Evan Hu
fdbbf300a6
SignPath Foundation requires a page titled "Code signing policy" that carries its attribution, names the committers, reviewers and approvers, and links the privacy policy, referenced from the project home page and the release pages. docs/code-signing-policy.md states what is signed, the team roles taken from the repository collaborators and the maintainers team, the CI release process that SignPath-signed builds will go through, and the current status: releases up to v0.9.3 were built and signed locally with the Certum certificate. Both READMEs link to it, and publish-release.sh appends the link to the release notes it writes.
62 lines
2.7 KiB
Bash
Executable File
62 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Attach the installer to the selected release, append the artifact details to its notes and publish.
|
|
#
|
|
# The release-please tag is the stable version selected for a future manual release. An automatic
|
|
# build gets its own SemVer prerelease tag so that the prerelease and the eventual stable release
|
|
# can coexist: v0.6.2-beta is the automatic build, while v0.6.2 remains the stable draft.
|
|
#
|
|
# The prerelease flag means "automatic and uncurated" here, not "beta". The product being 内测 is
|
|
# stated in the notes and in docs/installation.md.
|
|
#
|
|
# Requires GH_TOKEN, GH_REPO, TAG_NAME, ASSET_PATH, ASSET_NAME, ASSET_SHA256, SIGNING_ENABLED,
|
|
# DICTIONARY_TAG, PRODUCT_MANIFEST, RELEASE_TRIGGER and TARGET_SHA.
|
|
set -euo pipefail
|
|
|
|
if [[ "$RELEASE_TRIGGER" == push ]]; then
|
|
release_tag="${TAG_NAME}-beta"
|
|
title="${release_tag}（自动构建）"
|
|
banner='本版本由 CI 在合并到 `main` 后自动构建发布。'
|
|
|
|
if release_json=$(gh release view "$release_tag" --repo "$GH_REPO" --json isDraft,isPrerelease,targetCommitish 2>/dev/null); then
|
|
test "$(jq -er .isDraft <<< "$release_json")" = false
|
|
test "$(jq -er .isPrerelease <<< "$release_json")" = true
|
|
test "$(jq -er .targetCommitish <<< "$release_json")" = "$TARGET_SHA"
|
|
else
|
|
gh release create "$release_tag" \
|
|
--repo "$GH_REPO" \
|
|
--target "$TARGET_SHA" \
|
|
--title "$title" \
|
|
--notes "$banner" \
|
|
--prerelease
|
|
fi
|
|
|
|
channel=(--prerelease)
|
|
else
|
|
release_tag="$TAG_NAME"
|
|
title="$TAG_NAME"
|
|
banner=''
|
|
channel=(--prerelease=false --latest)
|
|
fi
|
|
|
|
gh release upload "$release_tag" "$ASSET_PATH" "$PRODUCT_MANIFEST" --repo "$GH_REPO" --clobber
|
|
|
|
gh release view "$release_tag" --repo "$GH_REPO" --json body --jq .body > notes.md
|
|
{
|
|
if [[ -n "$banner" ]]; then
|
|
printf '\n> %s\n' "$banner"
|
|
fi
|
|
printf '\n---\n\n'
|
|
printf '| Field | Value |\n| --- | --- |\n'
|
|
printf '| Installer | `%s` |\n' "$ASSET_NAME"
|
|
printf '| SHA256 | `%s` |\n' "$ASSET_SHA256"
|
|
printf '| Dictionaries | `%s` |\n' "$DICTIONARY_TAG"
|
|
printf '| Build inputs | `product-manifest.json` (attached and installed) |\n'
|
|
printf '\n[Code signing policy](https://github.com/%s/blob/develop/docs/code-signing-policy.md)\n' "$GH_REPO"
|
|
if [[ "$SIGNING_ENABLED" != true ]]; then
|
|
printf '\nThis build is **unsigned**. Windows warns on launch, and `uiAccess` does not take effect, so the candidate window cannot float over elevated applications.\n'
|
|
fi
|
|
} >> notes.md
|
|
|
|
gh release edit "$release_tag" --repo "$GH_REPO" --draft=false "${channel[@]}" --title "$title" --notes-file notes.md
|
|
echo "Published $release_tag as '$title' (${channel[*]}) with $ASSET_NAME"
|