2026.15 #135
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Create Ubuntu and Window Releases | |
| on: | |
| push: | |
| tags: | |
| - '*' | |
| workflow_dispatch: | |
| jobs: | |
| build-linux: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| submodules: 'true' | |
| - name: Extract release notes | |
| id: release_notes | |
| run: | | |
| NOTES=$(python3 ci_scripts/release_notes_to_md.py "${GITHUB_REF_NAME}") | |
| { | |
| echo "notes<<RELEASE_NOTES_EOF" | |
| echo "$NOTES" | |
| echo "RELEASE_NOTES_EOF" | |
| } >> "$GITHUB_OUTPUT" | |
| - run: docker pull ghcr.io/xlightssequencer/xlights-build-docker:master | |
| - run: docker run -e XLIGHTS_REF="${GITHUB_REF_NAME}" -e XLIGHTS_VERSION="${GITHUB_REF_NAME}" --name buildvm ghcr.io/xlightssequencer/xlights-build-docker:master /bin/bash Recipe.appimage | |
| - run: 'docker cp buildvm:/xLights/xLights/AppImage/ /tmp/' | |
| - run: ls -lh /tmp/AppImage | |
| - uses: ncipollo/release-action@v1 | |
| with: | |
| allowUpdates: true | |
| draft: true | |
| artifacts: "/tmp/AppImage/*.AppImage" | |
| body: ${{ steps.release_notes.outputs.notes }} | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| build-windows: | |
| runs-on: windows-2022 | |
| # Tag/dispatch-only workflow, so always enter the `release` environment: the | |
| # OIDC token subject (repo:.../environment:release) must match the Entra | |
| # federated credential that authorizes Azure Trusted Signing. Signing is then | |
| # gated on the WINDOWS_SIGNING_ENABLED repo variable, so releases keep | |
| # building (unsigned) until Trusted Signing is configured. | |
| environment: release | |
| permissions: | |
| id-token: write | |
| contents: write | |
| env: | |
| SIGN: ${{ vars.WINDOWS_SIGNING_ENABLED == 'true' }} | |
| steps: | |
| - name: Checkout xLights | |
| uses: actions/checkout@v4 | |
| with: | |
| submodules: 'true' | |
| - name: Setup msbuild | |
| uses: microsoft/setup-msbuild@v3 | |
| - name: install ISPC | |
| uses: ispc/install-ispc-action@main | |
| with: | |
| version: 1.31.0 | |
| # glslc (Vulkan SDK Bin) compiles the .comp compute kernels to SPIR-V | |
| # headers via the Xlights.vcxproj CompileVulkanShaders pre-build target | |
| # (x64). The action exports VULKAN_SDK so that target's PowerShell script | |
| # finds glslc; without it the msbuild step fails at the pre-build event. | |
| - name: Install Vulkan SDK | |
| uses: jakoch/install-vulkan-sdk-action@v1 | |
| with: | |
| install_runtime: false | |
| cache: true | |
| - name: Download wxWidgets | |
| run: | |
| git clone --depth=1 --shallow-submodules --recurse-submodules -b xlights_2026.13 https://github.com/xLightsSequencer/wxWidgets ..\wxWidgets\ | |
| - name: Build wxWidgets | |
| working-directory: ..\wxWidgets\ | |
| run: msbuild /m .\build\msw\wx_vc17.sln /p:Configuration="Release" /p:Platform="x64" | |
| - name: Build All | |
| shell: cmd | |
| working-directory: build_scripts\msw | |
| run: call build_VS_x64_skip_libltc.cmd | |
| # --- Authenticode signing via Azure Trusted Signing (Kulp Lights LLC) ------ | |
| # Sign our own executables before packaging, then sign the installer after | |
| # ISCC (the artifact users download and that SmartScreen/AV evaluate). | |
| # Third-party DLLs keep their vendors' signatures. Reuses fppMon's signing | |
| # account/profile; runs only when WINDOWS_SIGNING_ENABLED is set. | |
| - name: Azure login (OIDC for Trusted Signing) | |
| if: env.SIGN == 'true' | |
| uses: azure/login@v3 | |
| with: | |
| client-id: ${{ secrets.AZURE_CLIENT_ID }} | |
| tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
| subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | |
| - name: Sign xLights.exe (Trusted Signing) | |
| if: env.SIGN == 'true' | |
| uses: azure/artifact-signing-action@v2 | |
| with: | |
| endpoint: https://eus.codesigning.azure.net/ | |
| signing-account-name: kulplightssigning | |
| certificate-profile-name: kulplights-public | |
| files-folder: xlights\x64\Release | |
| files-folder-filter: exe | |
| file-digest: SHA256 | |
| timestamp-rfc3161: http://timestamp.acs.microsoft.com | |
| - name: Sign xlDo.exe (Trusted Signing) | |
| if: env.SIGN == 'true' | |
| uses: azure/artifact-signing-action@v2 | |
| with: | |
| endpoint: https://eus.codesigning.azure.net/ | |
| signing-account-name: kulplightssigning | |
| certificate-profile-name: kulplights-public | |
| files-folder: xlDo\x64\Release | |
| files-folder-filter: exe | |
| file-digest: SHA256 | |
| timestamp-rfc3161: http://timestamp.acs.microsoft.com | |
| - name: Sign fseq_convert.exe (Trusted Signing) | |
| if: env.SIGN == 'true' | |
| uses: azure/artifact-signing-action@v2 | |
| with: | |
| endpoint: https://eus.codesigning.azure.net/ | |
| signing-account-name: kulplightssigning | |
| certificate-profile-name: kulplights-public | |
| files-folder: fseq_convert\cmake_vs\Release | |
| files-folder-filter: exe | |
| file-digest: SHA256 | |
| timestamp-rfc3161: http://timestamp.acs.microsoft.com | |
| - name: Build Installer | |
| working-directory: build_scripts\msw | |
| run: ISCC.exe xLights_4_64bit_VS.iss | |
| - name: Sign installer (Trusted Signing) | |
| if: env.SIGN == 'true' | |
| uses: azure/artifact-signing-action@v2 | |
| with: | |
| endpoint: https://eus.codesigning.azure.net/ | |
| signing-account-name: kulplightssigning | |
| certificate-profile-name: kulplights-public | |
| files-folder: build_scripts\msw\output | |
| files-folder-filter: exe | |
| file-digest: SHA256 | |
| timestamp-rfc3161: http://timestamp.acs.microsoft.com | |
| # --- Microsoft Store package (unsigned; the Store re-signs on ingestion) ---- | |
| # Built every release and handed to the publish-store job below. Bundles the | |
| # already-signed exes. Output to a separate dir and uploaded as a workflow | |
| # artifact (NOT a public release asset) - an unsigned Store-identity package | |
| # isn't user-installable, so it must not land in the GitHub release. | |
| - name: Build Store MSIX | |
| shell: pwsh | |
| working-directory: build_scripts\msw\msix | |
| run: ./BuildMSIX.ps1 -Store -OutDir ..\store-output | |
| - name: Upload Store MSIX artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: xLights_Store_MSIX | |
| path: build_scripts\msw\store-output\xLights-Store-x64.msix | |
| - name: Stage Windows symbol map | |
| shell: pwsh | |
| run: | | |
| if (-not (Test-Path bin64\xLights.map)) { | |
| throw "bin64\xLights.map not produced - PrepMap step likely failed" | |
| } | |
| Copy-Item bin64\xLights.map "build_scripts\msw\output\xLights-${{ github.ref_name }}-win64.map" | |
| Write-Host "Staged symbol map: $((Get-Item bin64\xLights.map).Length) bytes" | |
| - uses: ncipollo/release-action@v1 | |
| with: | |
| allowUpdates: true | |
| draft: true | |
| omitBodyDuringUpdate: true | |
| artifacts: 'build_scripts\msw\output\*' | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| # --- Microsoft Store submission --------------------------------------------- | |
| # Uploads the Store MSIX into the app's Partner Center draft submission via the | |
| # Microsoft Store Developer CLI. Deliberately its own job rather than a step in | |
| # build-windows: publish-release must not depend on it, so a Partner Center | |
| # outage or a rejected package can never hold up the GitHub release. | |
| # | |
| # Gated on the MSSTORE_PUBLISH_ENABLED repo variable - until that is set the | |
| # release behaves exactly as it did before. The one-time setup is an Entra ID | |
| # app registration holding the Manager role on the Partner Center account | |
| # (Account settings > User management > Microsoft Entra applications); the app | |
| # itself is already live in the Store, which is what the submission API needs. | |
| # | |
| # By default the draft is left uncommitted, so the package is uploaded and | |
| # waits for a human to review the listing and press Submit. Set the | |
| # MSSTORE_AUTO_COMMIT variable to true to have CI start certification too. | |
| publish-store: | |
| needs: build-windows | |
| if: startsWith(github.ref, 'refs/tags/') | |
| runs-on: windows-2022 | |
| environment: release | |
| env: | |
| STORE_PUBLISH: ${{ vars.MSSTORE_PUBLISH_ENABLED == 'true' }} | |
| steps: | |
| - name: Download Store MSIX | |
| if: env.STORE_PUBLISH == 'true' | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: xLights_Store_MSIX | |
| path: store-msix | |
| - name: Setup Microsoft Store Developer CLI | |
| if: env.STORE_PUBLISH == 'true' | |
| uses: microsoft/microsoft-store-apppublisher@v1.4 | |
| # Checked before calling reconfigure: with a parameter missing the CLI | |
| # prompts for it, and an interactive prompt on a runner hangs the job | |
| # until the 6-hour timeout rather than failing. | |
| - name: Configure Partner Center credentials | |
| if: env.STORE_PUBLISH == 'true' | |
| shell: pwsh | |
| env: | |
| TENANT_ID: ${{ secrets.MSSTORE_TENANT_ID }} | |
| SELLER_ID: ${{ secrets.MSSTORE_SELLER_ID }} | |
| CLIENT_ID: ${{ secrets.MSSTORE_CLIENT_ID }} | |
| CLIENT_SECRET: ${{ secrets.MSSTORE_CLIENT_SECRET }} | |
| run: | | |
| foreach ($n in 'TENANT_ID','SELLER_ID','CLIENT_ID','CLIENT_SECRET') { | |
| if ([string]::IsNullOrWhiteSpace([Environment]::GetEnvironmentVariable($n))) { | |
| throw "MSSTORE_$n is not set - MSSTORE_PUBLISH_ENABLED needs all four Partner Center secrets" | |
| } | |
| } | |
| msstore reconfigure --tenantId $env:TENANT_ID --sellerId $env:SELLER_ID ` | |
| --clientId $env:CLIENT_ID --clientSecret $env:CLIENT_SECRET | |
| if ($LASTEXITCODE -ne 0) { throw "msstore reconfigure failed ($LASTEXITCODE)" } | |
| - name: Upload MSIX to Partner Center | |
| if: env.STORE_PUBLISH == 'true' | |
| shell: pwsh | |
| env: | |
| PRODUCT_ID: ${{ vars.MSSTORE_PRODUCT_ID || '9PGTCKZNKJ2G' }} | |
| AUTO_COMMIT: ${{ vars.MSSTORE_AUTO_COMMIT }} | |
| run: | | |
| $msix = Get-ChildItem store-msix -Filter *.msix -Recurse | Select-Object -First 1 | |
| if (-not $msix) { throw "No .msix in the xLights_Store_MSIX artifact" } | |
| $pubArgs = @($msix.FullName, '-id', $env:PRODUCT_ID) | |
| if ($env:AUTO_COMMIT -ne 'true') { $pubArgs += '--noCommit' } | |
| Write-Host "msstore publish $($pubArgs -join ' ')" | |
| & msstore publish @pubArgs | |
| if ($LASTEXITCODE -ne 0) { throw "msstore publish failed ($LASTEXITCODE)" } | |
| - name: Report submission status | |
| if: env.STORE_PUBLISH == 'true' | |
| continue-on-error: true | |
| env: | |
| PRODUCT_ID: ${{ vars.MSSTORE_PRODUCT_ID || '9PGTCKZNKJ2G' }} | |
| run: msstore submission status $env:PRODUCT_ID | |
| publish-release: | |
| needs: [build-linux, build-windows] | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Publish draft release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: gh release edit "${GITHUB_REF_NAME}" --draft=false --repo "${GITHUB_REPOSITORY}" | |
| - uses: vedantmgoyal9/winget-releaser@main | |
| with: | |
| identifier: xLightsSequencer.xLights | |
| installers-regex: '\.exe$' # Only .exe files | |
| token: ${{ secrets.WINGET_TOKEN }} |