SAML-tracer/.github/workflows/build-release.yml at 0facf52422c4225bd1b2febf049b983ab1bf9de1 · simplesamlphp/SAML-tracer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
---

name: Build release

on:  # yamllint disable-line rule:truthy
  push:
    tags:
      - '*'
  workflow_dispatch:

jobs:
  build:
    name: Build release
    runs-on: [ubuntu-latest]

    steps:
      - uses: actions/checkout@v6
        with:
          token: ${{ secrets.SAMLTRACER_BUILD_TOKEN }}
          ref: ${{ github.head_ref || github.ref_name }}
          # Full git history is needed to get a proper list of changed files within `super-linter`
          fetch-depth: 0

      - name: Fetch changes
        # Without fetching, we might miss new tags due to caching in Github Actions
        run: git fetch --all

      - uses: actions/setup-node@v6
        with:
          node-version: 24

      - name: Install assets
        # Deliberately a plain clean-install: package-lock.json is authoritative, so the
        # published build is reproducible from the committed lock-file alone. Do not add
        # `npm install --package-lock-only` or `npm audit fix` here -- both mutate the
        # dependency tree at build time, which makes the shipped third-party files
        # impossible for AMO reviewers to verify.
        run: npm clean-install

      - name: Copy third-party dependencies to lib/ directory
        # Copied verbatim from the @highlightjs/cdn-assets package, which is highlight.js'
        # own published distribution. The files are byte-identical to that release, so a
        # reviewer can verify them with `npm ci` and `diff` rather than reproducing a build.
        run: |
          cp node_modules/@highlightjs/cdn-assets/es/core.min.js lib/core.min.js
          cp node_modules/@highlightjs/cdn-assets/es/languages/xml.min.js lib/xml.min.js
          cp node_modules/@highlightjs/cdn-assets/es/languages/http.min.js lib/http.min.js
          cp node_modules/@highlightjs/cdn-assets/es/languages/properties.min.js lib/properties.min.js
          cp node_modules/pako/dist/pako_inflate.min.js lib/pako_inflate.min.js

      - name: Clean release
        run: |
          grep export-ignore .gitattributes | cut -d ' ' -f 1 | while IFS= read -r line
          do
            rm -rf "$line"
          done
          rm -rf .git

      - name: Build zip-file
        run: |
          zip -1 -r /tmp/samltracer.zip *

      - name: Save release
        uses: actions/upload-artifact@v7
        with:
          name: release
          path: "/tmp/samltracer.zip"
          retention-days: 1

      - name: Calculate SHA checksum
        run: sha256sum "/tmp/samltracer.zip"