Automated SecureDrop workstation build #1352
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Sign packages | |
| # Trigger on pushes to main that modify workstation/ (or this workflow) | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - 'workstation/**' | |
| - '.github/workflows/sign.yml' | |
| - '.github/workflows/autosign.py' | |
| - '.github/workflows/listing.py' | |
| - '.github/workflows/index.html.j2' | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| # TODO: switch to debian (rpm-sign isn't happy with it though) | |
| container: fedora:41 | |
| steps: | |
| - name: Install dependencies | |
| run: | | |
| dnf install -y rpmdevtools git git-lfs python3 python3-jinja2 rpm-sign createrepo_c | |
| - uses: actions/checkout@v4 | |
| with: | |
| lfs: true | |
| persist-credentials: false | |
| - name: Configuration | |
| env: | |
| SIGNING_KEY: ${{ secrets.SIGNING_KEY }} | |
| run: | | |
| echo "$SIGNING_KEY" | gpg --import - | |
| git config --global --add safe.directory '*' | |
| git config user.email "securedrop@freedom.press" | |
| git config user.name "sdcibot-signing[bot]" | |
| - name: Sign packages | |
| run: | | |
| ./.github/workflows/autosign.py workstation --fingerprint 83127F68BABB04F3FE9A69AA545E94503FAB65AB | |
| git add . | |
| - name: Clean old packages | |
| run: | | |
| find workstation -mindepth 1 -maxdepth 2 -type d | xargs -I '{}' ./.github/workflows/clean-old.py '{}' 4 | |
| git add . | |
| - name: Update metadata | |
| run: | | |
| # Only run if we made changes above, otherwise this'll keep running over and over | |
| # since the timestamp changes. | |
| if [[ -n "$(git diff --staged)" ]]; then | |
| ./.github/workflows/build.py | |
| fi | |
| ./.github/workflows/listing.py | |
| git add . | |
| - uses: actions/create-github-app-token@v2 | |
| id: app-token | |
| with: | |
| app-id: ${{ vars.FPF_BRANCH_UPDATER_APP_ID }} | |
| private-key: ${{ secrets.FPF_BRANCH_UPDATER_APP_PRIVKEY }} | |
| - name: git commit and push | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| run: | | |
| # Index will be clean if there are no changes | |
| git diff-index --quiet HEAD || git commit -m "Signing new packages" | |
| git push https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git main |