小莫andfanlusky
ad78409e3c
* ci(release): run the SignPath path on GitHub-hosted runners SignPath's open-source plan accepts a signing request only when every job leading up to it ran on a GitHub-hosted runner, and tsf, server and package all ran on the self-hosted release machine. With WINDOWS_SIGNING_PROVIDER=signpath they now run on windows-2025, restoring vcpkg binaries and (for the Server) sccache the way ci.yml does; the certificate path keeps the self-hosted runner unchanged. The org secret holding the SignPath API token is SIGNPATH_TOKEN, so the workflow and detect-release-signing.ps1 read that name instead of SIGNPATH_API_TOKEN. AGENTS.md lists what SignPath needs configured, and the code signing policy records the accepted application and the hosted-runner rule. * fix(ci): let the SignPath action read the run's artifacts * fix(installer): drop authenticode-sign attributes SignPath Foundation rejects * fix(ci): fail the hosted SignPath release before signatures are spent - Probe ISCC with WizardStyle=modern dynamic and run that probe at the start of the hosted package job, so an image ISCC older than 6.6 fails before the payload signing request instead of after it. - Verify the TSF vcpkg root before installing into it or saving its archives under the -complete key. - Check the Server job's C:\vcpkg override against the vcpkg the hosted image puts on PATH. - Code signing policy: drop the stale "once approved" wording and state that the hosted-runner rule applies to SignPath-signed releases. * docs: list only the configured SignPath approver --------- Co-authored-by: fanlusky <1730976608@qq.com>
40 lines
1.8 KiB
PowerShell
Executable File
40 lines
1.8 KiB
PowerShell
Executable File
# Prove ISCC can resolve the Chinese language file, by compiling a script that needs it.
|
|
#
|
|
# install-inno-language.ps1 used to write the file next to the Chocolatey ISCC shim rather than into
|
|
# the Inno Setup installation, report success, and let packaging fail several steps later with an
|
|
# include error naming a path nothing had written to. Eight releases went out as unpublished drafts
|
|
# before anybody connected the two.
|
|
#
|
|
# Asserting the file exists where install-inno-language.ps1 put it would only restate that script's
|
|
# own belief about where ISCC looks, which is precisely the thing that was wrong. Compiling a script
|
|
# whose only content is a [Languages] entry pointing at compiler:Languages\ChineseSimplified.isl is
|
|
# what makes ISCC answer the question. Seconds on an image that already ships Inno Setup.
|
|
#
|
|
# The probe also carries msime_setup.iss's WizardStyle=modern dynamic, which ISCC older than 6.6
|
|
# rejects, so the same compile answers whether this ISCC can build the real installer.
|
|
$ErrorActionPreference = 'Stop'
|
|
|
|
& "$PSScriptRoot/install-inno-language.ps1"
|
|
|
|
$output = if ($env:RUNNER_TEMP) { $env:RUNNER_TEMP } else { [System.IO.Path]::GetTempPath() }
|
|
$probe = Join-Path $output 'language-probe.iss'
|
|
|
|
@(
|
|
'[Setup]'
|
|
'AppName=Language probe'
|
|
'AppVersion=1.0'
|
|
'DefaultDirName={autopf}\LanguageProbe'
|
|
"OutputDir=$output"
|
|
'OutputBaseFilename=language-probe'
|
|
'WizardStyle=modern dynamic'
|
|
'[Languages]'
|
|
'Name: "chinesesimplified"; MessagesFile: "compiler:Languages\ChineseSimplified.isl"'
|
|
) | Set-Content -Path $probe -Encoding UTF8
|
|
|
|
ISCC.exe $probe
|
|
if ($LASTEXITCODE -ne 0) {
|
|
throw "ISCC could not resolve compiler:Languages\ChineseSimplified.isl (exit code $LASTEXITCODE)"
|
|
}
|
|
|
|
Write-Host 'ISCC resolved compiler:Languages\ChineseSimplified.isl'
|