826 lines
43 KiB
YAML
826 lines
43 KiB
YAML
name: Release
|
|
run-name: ${{ inputs.test_signing && 'SignPath test signing' || 'Release' }}
|
|
|
|
# Releasing is automatic. A push to main that carries a fix or a feat ends with a published installer, without anybody merging or dispatching anything: this workflow refreshes release-please's pull request, tests it, merges it, turns the merge into a draft release, then builds, signs and publishes that draft.
|
|
#
|
|
# The whole cycle runs inside the one run that the original push started. land-release-pr.sh merges with GITHUB_TOKEN, whose pushes do not start workflow runs, so the merge cannot produce a second Release run queued behind this one on the concurrency group.
|
|
#
|
|
# This spends code signing signatures on every releasable merge to main -- one per payload EXE/DLL plus one for the installer, so roughly fifteen per release rather than one. The certificate allows 3000 signatures a month, so the quota is still not what constrains this; what it spends is release hygiene -- see docs/product-release.md.
|
|
#
|
|
# workflow_dispatch either repairs an existing draft or tests SignPath with the selected commit.
|
|
# Test signing uses the same build and packaging steps, but never creates or publishes a release.
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: Draft release tag to build, sign and publish, for example v2026.9.1
|
|
required: false
|
|
type: string
|
|
test_signing:
|
|
description: Test SignPath on the selected ref without creating or publishing a release (leave tag empty)
|
|
required: false
|
|
type: boolean
|
|
default: false
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
# A push refreshes release-please metadata while workflow_dispatch builds a
|
|
# selected draft. They must not block each other on the same branch lock.
|
|
group: release-${{ inputs.test_signing && 'test-signing' || github.event_name }}-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
prepare:
|
|
name: Prepare release metadata
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 60
|
|
permissions:
|
|
# Read the PR-triggered run; merging stays scoped to GITHUB_TOKEN.
|
|
actions: read
|
|
contents: write
|
|
pull-requests: write
|
|
outputs:
|
|
should_publish: ${{ inputs.test_signing || github.event_name == 'workflow_dispatch' || steps.target.outputs.release_created == 'true' }}
|
|
tag_name: ${{ inputs.test_signing && format('test-{0}', github.run_id) || (github.event_name == 'workflow_dispatch' && inputs.tag || steps.target.outputs.tag_name) }}
|
|
signing_provider: ${{ inputs.test_signing && 'signpath' || vars.WINDOWS_SIGNING_PROVIDER }}
|
|
signing_policy: ${{ inputs.test_signing && 'test-signing' || vars.SIGNPATH_SIGNING_POLICY_SLUG }}
|
|
test_certificate_sha256: ${{ steps.test_signing.outputs.certificate_sha256 }}
|
|
version: ${{ inputs.test_signing && steps.test_signing.outputs.version || (github.event_name == 'workflow_dispatch' && steps.requested_release.outputs.version || steps.target.outputs.version) }}
|
|
target_sha: ${{ inputs.test_signing && github.sha || (github.event_name == 'workflow_dispatch' && steps.requested_release.outputs.target_sha || steps.target.outputs.target_sha) }}
|
|
steps:
|
|
- name: Check out release automation
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Validate the test signing policy and download its public certificate
|
|
if: ${{ inputs.test_signing }}
|
|
id: test_signing
|
|
env:
|
|
SIGNPATH_TOKEN: ${{ secrets.SIGNPATH_TOKEN }}
|
|
SIGNPATH_ORGANIZATION_ID: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
|
|
SIGNPATH_PROJECT_SLUG: ${{ vars.SIGNPATH_PROJECT_SLUG }}
|
|
run: python3 scripts/ci/prepare-test-signing.py
|
|
|
|
- name: Upload the test signing public certificate
|
|
if: ${{ inputs.test_signing }}
|
|
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
|
|
with:
|
|
name: signpath-test-certificate
|
|
path: ${{ runner.temp }}/signpath-test.cer
|
|
if-no-files-found: error
|
|
|
|
# Separate release metadata from PR updates to preserve release-please ordering.
|
|
# Recover an already-merged release before calculating the next PR, matching release-please's
|
|
# normal releases-then-pull-requests ordering.
|
|
- name: Require the release metadata credential
|
|
if: ${{ github.event_name == 'push' }}
|
|
env:
|
|
RELEASE_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
|
|
run: |
|
|
if [[ -z "$RELEASE_TOKEN" ]]; then
|
|
echo '::error::RELEASE_PLEASE_TOKEN must allow contents and workflows writes to create release tags.'
|
|
exit 1
|
|
fi
|
|
|
|
- name: Recover releases from previously merged pull requests
|
|
if: ${{ github.event_name == 'push' }}
|
|
id: release_pr
|
|
uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5
|
|
with:
|
|
# release-please reads and writes the repository's default branch unless told otherwise, and that is now develop. The release branch is main: without this the version pull request, the changelog and the tag all land on develop, and the branch this workflow waits for (release-please--branches--main--*) is never created.
|
|
target-branch: main
|
|
token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
|
|
skip-github-pull-request: true
|
|
|
|
- name: Refresh the release pull request
|
|
# When recovery found a release to publish, do not create the next
|
|
# release PR in the same run. That PR belongs to the next main push.
|
|
if: ${{ github.event_name == 'push' && steps.release_pr.outputs.release_created != 'true' }}
|
|
id: release_update
|
|
uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5
|
|
with:
|
|
target-branch: main
|
|
# A trusted credential starts normal PR checks without manual workflow approval.
|
|
token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
|
|
skip-github-release: true
|
|
|
|
- name: Test and merge the release pull request
|
|
if: ${{ github.event_name == 'push' }}
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
GH_REPO: ${{ github.repository }}
|
|
run: bash scripts/ci/land-release-pr.sh
|
|
|
|
- name: Create the release for the merged pull request
|
|
if: ${{ github.event_name == 'push' }}
|
|
id: release
|
|
uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5
|
|
with:
|
|
target-branch: main
|
|
# Creating a tag at a historical workflow-changing commit needs workflows:write.
|
|
# Only GITHUB_TOKEN merges to main, preventing a second Release run.
|
|
token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
|
|
skip-github-pull-request: true
|
|
|
|
- name: Resolve the release this run publishes
|
|
if: ${{ github.event_name == 'push' }}
|
|
id: target
|
|
env:
|
|
FIRST_CREATED: ${{ steps.release_pr.outputs.release_created }}
|
|
FIRST_TAG: ${{ steps.release_pr.outputs.tag_name }}
|
|
FIRST_VERSION: ${{ steps.release_pr.outputs.version }}
|
|
FIRST_SHA: ${{ steps.release_pr.outputs.sha }}
|
|
SECOND_CREATED: ${{ steps.release.outputs.release_created }}
|
|
SECOND_TAG: ${{ steps.release.outputs.tag_name }}
|
|
SECOND_VERSION: ${{ steps.release.outputs.version }}
|
|
SECOND_SHA: ${{ steps.release.outputs.sha }}
|
|
run: bash scripts/ci/resolve-auto-release.sh
|
|
|
|
- name: Validate requested draft release
|
|
if: ${{ github.event_name == 'workflow_dispatch' && !inputs.test_signing }}
|
|
id: requested_release
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
GH_REPO: ${{ github.repository }}
|
|
TAG_NAME: ${{ inputs.tag }}
|
|
run: bash scripts/ci/validate-draft-release.sh
|
|
|
|
dependencies:
|
|
name: Load the release product lock
|
|
needs: prepare
|
|
if: ${{ needs.prepare.outputs.should_publish == 'true' }}
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 60
|
|
outputs:
|
|
dictionary_tag: ${{ steps.lock.outputs.dictionary_tag }}
|
|
steps:
|
|
- name: Read dependencies from the release commit
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ needs.prepare.outputs.target_sha }}
|
|
persist-credentials: false
|
|
# verify-published is a release gate and is deliberately absent from ci.yml: a pull request
|
|
# legitimately locks a branch commit while a change lands in the engine and here at once, and
|
|
# enforcing reachability there would deadlock the landing it protects.
|
|
- name: Validate and export the product lock
|
|
id: lock
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
python3 scripts/product_lock.py verify-published
|
|
python3 scripts/product_lock.py outputs --github-output "$GITHUB_OUTPUT"
|
|
|
|
tsf:
|
|
name: Build TSF ${{ matrix.name }}
|
|
needs: [prepare, dependencies]
|
|
if: ${{ needs.prepare.outputs.should_publish == 'true' }}
|
|
# SignPath's open-source plan accepts a signing request only when every job leading up to it ran on a GitHub-hosted runner, so under SignPath the three Windows jobs move off the release machine. The certificate path keeps the self-hosted runner, where the certificate lives.
|
|
runs-on: ${{ needs.prepare.outputs.signing_provider == 'signpath' && 'windows-2025' || fromJSON('["self-hosted","Windows","X64","msime-windows"]') }}
|
|
env:
|
|
# Each self-hosted runner has a different default vcpkg installation.
|
|
# Keep every matrix job aligned with the registry selected below even
|
|
# when GitHub schedules x64 and Win32 on different runner instances.
|
|
# A GitHub-hosted runner has one, at C:\vcpkg on windows-2025 (VCPKG_INSTALLATION_ROOT); the verification step below checks the image still puts it there.
|
|
VCPKG_ROOT: ${{ needs.prepare.outputs.signing_provider == 'signpath' && 'C:\vcpkg' || matrix.vcpkg_root }}
|
|
timeout-minutes: 60
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- name: x64
|
|
architecture: x64
|
|
triplet: x64-windows-static
|
|
build_dir: windows/build64-release
|
|
vcpkg_root: E:\msime-runner\vcpkg-1
|
|
- name: Win32
|
|
architecture: Win32
|
|
triplet: x86-windows-static
|
|
build_dir: windows/build32-release
|
|
vcpkg_root: E:\msime-runner\vcpkg-2
|
|
steps:
|
|
- name: Check out release commit
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ needs.prepare.outputs.target_sha }}
|
|
submodules: recursive
|
|
persist-credentials: false
|
|
|
|
# Some runner instances leave _work owned by SYSTEM while the job itself
|
|
# runs as `runner`. checkout still succeeds, so the first plain git call
|
|
# is what exits 128 on dubious ownership, minutes into the job.
|
|
#
|
|
# The self-hosted jobs are separate runner instances on one machine, so
|
|
# they share C:\Users\runner\.gitconfig and reach this step in the same
|
|
# second. Whoever loses that race gets "could not lock config file". Read
|
|
# the list back before each attempt so a peer's write counts as success.
|
|
- name: Trust the runner workspace
|
|
shell: pwsh
|
|
run: |
|
|
$workspace = $env:GITHUB_WORKSPACE -replace '\\', '/'
|
|
foreach ($attempt in 1..10) {
|
|
$trusted = git config --global --get-all safe.directory
|
|
if ($trusted -contains $workspace) { exit 0 }
|
|
git config --global --add safe.directory $workspace
|
|
if ($LASTEXITCODE -eq 0) { exit 0 }
|
|
Start-Sleep -Milliseconds (200 * $attempt)
|
|
}
|
|
throw "Could not add $workspace to the global safe.directory list"
|
|
|
|
- name: Stamp the version resource
|
|
shell: pwsh
|
|
env:
|
|
TARGET_VERSION: ${{ needs.prepare.outputs.version }}
|
|
run: |
|
|
python scripts/apply_version.py --version $env:TARGET_VERSION
|
|
python scripts/apply_version.py --version $env:TARGET_VERSION --check
|
|
|
|
# Before anything installs into or caches from VCPKG_ROOT: a mismatch found after the cache save would already have stored the wrong root's archives under the -complete key.
|
|
- name: Verify the selected vcpkg root
|
|
shell: pwsh
|
|
env:
|
|
EXPECTED_VCPKG_ROOT: ${{ needs.prepare.outputs.signing_provider != 'signpath' && matrix.vcpkg_root || '' }}
|
|
run: |
|
|
# On a hosted runner the image's own vcpkg is the expected one.
|
|
$expected = if ($env:EXPECTED_VCPKG_ROOT) { $env:EXPECTED_VCPKG_ROOT } else { $env:VCPKG_INSTALLATION_ROOT }
|
|
if ($env:VCPKG_ROOT -ne $expected) {
|
|
throw "VCPKG_ROOT is '$env:VCPKG_ROOT'; expected '$expected' for ${{ matrix.name }} on runner '$env:RUNNER_NAME'"
|
|
}
|
|
|
|
# A hosted runner starts with no vcpkg binaries, so it restores the archives ci.yml's TSF job saves under the same scope. A run on main can read the caches develop's CI wrote, since develop is the default branch.
|
|
- name: Restore dependency binaries
|
|
if: ${{ needs.prepare.outputs.signing_provider == 'signpath' }}
|
|
id: vcpkg-cache
|
|
uses: ./.github/actions/vcpkg-cache
|
|
with:
|
|
scope: tip-${{ matrix.triplet }}
|
|
|
|
- name: Install dependencies
|
|
shell: pwsh
|
|
working-directory: windows
|
|
run: |
|
|
& "$env:VCPKG_ROOT\\vcpkg.exe" install --triplet ${{ matrix.triplet }}
|
|
|
|
- name: Save dependency binaries before compiling
|
|
if: ${{ needs.prepare.outputs.signing_provider == 'signpath' && steps.vcpkg-cache.outputs.matched-key != format('{0}-complete', steps.vcpkg-cache.outputs.key) }}
|
|
uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
with:
|
|
path: ${{ steps.vcpkg-cache.outputs.path }}
|
|
key: ${{ steps.vcpkg-cache.outputs.key }}-complete
|
|
|
|
# CMakePresets.json points at a developer machine's vcpkg, so the presets cannot be used
|
|
# here. This mirrors what .github/workflows/ci.yml already does, into the build directory
|
|
# layout that the installer's Prepare-PackageFiles.ps1 expects.
|
|
- name: Configure
|
|
shell: pwsh
|
|
run: >
|
|
cmake -S windows -B ${{ matrix.build_dir }} -A ${{ matrix.architecture }}
|
|
-DCMAKE_TOOLCHAIN_FILE="$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake"
|
|
-DVCPKG_TARGET_TRIPLET=${{ matrix.triplet }}
|
|
|
|
- name: Build
|
|
shell: pwsh
|
|
run: cmake --build ${{ matrix.build_dir }} --config Release --parallel
|
|
|
|
- name: Check the TSF binary and symbols the installer expects
|
|
shell: pwsh
|
|
run: ./scripts/ci/check-tsf-dll.ps1 -BuildDir '${{ matrix.build_dir }}'
|
|
|
|
- name: Test the wire contract on this architecture
|
|
run: ctest --test-dir ${{ matrix.build_dir }} -C Release --output-on-failure
|
|
|
|
- name: Upload the TSF binary and symbols
|
|
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
|
|
with:
|
|
name: tsf-${{ matrix.name }}
|
|
# Upload the output directory so download-artifact restores its contents directly into
|
|
# the layout Prepare-PackageFiles.ps1 expects.
|
|
path: ${{ matrix.build_dir }}/Release
|
|
if-no-files-found: error
|
|
|
|
server:
|
|
name: Build Server
|
|
needs: [prepare, dependencies]
|
|
if: ${{ needs.prepare.outputs.should_publish == 'true' }}
|
|
runs-on: ${{ needs.prepare.outputs.signing_provider == 'signpath' && 'windows-2025' || fromJSON('["self-hosted","Windows","X64","msime-windows"]') }}
|
|
env:
|
|
# windows-2025 already sets this to its own vcpkg; the self-hosted runner's default is replaced with the instance reserved for this job.
|
|
VCPKG_INSTALLATION_ROOT: ${{ needs.prepare.outputs.signing_provider == 'signpath' && 'C:\vcpkg' || 'E:\\msime-runner\\vcpkg-3' }}
|
|
# Only the GitHub-hosted path compiles through sccache (see Configure); the variable is inert where sccache is not the compiler launcher.
|
|
SCCACHE_GHA_ENABLED: ${{ needs.prepare.outputs.signing_provider == 'signpath' && 'true' || '' }}
|
|
SCCACHE_IGNORE_SERVER_IO_ERROR: ${{ needs.prepare.outputs.signing_provider == 'signpath' && '1' || '' }}
|
|
# A 4-core hosted runner is slower than the release machine; sccache hits from ci.yml's Server job on develop carry most of it.
|
|
timeout-minutes: ${{ needs.prepare.outputs.signing_provider == 'signpath' && 120 || 90 }}
|
|
steps:
|
|
- name: Check out release commit
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ needs.prepare.outputs.target_sha }}
|
|
submodules: recursive
|
|
persist-credentials: false
|
|
|
|
# Some runner instances leave _work owned by SYSTEM while the job itself
|
|
# runs as `runner`. checkout still succeeds, so the first plain git call
|
|
# is what exits 128 on dubious ownership, minutes into the job.
|
|
#
|
|
# The self-hosted jobs are separate runner instances on one machine, so
|
|
# they share C:\Users\runner\.gitconfig and reach this step in the same
|
|
# second. Whoever loses that race gets "could not lock config file". Read
|
|
# the list back before each attempt so a peer's write counts as success.
|
|
- name: Trust the runner workspace
|
|
shell: pwsh
|
|
run: |
|
|
$workspace = $env:GITHUB_WORKSPACE -replace '\\', '/'
|
|
foreach ($attempt in 1..10) {
|
|
$trusted = git config --global --get-all safe.directory
|
|
if ($trusted -contains $workspace) { exit 0 }
|
|
git config --global --add safe.directory $workspace
|
|
if ($LASTEXITCODE -eq 0) { exit 0 }
|
|
Start-Sleep -Milliseconds (200 * $attempt)
|
|
}
|
|
throw "Could not add $workspace to the global safe.directory list"
|
|
|
|
# The job env replaces the image's own VCPKG_INSTALLATION_ROOT, so check C:\vcpkg against the vcpkg the image puts on PATH before install-boost.ps1, the cache key and the toolchain all read it.
|
|
- name: Verify the hosted vcpkg root
|
|
if: ${{ needs.prepare.outputs.signing_provider == 'signpath' }}
|
|
shell: pwsh
|
|
run: |
|
|
$onPath = Get-Command vcpkg.exe -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1
|
|
$imageRoot = if ($onPath) { Split-Path -Parent $onPath.Source } else { '' }
|
|
if (-not (Test-Path -LiteralPath (Join-Path $env:VCPKG_INSTALLATION_ROOT 'vcpkg.exe') -PathType Leaf) -or
|
|
$imageRoot -ne $env:VCPKG_INSTALLATION_ROOT) {
|
|
throw "VCPKG_INSTALLATION_ROOT is '$env:VCPKG_INSTALLATION_ROOT' but the image's vcpkg is at '$imageRoot'"
|
|
}
|
|
|
|
# The GitHub-hosted steps below are ci.yml's Server job: the same vcpkg cache scope, MSVC environment and sccache, so a release run on main restores what develop's CI saved instead of compiling Boost and the whole server cold on four cores.
|
|
- name: Restore dependency binaries
|
|
if: ${{ needs.prepare.outputs.signing_provider == 'signpath' }}
|
|
id: vcpkg-cache
|
|
uses: ./.github/actions/vcpkg-cache
|
|
with:
|
|
scope: server-x64-windows-and-static-md
|
|
|
|
- name: Set up MSVC environment
|
|
if: ${{ needs.prepare.outputs.signing_provider == 'signpath' }}
|
|
uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
|
|
|
|
- name: Set up sccache
|
|
if: ${{ needs.prepare.outputs.signing_provider == 'signpath' }}
|
|
id: sccache
|
|
continue-on-error: true
|
|
uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
|
|
|
|
- name: Install Boost
|
|
shell: pwsh
|
|
run: ./scripts/ci/install-boost.ps1
|
|
|
|
- name: Save Boost binaries before configuring
|
|
if: ${{ needs.prepare.outputs.signing_provider == 'signpath' && steps.vcpkg-cache.outputs.matched-key != format('{0}-complete', steps.vcpkg-cache.outputs.key) && steps.vcpkg-cache.outputs.matched-key != format('{0}-boost', steps.vcpkg-cache.outputs.key) }}
|
|
uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
with:
|
|
path: ${{ steps.vcpkg-cache.outputs.path }}
|
|
key: ${{ steps.vcpkg-cache.outputs.key }}-boost
|
|
|
|
# The package job stages these outputs into the installer's expected directory.
|
|
- name: Configure
|
|
if: ${{ needs.prepare.outputs.signing_provider != 'signpath' }}
|
|
shell: pwsh
|
|
run: >
|
|
cmake -S server -B server/build-release -A x64
|
|
-DCMAKE_TOOLCHAIN_FILE="$env:VCPKG_INSTALLATION_ROOT/scripts/buildsystems/vcpkg.cmake"
|
|
-DVCPKG_TARGET_TRIPLET=x64-windows
|
|
-DMSIME_PRODUCT_VERSION_OVERRIDE=${{ needs.prepare.outputs.version }}
|
|
|
|
# Ninja Multi-Config because sccache plugs in through CMAKE_<LANG>_COMPILER_LAUNCHER, which the Visual Studio generator ignores; it keeps the --config Release / bin/Release layout the later steps read.
|
|
- name: Configure hosted build
|
|
if: ${{ needs.prepare.outputs.signing_provider == 'signpath' }}
|
|
shell: pwsh
|
|
run: |
|
|
$cmakeArgs = @(
|
|
'-S', 'server', '-B', 'server/build-release', '-G', 'Ninja Multi-Config',
|
|
"-DCMAKE_TOOLCHAIN_FILE=$env:VCPKG_INSTALLATION_ROOT/scripts/buildsystems/vcpkg.cmake",
|
|
'-DVCPKG_TARGET_TRIPLET=x64-windows',
|
|
'-DMSIME_PRODUCT_VERSION_OVERRIDE=${{ needs.prepare.outputs.version }}'
|
|
)
|
|
$cmakeArgs += @(./scripts/ci/cmake-sccache-args.ps1 -SetupOutcome '${{ steps.sccache.outcome }}')
|
|
cmake @cmakeArgs
|
|
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
|
|
|
|
- name: Save dependency binaries before compiling
|
|
if: ${{ needs.prepare.outputs.signing_provider == 'signpath' && steps.vcpkg-cache.outputs.matched-key != format('{0}-complete', steps.vcpkg-cache.outputs.key) }}
|
|
uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
with:
|
|
path: ${{ steps.vcpkg-cache.outputs.path }}
|
|
key: ${{ steps.vcpkg-cache.outputs.key }}-complete
|
|
|
|
- name: Build
|
|
shell: pwsh
|
|
run: cmake --build server/build-release --config Release --parallel
|
|
|
|
- name: Report sccache hit rate
|
|
if: ${{ !cancelled() && needs.prepare.outputs.signing_provider == 'signpath' && steps.sccache.outcome == 'success' }}
|
|
continue-on-error: true
|
|
shell: pwsh
|
|
run: sccache --show-stats
|
|
|
|
- name: Check the binaries the installer requires
|
|
shell: pwsh
|
|
run: ./scripts/ci/check-server-binaries.ps1 -BuildDir server/build-release/bin/Release
|
|
|
|
- name: Test Server with the release's exact dictionaries
|
|
shell: pwsh
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: ./scripts/ci/test-server.ps1 -ServerRoot server -StagingRoot "$env:RUNNER_TEMP/product-data" -BuildDir build-release
|
|
|
|
# A uiAccess=true binary cannot be launched from the non-interactive
|
|
# service session used by this runner. Test the normal build first, then
|
|
# embed the manifest before upload and signing.
|
|
- name: Embed the Server uiAccess manifest
|
|
shell: pwsh
|
|
run: ./scripts/ci/embed-server-manifest.ps1 -BuildDir server/build-release/bin/Release
|
|
|
|
- name: Verify the embedded Server uiAccess manifest
|
|
shell: pwsh
|
|
run: ./scripts/ci/check-server-binaries.ps1 -BuildDir server/build-release/bin/Release
|
|
|
|
- name: Upload the Server build
|
|
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
|
|
with:
|
|
name: server
|
|
path: server/build-release/bin/Release
|
|
if-no-files-found: error
|
|
|
|
package:
|
|
name: Package and publish installer
|
|
needs: [prepare, dependencies, tsf, server]
|
|
# Stated explicitly even though skipped needs would already skip this job. This is the only job
|
|
# that spends a signature, so the condition that stops it belongs here rather than being a
|
|
# consequence of the other jobs' conditions that a later edit could quietly undo.
|
|
if: ${{ needs.prepare.outputs.should_publish == 'true' }}
|
|
runs-on: ${{ needs.prepare.outputs.signing_provider == 'signpath' && 'windows-2025' || fromJSON('["self-hosted","Windows","X64","msime-windows"]') }}
|
|
# A SignPath signing request waits for an approver, twice per release, so that path gets room for both approvals on top of the build.
|
|
timeout-minutes: ${{ needs.prepare.outputs.signing_provider == 'signpath' && 150 || 60 }}
|
|
permissions:
|
|
contents: write
|
|
# Build provenance. Unlike Authenticode this costs nothing and needs no certificate, and the
|
|
# Sigstore transparency log it writes to is outside this organisation's control, so it is the
|
|
# one integrity signal a repository admin cannot forge by swapping a release asset.
|
|
id-token: write
|
|
attestations: write
|
|
# signpath/github-action-submit-signing-request reads this job's details and downloads the artifact it submits with GITHUB_TOKEN; without this the request fails before SignPath sees it.
|
|
actions: read
|
|
env:
|
|
DICTIONARY_TAG: ${{ needs.dependencies.outputs.dictionary_tag }}
|
|
# download-dictionaries.sh stages MetasequoiaImeDict/out under this root, and
|
|
# Prepare-PackageFiles.ps1 reads its dictionary directory from the same place. Before the
|
|
# consolidation this was a synthetic tree holding five sibling checkouts under their
|
|
# historical names; now the dictionary release is the only source that still arrives from
|
|
# outside, so it lands beside the components in the one checkout.
|
|
STAGING_ROOT: .
|
|
steps:
|
|
# The helpcodes are collected out of engine/helpcode, which is a directory of this repository,
|
|
# so a plain checkout of the release commit already carries them.
|
|
- name: Check out the release commit
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ needs.prepare.outputs.target_sha }}
|
|
persist-credentials: false
|
|
|
|
# Some runner instances leave _work owned by SYSTEM while the job itself
|
|
# runs as `runner`. checkout still succeeds, so the first plain git call
|
|
# is what exits 128 on dubious ownership, minutes into the job.
|
|
#
|
|
# The self-hosted jobs are separate runner instances on one machine, so
|
|
# they share C:\Users\runner\.gitconfig and reach this step in the same
|
|
# second. Whoever loses that race gets "could not lock config file". Read
|
|
# the list back before each attempt so a peer's write counts as success.
|
|
- name: Trust the runner workspace
|
|
shell: pwsh
|
|
run: |
|
|
$workspace = $env:GITHUB_WORKSPACE -replace '\\', '/'
|
|
foreach ($attempt in 1..10) {
|
|
$trusted = git config --global --get-all safe.directory
|
|
if ($trusted -contains $workspace) { exit 0 }
|
|
git config --global --add safe.directory $workspace
|
|
if ($LASTEXITCODE -eq 0) { exit 0 }
|
|
Start-Sleep -Milliseconds (200 * $attempt)
|
|
}
|
|
throw "Could not add $workspace to the global safe.directory list"
|
|
|
|
- name: Verify the release commit is on main
|
|
if: ${{ !inputs.test_signing }}
|
|
shell: bash
|
|
run: bash scripts/ci/verify-commit-on-main.sh
|
|
|
|
- name: Download the test signing public certificate
|
|
if: ${{ inputs.test_signing }}
|
|
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
|
|
with:
|
|
name: signpath-test-certificate
|
|
path: ${{ runner.temp }}/signpath-test-certificate
|
|
|
|
- name: Trust the pinned test certificate on this ephemeral runner
|
|
if: ${{ inputs.test_signing }}
|
|
id: test_certificate
|
|
shell: pwsh
|
|
env:
|
|
EXPECTED_SHA256: ${{ needs.prepare.outputs.test_certificate_sha256 }}
|
|
run: >
|
|
./scripts/ci/trust-test-signing-certificate.ps1
|
|
-Path "$env:RUNNER_TEMP/signpath-test-certificate/signpath-test.cer"
|
|
-ExpectedSha256 $env:EXPECTED_SHA256
|
|
|
|
# The hosted image's preinstalled ISCC compiles the installer only after the payload signing request has been approved. Prove now, before any signature is spent, that it resolves the Chinese language file and is new enough (6.6+) for msime_setup.iss.
|
|
- name: Check the hosted Inno Setup can compile the installer
|
|
if: ${{ needs.prepare.outputs.signing_provider == 'signpath' }}
|
|
shell: pwsh
|
|
run: ./scripts/ci/check-inno-language.ps1
|
|
|
|
- name: Download the x64 TSF binary and symbols
|
|
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
|
|
with:
|
|
name: tsf-x64
|
|
path: windows/build64-release/Release
|
|
|
|
- name: Download the 32-bit TSF binary and symbols
|
|
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
|
|
with:
|
|
name: tsf-Win32
|
|
path: windows/build32-release/Release
|
|
|
|
- name: Download the Server build
|
|
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
|
|
with:
|
|
name: server
|
|
path: server/build-release/bin/Release
|
|
|
|
- name: Download the dictionaries
|
|
shell: bash
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: bash scripts/ci/download-dictionaries.sh
|
|
|
|
# The word-lattice language model is the one product input that is neither built from this
|
|
# repository's sources nor published in the dictionary release: it is converted here from the
|
|
# ARPA corpus pinned in language-model/lock.json. Both the download and the converted result
|
|
# are checked against that lock, so this step is reproducible rather than a fetch of whatever
|
|
# the upstream file server serves today. It configures engine/ngram alone, so it needs no
|
|
# vcpkg and no SQLite on this runner.
|
|
- name: Build the word-lattice language model
|
|
shell: pwsh
|
|
run: ./scripts/build-language-model.ps1
|
|
|
|
# The neural sentence models are downloaded from the chinese-ime-lm release pinned in
|
|
# neural-model/lock.json and checked against the SHA256 recorded there. Prepare-PackageFiles.ps1
|
|
# asserts they exist, so this has to run before the payload is collected.
|
|
- name: Download the neural sentence models
|
|
shell: pwsh
|
|
run: ./scripts/fetch-neural-model.ps1
|
|
|
|
- name: Decide the signing mode
|
|
id: signing
|
|
shell: pwsh
|
|
env:
|
|
CERTIFICATE_BASE64: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_BASE64 }}
|
|
CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_PASSWORD }}
|
|
CERTIFICATE_THUMBPRINT: ${{ vars.WINDOWS_SIGNING_CERTIFICATE_THUMBPRINT }}
|
|
SIGNING_PROVIDER: ${{ needs.prepare.outputs.signing_provider }}
|
|
SIGNPATH_TOKEN: ${{ secrets.SIGNPATH_TOKEN }}
|
|
SIGNPATH_ORGANIZATION_ID: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
|
|
SIGNPATH_PROJECT_SLUG: ${{ vars.SIGNPATH_PROJECT_SLUG }}
|
|
SIGNPATH_SIGNING_POLICY_SLUG: ${{ needs.prepare.outputs.signing_policy }}
|
|
run: ./scripts/ci/detect-release-signing.ps1
|
|
|
|
# -IncludeSymbols is what makes the published installer carry the PDBs matching its binaries.
|
|
# Staging symbols is opt-in because they are ~140 MB against ~20 MB of binaries and Inno Setup
|
|
# compresses them with solid LZMA2, which is why the local test scripts leave them out.
|
|
- name: Collect the installer payload
|
|
shell: pwsh
|
|
working-directory: installer
|
|
env:
|
|
TARGET_VERSION: ${{ needs.prepare.outputs.version }}
|
|
run: >
|
|
pwsh -File ./Prepare-PackageFiles.ps1 -TargetVersion $env:TARGET_VERSION
|
|
-RepoRoot (Resolve-Path '..').Path
|
|
-TsfDirectory windows -ServerDirectory server -NoticesDirectory .
|
|
-HelpCodeDirectory engine/helpcode -IncludeSymbols
|
|
|
|
- name: Embed the exact product dependency manifest
|
|
env:
|
|
WINDOWS_COMMIT: ${{ needs.prepare.outputs.target_sha }}
|
|
run: >
|
|
python scripts/product_lock.py manifest
|
|
--windows-commit "$env:WINDOWS_COMMIT"
|
|
--output installer/app_data/product-manifest.json
|
|
|
|
# Every payload EXE/DLL, not just the uiAccess server. The server is the only one that
|
|
# technically requires a signature (uiAccess=true is ignored without one), but Microsoft
|
|
# Defender blocks the unsigned helper processes -- settings page, emoji panel, watchdog --
|
|
# and the user sees an input method that installs and then cannot open its own panels.
|
|
- name: Sign the payload binaries
|
|
if: ${{ steps.signing.outputs.signing_provider == 'certificate' }}
|
|
shell: pwsh
|
|
working-directory: installer
|
|
env:
|
|
CERTIFICATE_BASE64: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_BASE64 }}
|
|
CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_PASSWORD }}
|
|
CERTIFICATE_THUMBPRINT: ${{ vars.WINDOWS_SIGNING_CERTIFICATE_THUMBPRINT }}
|
|
TIMESTAMP_URL: ${{ vars.WINDOWS_SIGNING_TIMESTAMP_URL || 'http://timestamp.digicert.com' }}
|
|
run: ../scripts/ci/sign-binaries.ps1 -Recurse -Path 'server_exe', 'tsf_dll'
|
|
|
|
# The SignPath path signs the same files minus the third-party DLLs, which SignPath Foundation does not allow a project to sign. See scripts/ci/signpath-files.ps1 and installer/signpath/.
|
|
- name: Stage the payload binaries for SignPath
|
|
if: ${{ steps.signing.outputs.signing_provider == 'signpath' }}
|
|
shell: pwsh
|
|
working-directory: installer
|
|
run: ../scripts/ci/signpath-files.ps1 -Mode Stage -Set Payload -Directory "$env:RUNNER_TEMP/signpath-payload-unsigned"
|
|
|
|
- name: Upload the unsigned payload for SignPath
|
|
if: ${{ steps.signing.outputs.signing_provider == 'signpath' }}
|
|
id: signpath-payload
|
|
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
|
|
with:
|
|
name: signpath-payload-unsigned
|
|
path: ${{ runner.temp }}/signpath-payload-unsigned
|
|
if-no-files-found: error
|
|
|
|
- name: Sign the payload binaries with SignPath
|
|
id: signed_payload
|
|
if: ${{ steps.signing.outputs.signing_provider == 'signpath' }}
|
|
uses: signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0
|
|
with:
|
|
api-token: ${{ secrets.SIGNPATH_TOKEN }}
|
|
organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
|
|
project-slug: ${{ vars.SIGNPATH_PROJECT_SLUG }}
|
|
signing-policy-slug: ${{ needs.prepare.outputs.signing_policy }}
|
|
artifact-configuration-slug: payload
|
|
github-artifact-id: ${{ steps.signpath-payload.outputs.artifact-id }}
|
|
wait-for-completion: true
|
|
wait-for-completion-timeout-in-seconds: 3600
|
|
output-artifact-directory: ${{ runner.temp }}/signpath-payload-signed
|
|
|
|
- name: Put the signed payload binaries back
|
|
if: ${{ steps.signing.outputs.signing_provider == 'signpath' }}
|
|
shell: pwsh
|
|
working-directory: installer
|
|
env:
|
|
EXPECTED_SIGNER: ${{ steps.test_certificate.outputs.thumbprint }}
|
|
run: ../scripts/ci/signpath-files.ps1 -ExpectedSignerThumbprint "$env:EXPECTED_SIGNER" -AllowUntrustedSigner:${{ inputs.test_signing }} -Mode Restore -Set Payload -Directory "$env:RUNNER_TEMP/signpath-payload-signed"
|
|
|
|
- name: Install the Chinese language file for Inno Setup
|
|
shell: pwsh
|
|
run: ./scripts/ci/install-inno-language.ps1
|
|
|
|
- name: Compile the installer
|
|
shell: pwsh
|
|
working-directory: installer
|
|
run: pwsh -File ./Compile-Installer.ps1
|
|
|
|
- name: Sign the installer
|
|
if: ${{ steps.signing.outputs.signing_provider == 'certificate' }}
|
|
shell: pwsh
|
|
working-directory: installer
|
|
env:
|
|
CERTIFICATE_BASE64: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_BASE64 }}
|
|
CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_PASSWORD }}
|
|
CERTIFICATE_THUMBPRINT: ${{ vars.WINDOWS_SIGNING_CERTIFICATE_THUMBPRINT }}
|
|
TIMESTAMP_URL: ${{ vars.WINDOWS_SIGNING_TIMESTAMP_URL || 'http://timestamp.digicert.com' }}
|
|
TARGET_VERSION: ${{ needs.prepare.outputs.version }}
|
|
run: ../scripts/ci/sign-binaries.ps1 -Path "Output/MetasequoiaIME_Setup_v$env:TARGET_VERSION.exe"
|
|
|
|
- name: Stage the installer for SignPath
|
|
if: ${{ steps.signing.outputs.signing_provider == 'signpath' }}
|
|
shell: pwsh
|
|
working-directory: installer
|
|
env:
|
|
TARGET_VERSION: ${{ needs.prepare.outputs.version }}
|
|
run: ../scripts/ci/signpath-files.ps1 -Mode Stage -Set Installer -Version $env:TARGET_VERSION -Directory "$env:RUNNER_TEMP/signpath-installer-unsigned"
|
|
|
|
- name: Upload the unsigned installer for SignPath
|
|
if: ${{ steps.signing.outputs.signing_provider == 'signpath' }}
|
|
id: signpath-installer
|
|
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
|
|
with:
|
|
name: signpath-installer-unsigned
|
|
path: ${{ runner.temp }}/signpath-installer-unsigned
|
|
if-no-files-found: error
|
|
|
|
- name: Sign the installer with SignPath
|
|
id: signed_installer
|
|
if: ${{ steps.signing.outputs.signing_provider == 'signpath' }}
|
|
uses: signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0
|
|
with:
|
|
api-token: ${{ secrets.SIGNPATH_TOKEN }}
|
|
organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
|
|
project-slug: ${{ vars.SIGNPATH_PROJECT_SLUG }}
|
|
signing-policy-slug: ${{ needs.prepare.outputs.signing_policy }}
|
|
artifact-configuration-slug: installer
|
|
github-artifact-id: ${{ steps.signpath-installer.outputs.artifact-id }}
|
|
wait-for-completion: true
|
|
wait-for-completion-timeout-in-seconds: 3600
|
|
output-artifact-directory: ${{ runner.temp }}/signpath-installer-signed
|
|
|
|
- name: Put the signed installer back
|
|
if: ${{ steps.signing.outputs.signing_provider == 'signpath' }}
|
|
shell: pwsh
|
|
working-directory: installer
|
|
env:
|
|
TARGET_VERSION: ${{ needs.prepare.outputs.version }}
|
|
EXPECTED_SIGNER: ${{ steps.test_certificate.outputs.thumbprint }}
|
|
run: ../scripts/ci/signpath-files.ps1 -ExpectedSignerThumbprint "$env:EXPECTED_SIGNER" -AllowUntrustedSigner:${{ inputs.test_signing }} -Mode Restore -Set Installer -Version $env:TARGET_VERSION -Directory "$env:RUNNER_TEMP/signpath-installer-signed"
|
|
|
|
- name: Record the signing request links for review
|
|
if: ${{ always() && steps.signing.outputs.signing_provider == 'signpath' }}
|
|
shell: pwsh
|
|
env:
|
|
PAYLOAD_REQUEST: ${{ steps.signed_payload.outputs.signing-request-web-url }}
|
|
INSTALLER_REQUEST: ${{ steps.signed_installer.outputs.signing-request-web-url }}
|
|
TEST_SIGNING: ${{ inputs.test_signing }}
|
|
run: |
|
|
$mode = if ($env:TEST_SIGNING -eq 'true') { 'Test signing (not for distribution)' } else { 'Release signing' }
|
|
@(
|
|
"## SignPath: $mode"
|
|
"GitHub Actions run: $env:GITHUB_SERVER_URL/$env:GITHUB_REPOSITORY/actions/runs/$env:GITHUB_RUN_ID"
|
|
"Payload request: $env:PAYLOAD_REQUEST"
|
|
"Installer request: $env:INSTALLER_REQUEST"
|
|
) >> $env:GITHUB_STEP_SUMMARY
|
|
|
|
- name: Name the asset and record its checksum
|
|
id: asset
|
|
shell: pwsh
|
|
working-directory: installer
|
|
env:
|
|
TARGET_VERSION: ${{ needs.prepare.outputs.version }}
|
|
ASSET_SUFFIX: ${{ inputs.test_signing && '-test-signed' || steps.signing.outputs.asset_suffix }}
|
|
run: ../scripts/ci/name-installer-asset.ps1
|
|
|
|
- name: Upload the installer as a workflow artifact
|
|
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
|
|
with:
|
|
name: ${{ inputs.test_signing && 'installer-test-signed' || 'installer' }}
|
|
path: |
|
|
${{ steps.asset.outputs.asset_path }}
|
|
installer/app_data/product-manifest.json
|
|
if-no-files-found: error
|
|
|
|
- name: Attest the installer's build provenance
|
|
if: ${{ !inputs.test_signing }}
|
|
uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
|
|
with:
|
|
subject-path: ${{ steps.asset.outputs.asset_path }}
|
|
|
|
- name: Revalidate the draft release target
|
|
if: ${{ !inputs.test_signing }}
|
|
shell: bash
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
GH_REPO: ${{ github.repository }}
|
|
TAG_NAME: ${{ needs.prepare.outputs.tag_name }}
|
|
TARGET_SHA: ${{ needs.prepare.outputs.target_sha }}
|
|
run: bash scripts/ci/revalidate-draft-release.sh
|
|
|
|
- name: Upload and publish the release
|
|
if: ${{ !inputs.test_signing }}
|
|
shell: bash
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
GH_REPO: ${{ github.repository }}
|
|
TAG_NAME: ${{ needs.prepare.outputs.tag_name }}
|
|
ASSET_PATH: ${{ steps.asset.outputs.asset_path }}
|
|
ASSET_NAME: ${{ steps.asset.outputs.asset_name }}
|
|
ASSET_SHA256: ${{ steps.asset.outputs.asset_sha256 }}
|
|
SIGNING_ENABLED: ${{ steps.signing.outputs.signing_enabled }}
|
|
PRODUCT_MANIFEST: installer/app_data/product-manifest.json
|
|
RELEASE_TRIGGER: ${{ github.event_name }}
|
|
TARGET_SHA: ${{ needs.prepare.outputs.target_sha }}
|
|
run: bash scripts/ci/publish-release.sh
|
|
|
|
# msime.app/update.json is what the settings page's "检查更新" reads, and MSIME-Web only
|
|
# regenerated it from a */30 cron. Scheduled events on public repositories are delayed heavily
|
|
# -- measured runs sat roughly two hours apart -- so the site advertised an old version for
|
|
# hours after every release. MSIME-Web already declares a repository_dispatch trigger for
|
|
# exactly this and nothing was ever sending it.
|
|
#
|
|
# This runs after publishing on purpose. If the dispatch fails the release is already out and
|
|
# correct; what the failure means is that the website is now stale and someone has to act, so
|
|
# it is reported as a failure rather than swallowed.
|
|
#
|
|
# No event condition: the enclosing job already only runs when a release is being published, and gating this on workflow_dispatch limited the notification to the repair path -- the one branch of this workflow that almost never runs. Every release from the normal push path published in silence, MSIME-Web received no dispatch at all, and the site waited for a cron that GitHub delivers roughly seven times a day rather than the forty-eight the schedule asks for. 0.8.0 reached msime.app a day late that way.
|
|
- name: Refresh the download manifest on msime.app
|
|
if: ${{ !inputs.test_signing }}
|
|
shell: bash
|
|
env:
|
|
GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
|
|
run: |
|
|
if [[ -z "$GH_TOKEN" ]]; then
|
|
echo '::error::RELEASE_PLEASE_TOKEN is required to notify MSIME-Web; msime.app/update.json will stay on the previous version until its cron catches up.'
|
|
exit 1
|
|
fi
|
|
gh api --method POST repos/metasequoiaime/MSIME-Web/dispatches -f event_type=update-manifest
|