hasheous-taskrunner/.github/workflows/BuildMacOSExeOnTag-Prerelease.yml at main · gaseous-project/hasheous-taskrunner · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
name: Build Pre-release macOS Exe

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+-preview.[0-9]'
      - 'v[0-9]+.[0-9]+.[0-9]+-rc.[0-9]'

permissions:
  contents: write
  id-token: write
  attestations: write

jobs:
  build-macos-exe:
    runs-on: macos-latest
    strategy:
      matrix:
        arch: [x64, arm64]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: 'true'

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '8.0.x'

      - name: Install dotnet tool
        run: dotnet tool install -g dotnetCampus.TagToVersion

      - name: Set tag to version
        run: dotnet TagToVersion -t ${{ github.ref }}

      - name: Restore dependencies
        run: dotnet restore hasheous-taskrunner/hasheous-taskrunner.csproj

      - name: Build and publish macOS exe (${{ matrix.arch }})
        run: dotnet publish hasheous-taskrunner/hasheous-taskrunner.csproj -c Release -r osx-${{ matrix.arch }} --self-contained -p:PublishSingleFile=true -p:PublishReadyToRun=true -p:IncludeNativeLibrariesForSelfExtract=true -p:EnableCompressionInSingleFile=true

      - name: Prepare artifact
        run: |
          version=$(sed -n 's/.*<Version>\(.*\)<\/Version>.*/\1/p' build/Version.props | head -1)
          sourceExe="hasheous-taskrunner/bin/Release/net8.0/osx-${{ matrix.arch }}/publish/hasheous-taskrunner"
          destExe="hasheous-taskrunner-macos-${version}-${{ matrix.arch }}"
          mv "$sourceExe" "$destExe"
          chmod +x "$destExe"
          echo "Created artifact: $destExe"
        shell: bash

      - name: Generate SHA256 checksum
        run: |
          exeFile=$(ls hasheous-taskrunner-macos-*-${{ matrix.arch }} | head -1)
          shasum -a 256 "$exeFile" | awk '{print $1 "  " $2}' > "${exeFile}.sha256"
          echo "Created checksum file: ${exeFile}.sha256"
          echo "SHA256: $(cat ${exeFile}.sha256)"
        shell: bash

      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          path: hasheous-taskrunner/bin/Release/net8.0/osx-${{ matrix.arch }}/publish/
          artifact-name: sbom-macos-${{ matrix.arch }}.spdx.json
          output-file: sbom-macos-${{ matrix.arch }}.spdx.json
          format: spdx-json

      - name: Attest build provenance
        uses: actions/attest-build-provenance@v1
        with:
          subject-path: 'hasheous-taskrunner-macos-*-${{ matrix.arch }}'

      - name: Attest SBOM
        uses: actions/attest-sbom@v1
        with:
          subject-path: 'hasheous-taskrunner-macos-*-${{ matrix.arch }}'
          sbom-path: 'sbom-macos-${{ matrix.arch }}.spdx.json'

      - name: Upload to release
        uses: softprops/action-gh-release@v1
        if: startsWith(github.ref, 'refs/tags/')
        with:
          files: |
            hasheous-taskrunner-macos-*-${{ matrix.arch }}
            hasheous-taskrunner-macos-*-${{ matrix.arch }}.sha256
            sbom-macos-${{ matrix.arch }}.spdx.json
          prerelease: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}