Swap TLS validations on wizard so homing after firmware type, refresh… #2537
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| # Sequence of patterns matched against refs/heads | |
| branches: | |
| - master | |
| - dev | |
| - features/* # all feature branches | |
| - bugfix/* | |
| # Sequence of patterns matched against refs/tags | |
| tags: | |
| - '*' | |
| pull_request: | |
| branches: [ "master" ] | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.CI_TOKEN }} | |
| NODE_OPTIONS: --max-old-space-size=8192 | |
| VITE_PUBLIC_POSTHOG_PROJECT_TOKEN: ${{ secrets.VITE_PUBLIC_POSTHOG_PROJECT_TOKEN }} | |
| VITE_PUBLIC_POSTHOG_HOST: ${{ secrets.VITE_PUBLIC_POSTHOG_HOST }} | |
| jobs: | |
| build-linux: | |
| name: Build Linux packages | |
| runs-on: ubuntu-latest | |
| environment: CI | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v3 | |
| - name: Setup and build | |
| uses: ./.github/actions/setup-build | |
| - name: Build Linux binaries | |
| run: yarn run build:linux | |
| - name: Prepare release assets | |
| shell: bash | |
| run: | | |
| GIT_COMMIT_LOG=`git log -1 --format='%ci %H %s'` | |
| PACKAGE_NAME=`node -e "console.log(require('./src/package.json').name)"` | |
| PACKAGE_VERSION=`node -e "console.log(require('./src/package.json').version)"` | |
| mkdir -p releases/linux | |
| ls -al output | |
| cp -af "output/${PACKAGE_NAME}-${PACKAGE_VERSION}-x86_64.AppImage" "releases/linux/${PACKAGE_NAME}-${PACKAGE_VERSION}-Linux-Intel-64Bit.AppImage" | |
| cp -af "output/${PACKAGE_NAME}-${PACKAGE_VERSION}-amd64.deb" "releases/linux/${PACKAGE_NAME}-${PACKAGE_VERSION}-Linux-Intel-64Bit.deb" | |
| cp -af "output/${PACKAGE_NAME}-${PACKAGE_VERSION}-arm64.AppImage" "releases/linux/${PACKAGE_NAME}-${PACKAGE_VERSION}-Linux-ARM-64Bit.AppImage" | |
| cp -af "output/${PACKAGE_NAME}-${PACKAGE_VERSION}-arm64.deb" "releases/linux/${PACKAGE_NAME}-${PACKAGE_VERSION}-Linux-ARM-64Bit.deb" | |
| ls -al output releases/linux | |
| if [[ "$GITHUB_REF_TYPE" == "branch" && "$GITHUB_REF_NAME" == "master" ]]; then | |
| yarn github-release delete \ | |
| --owner=gSender \ | |
| --repo=gsender \ | |
| --tag="${GITHUB_REF_NAME}-latest" \ | |
| --release-name="${GITHUB_REF_NAME}" \ | |
| "*-linux*"; | |
| yarn github-release upload \ | |
| --owner=gSender \ | |
| --repo=gsender \ | |
| --tag="${GITHUB_REF_NAME}-latest" \ | |
| --release-name="${GITHUB_REF_NAME}" \ | |
| --body="${GIT_COMMIT_LOG}" \ | |
| releases/linux/*; | |
| fi | |
| - name: Release | |
| uses: softprops/action-gh-release@v1 | |
| if: startsWith(github.ref, 'refs/tags/') | |
| with: | |
| files: releases/linux/* | |
| prerelease: true | |
| draft: true | |
| build-macos: | |
| name: Build macOS packages | |
| environment: CI | |
| runs-on: macos-latest | |
| env: | |
| GH_TOKEN: ${{ secrets.CI_TOKEN }} | |
| APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }} | |
| CSC_LINK: ${{ secrets.CSC_LINK }} | |
| # Skip code signing for pull requests | |
| CSC_IDENTITY_AUTO_DISCOVERY: ${{ github.event_name == 'pull_request' && 'false' || 'true' }} | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v3 | |
| - name: Pip setuptools | |
| run: sudo -H pip install setuptools | |
| - name: Setup and build | |
| uses: ./.github/actions/setup-build | |
| - name: Build macOS binaries | |
| run: yarn run build:macos | |
| - name: Prepare release assets | |
| shell: bash | |
| run: | | |
| GIT_COMMIT_LOG=`git log -1 --format='%ci %H %s'` | |
| PACKAGE_NAME=`node -e "console.log(require('./src/package.json').name)"` | |
| PACKAGE_VERSION=`node -e "console.log(require('./src/package.json').version)"` | |
| mkdir -p releases/macos | |
| ls -al output | |
| cp -af "output/${PACKAGE_NAME}-${PACKAGE_VERSION}-x64.dmg" "releases/macos/gSender-${PACKAGE_VERSION}-Mac-Intel.dmg" | |
| cp -af "output/${PACKAGE_NAME}-${PACKAGE_VERSION}-arm64.dmg" "releases/macos/gSender-${PACKAGE_VERSION}-Mac-Silicon.dmg" | |
| ls -al output releases/macos | |
| if [[ "$GITHUB_REF_TYPE" == "branch" && "$GITHUB_REF_NAME" == "master" ]]; then | |
| yarn github-release delete \ | |
| --owner=gSender \ | |
| --repo=gsender \ | |
| --tag="${GITHUB_REF_NAME}-latest" \ | |
| --release-name="${GITHUB_REF_NAME}" \ | |
| "*-macos*"; | |
| yarn github-release upload \ | |
| --owner=gSender \ | |
| --repo=gsender \ | |
| --tag="${GITHUB_REF_NAME}-latest" \ | |
| --release-name="${GITHUB_REF_NAME}" \ | |
| --body="${GIT_COMMIT_LOG}" \ | |
| releases/macos/*; | |
| fi | |
| - name: Release | |
| uses: softprops/action-gh-release@v1 | |
| if: startsWith(github.ref, 'refs/tags/') | |
| with: | |
| files: releases/macos/* | |
| prerelease: true | |
| draft: true | |
| - name: Upload Mac Artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: mac_artifact | |
| path: releases/macos/*.dmg | |
| compression-level: 0 # no compression | |
| retention-days: 2 | |
| build-windows: | |
| name: Build Windows packages | |
| environment: CI | |
| runs-on: windows-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Prepare VC++ Runtime | |
| run: choco install -y vcredist2017 | |
| - name: Checkout code | |
| uses: actions/checkout@v3 | |
| - name: Write client auth certificate | |
| if: startsWith(github.ref, 'refs/tags/') | |
| shell: pwsh | |
| run: | | |
| $b64 = "${{ secrets.SM_CLIENT_CERT_FILE_BASE64 }}" -replace '\s', '' | |
| $certBytes = [Convert]::FromBase64String($b64) | |
| $certPath = "${{ github.workspace }}\sm_client_cert.p12" | |
| [IO.File]::WriteAllBytes($certPath, $certBytes) | |
| echo "SM_CLIENT_CERT_FILE=$certPath" | Out-File -Append -FilePath $env:GITHUB_ENV -Encoding utf8 | |
| - name: Set up DigiCert SM Tools | |
| if: startsWith(github.ref, 'refs/tags/') | |
| shell: pwsh | |
| env: | |
| SM_API_KEY: ${{ secrets.SM_API_KEY }} | |
| SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }} | |
| SM_HOST: ${{ secrets.SM_HOST }} | |
| run: | | |
| curl -X GET "https://one.digicert.com/signingmanager/api-ui/v1/releases/smtools-windows-x64.msi/download" ` | |
| -H "x-api-key:$env:SM_API_KEY" -o smtools.msi | |
| $msiPath = (Resolve-Path smtools.msi).Path | |
| $proc = Start-Process msiexec -ArgumentList "/i `"$msiPath`" /quiet /qn" -Wait -PassThru | |
| if ($proc.ExitCode -ne 0) { throw "msiexec failed with exit code $($proc.ExitCode)" } | |
| $smctl = Get-ChildItem "C:\Program Files", "C:\Program Files (x86)" -Recurse -Filter "smctl.exe" -ErrorAction SilentlyContinue | Select-Object -First 1 | |
| if (-not $smctl) { throw "smctl.exe not found after install" } | |
| $klPath = $smctl.DirectoryName | |
| Write-Host "smctl found at: $klPath" | |
| echo $klPath | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8 | |
| Set-Content -Path "C:\Windows\System32\pkcs11properties.cfg" -Value "curl_path=$klPath" | |
| [System.Environment]::SetEnvironmentVariable("SM_API_KEY", $env:SM_API_KEY, "Machine") | |
| [System.Environment]::SetEnvironmentVariable("SM_CLIENT_CERT_FILE", $env:SM_CLIENT_CERT_FILE, "Machine") | |
| [System.Environment]::SetEnvironmentVariable("SM_CLIENT_CERT_PASSWORD", $env:SM_CLIENT_CERT_PASSWORD, "Machine") | |
| [System.Environment]::SetEnvironmentVariable("SM_HOST", $env:SM_HOST, "Machine") | |
| & $smctl.FullName healthcheck | |
| & $smctl.FullName creds save $env:SM_API_KEY $env:SM_CLIENT_CERT_PASSWORD | |
| & $smctl.FullName windows certsync --keypair-alias="${{ secrets.SM_KEYPAIR_ALIAS }}" | |
| - name: Add signtool to PATH | |
| if: startsWith(github.ref, 'refs/tags/') | |
| shell: pwsh | |
| run: | | |
| $signtool = Get-ChildItem -Path "${env:ProgramFiles(x86)}\Windows Kits\10\bin" -Recurse -Filter "signtool.exe" | | |
| Where-Object { $_.FullName -match "x64" } | | |
| Sort-Object LastWriteTime -Descending | | |
| Select-Object -First 1 | |
| if (-not $signtool) { throw "signtool.exe not found in Windows SDK" } | |
| $signtool.DirectoryName | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8 | |
| - name: Setup and build | |
| uses: ./.github/actions/setup-build | |
| - name: Build Windows binaries | |
| env: | |
| SM_API_KEY: ${{ startsWith(github.ref, 'refs/tags/') && secrets.SM_API_KEY || '' }} | |
| SM_CLIENT_CERT_PASSWORD: ${{ startsWith(github.ref, 'refs/tags/') && secrets.SM_CLIENT_CERT_PASSWORD || '' }} | |
| SM_HOST: ${{ startsWith(github.ref, 'refs/tags/') && secrets.SM_HOST || '' }} | |
| SM_KEYPAIR_ALIAS: ${{ startsWith(github.ref, 'refs/tags/') && secrets.SM_KEYPAIR_ALIAS || '' }} | |
| run: yarn run build:windows | |
| - name: Prepare release assets | |
| shell: bash | |
| run: | | |
| GIT_COMMIT_LOG=`git log -1 --format='%ci %H %s'` | |
| PACKAGE_NAME=`node -e "console.log(require('./src/package.json').name)"` | |
| PACKAGE_VERSION=`node -e "console.log(require('./src/package.json').version)"` | |
| mkdir -p releases/windows | |
| ls -al output | |
| cp -af "output/${PACKAGE_NAME}-${PACKAGE_VERSION}-x64.exe" "releases/windows/gSender-${PACKAGE_VERSION}-Windows-64Bit.exe" | |
| ls -al output releases/windows | |
| if [[ "$GITHUB_REF_TYPE" == "branch" && "$GITHUB_REF_NAME" == "master" ]]; then | |
| yarn github-release delete \ | |
| --owner=gSender \ | |
| --repo=gsender \ | |
| --tag="${GITHUB_REF_NAME}-latest" \ | |
| --release-name="${GITHUB_REF_NAME}" \ | |
| "*-windows*"; | |
| yarn github-release upload \ | |
| --owner=gSender \ | |
| --repo=gsender \ | |
| --tag="${GITHUB_REF_NAME}-latest" \ | |
| --release-name="${GITHUB_REF_NAME}" \ | |
| --body="${GIT_COMMIT_LOG}" \ | |
| releases/windows/*; | |
| fi | |
| - name: Release | |
| uses: softprops/action-gh-release@v1 | |
| if: startsWith(github.ref, 'refs/tags/') | |
| with: | |
| files: releases/windows/* | |
| prerelease: true | |
| draft: true | |
| - name: Upload Windows Artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: windows_artifact | |
| path: releases/windows/*.exe | |
| compression-level: 0 # no compression | |
| retention-days: 2 | |
| build-pi: | |
| name: Build Raspberry PI packages | |
| runs-on: ubuntu-24.04-arm | |
| environment: CI | |
| env: | |
| GH_TOKEN: ${{ secrets.CI_TOKEN }} | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v3 | |
| - name: Build Pi binaries using docker | |
| shell: bash | |
| run: | | |
| scripts/build-pi.sh | |
| - name: Release | |
| uses: softprops/action-gh-release@v1 | |
| if: startsWith(github.ref, 'refs/tags/') | |
| with: | |
| files: | | |
| releases/pi/* | |
| prerelease: true | |
| draft: true |