p espressif notary.keychain | |
| /usr/bin/security default-keychain -s notary.keychain | |
| /usr/bin/security unlock-keychain -p espressif notary.keychain | |
| echo "Create keychain profile" | |
| xcrun notarytool store-credentials "ide-notarytool-profile" --apple-id $NOTARIZATION_USERNAME --team-id $NOTARIZATION_TEAM_ID --password $NOTARIZATION_PASSWORD | |
| xcrun notarytool submit $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-x86_64.dmg --keychain-profile "ide-notarytool-profile" --wait | |
| echo "Attach staple for x86_64.dmg" | |
| xcrun stapler staple $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-x86_64.dmg | |
| echo "Unlock the notary keychain" | |
| /usr/bin/security unlock-keychain -p espressif notary.keychain | |
| xcrun notarytool submit $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg --keychain-profile "ide-notarytool-profile" --wait | |
| echo "Attach staple for aarch64.dmg" | |
| xcrun stapler staple $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg | |
| - name: Upload Espressif-IDE-macosx-cocoa-x86_64.dmg | |
| if: ${{ !cancelled() }} | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: espressif-ide-macosx-cocoa-x86_64 | |
| path: releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-x86_64.dmg | |
| - name: Upload Espressif-IDE-macosx-cocoa-aarch64.dmg | |
| if: ${{ !cancelled() }} | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: espressif-ide-macosx.cocoa.aarch64 | |
| path: releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg | |
| - name: Upload build artifacts | |
| if: ${{ !cancelled() }} | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: com.espressif.idf.update | |
| path: releng/com.espressif.idf.update/target/repository | |
| - name: Upload windows rcp | |
| if: ${{ !cancelled() }} | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: espressif-ide-win32 | |
| path: releng/com.espressif.idf.product/target/products/Espressif-IDE-*-win32.win32.x86_64.zip | |
| - name: Upload linux rcp | |
| if: ${{ !cancelled() }} | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: espressif-ide-linux | |
| path: releng/com.espressif.idf.product/target/products/Espressif-IDE-*-linux.gtk.x86_64.tar.gz | |
| - name: Upload build assets to dl.espressif.com | |
| id: upload-release-asset-espressif | |
| env: | |
| AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }} | |
| run: | | |
| ARCHIVE_DIR="/releng/com.espressif.idf.update/target/" | |
| ARCHIVE_NAME="com.espressif.idf.update*.zip" | |
| echo "${ARCHIVE_DIR}" | |
| echo ${PWD}${ARCHIVE_DIR} | |
| ARCHIVE_FILE_NAME="$(find ${PWD}${ARCHIVE_DIR}${ARCHIVE_NAME})" | |
| echo "${ARCHIVE_FILE_NAME}" | |
| ARCHIVE_PREFIX="com.espressif.idf.update-" | |
| ARCHIVE_SUFFIX="-SNAPSHOT.zip"; | |
| tmp=${ARCHIVE_FILE_NAME#*${ARCHIVE_PREFIX}} # remove prefix | |
| ARCHIVE_VERSION=${tmp%${ARCHIVE_SUFFIX}*} # remove suffix | |
| echo "${ARCHIVE_VERSION}" | |
| FOLDER_NAME="v${ARCHIVE_VERSION}" | |
| mkdir "${FOLDER_NAME}" && cd "${FOLDER_NAME}" && unzip -q ${ARCHIVE_FILE_NAME} && cd .. | |
| echo ${PWD} | |
| ARCHIVE_VERSION_NEW="${ARCHIVE_PREFIX}${ARCHIVE_VERSION}.zip" | |
| echo ${ARCHIVE_VERSION_NEW} | |
| mv ${ARCHIVE_FILE_NAME} ${ARCHIVE_VERSION_NEW} | |
| mv releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-x86_64.dmg "releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-x86_64-${FOLDER_NAME}.dmg" | |
| mv releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg "releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64-${FOLDER_NAME}.dmg" | |
| aws s3 rm s3://${{ secrets.DL_BUCKET }}/dl/idf-eclipse-plugin/updates/nightly --recursive | |
| aws s3 cp --acl=public-read --recursive "./${FOLDER_NAME}/" s3://${{ secrets.DL_BUCKET }}/dl/idf-eclipse-plugin/updates/nightly | |
| aws s3 cp --acl=public-read "./releng/index.html" s3://${{ secrets.DL_BUCKET }}/dl/idf-eclipse-plugin/updates/nightly/ | |
| aws cloudfront create-invalidation --distribution-id ${{ secrets.DL_DISTRIBUTION_ID }} --paths "/dl/idf-eclipse-plugin/updates/nightly/*" |