Tha.Les
b9437115ca
Two halves of the same bug. The upload steps passed no `prerelease` to softprops/action-gh-release, which defaults it to false and writes it back. Attaching assets therefore promoted the release it was attaching them to. v0.13.0 and v0.14.0 were both published as pre-releases and both ended up marked as the latest release within the hour, which also fired `released` and pushed :latest to GHCR. Each workflow now carries the release's own flag. The updater took the newest non-draft release, pre-releases included. That was deliberate when it was written, because /releases/latest hides pre-releases and every release was one, so tracking stable meant nobody would ever be notified. With the flag preserved, a pre-release is now genuinely a pre-release, and offering it would push unverified builds to everyone. It now takes the newest release that is neither draft nor pre-release, so a release reaches users only once it has been promoted. The e2e stub grew an unpromoted pre-release ahead of the stable one, and the spec pins which of the two the card names. Co-authored-by: Thales <>
112 lines
4.5 KiB
YAML
112 lines
4.5 KiB
YAML
name: Windows Release
|
|
|
|
on:
|
|
release:
|
|
types: [published]
|
|
|
|
permissions: {}
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
build-and-upload:
|
|
# Runner must be windows/x64 with PowerShell, Docker, and rustup.
|
|
runs-on: [self-hosted, windows, x64]
|
|
timeout-minutes: 90
|
|
permissions:
|
|
contents: write
|
|
# Source the tag from the github context (evaluated by Actions) rather than
|
|
# $env:GITHUB_REF_NAME, which is only injected by runner >= 2.290. Keeps the
|
|
# build working on older self-hosted runners. (#212 follow-up)
|
|
env:
|
|
REF_NAME: ${{ github.ref_name }}
|
|
defaults:
|
|
run:
|
|
shell: powershell
|
|
steps:
|
|
- name: clean workspace
|
|
run: |
|
|
Remove-Item -Recurse -Force .build, dist -ErrorAction SilentlyContinue
|
|
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: write version files
|
|
run: |
|
|
$tag = $env:REF_NAME
|
|
if (-not $tag) { throw "REF_NAME is not set" }
|
|
$version = $tag -replace '^v', ''
|
|
$json = "{`"version`": `"$version`"}"
|
|
Set-Content -Path "static/version.json" -Value $json -Encoding UTF8
|
|
(Get-Content "desktop/src-tauri/Cargo.toml") -replace '^version = ".*"', "version = `"$version`"" |
|
|
Set-Content "desktop/src-tauri/Cargo.toml"
|
|
(Get-Content "desktop/src-tauri/tauri.conf.json") -replace '"version": "[^"]*"', "`"version`": `"$version`"" |
|
|
Set-Content "desktop/src-tauri/tauri.conf.json"
|
|
(Get-Content "pyproject.toml") -replace '^version = ".*"', "version = `"$version`"" |
|
|
Set-Content "pyproject.toml"
|
|
(Get-Content "desktop/package.json") -replace '"version": "[^"]*"', "`"version`": `"$version`"" |
|
|
Set-Content "desktop/package.json"
|
|
Write-Host "Wrote version $version to all version files"
|
|
|
|
- name: build Windows NVIDIA
|
|
run: |
|
|
powershell -NoProfile -ExecutionPolicy Bypass -File scripts/windows/make-portable.ps1 `
|
|
-PackageName StemDeck-Windows-x64.NVIDIA `
|
|
-PackageVersion "$env:REF_NAME"
|
|
|
|
- name: build Windows CPU
|
|
run: |
|
|
powershell -NoProfile -ExecutionPolicy Bypass -File scripts/windows/make-portable.ps1 `
|
|
-PackageName StemDeck-Windows-x64 `
|
|
-PackageVersion "$env:REF_NAME" `
|
|
-CpuOnly `
|
|
-PublishUpdaterAssets
|
|
|
|
- name: scan artifacts
|
|
run: |
|
|
Write-Host "Preparing ClamAV scan for Windows release artifacts..."
|
|
Write-Host "Artifacts staged in: $PWD\dist"
|
|
Get-ChildItem -Path "dist" -File |
|
|
Sort-Object Name |
|
|
Select-Object Name,
|
|
@{Name="SizeMB"; Expression={ [math]::Round($_.Length / 1MB, 2) }} |
|
|
Format-Table -AutoSize
|
|
|
|
Write-Host "SHA256 checksums:"
|
|
Get-ChildItem -Path "dist" -Filter "*.zip" -File |
|
|
Sort-Object Name |
|
|
ForEach-Object {
|
|
$hash = Get-FileHash -Algorithm SHA256 $_.FullName
|
|
Write-Host " $($hash.Hash) $($_.Name)"
|
|
}
|
|
|
|
Write-Host "Pulling latest ClamAV scanner image..."
|
|
docker pull clamav/clamav:latest
|
|
|
|
Write-Host "Running ClamAV scan over dist/..."
|
|
docker run --rm -v "${PWD}/dist:/scan:ro" clamav/clamav:latest `
|
|
clamscan --recursive --infected --bell /scan
|
|
if ($LASTEXITCODE -ne 0) {
|
|
throw "ClamAV scan failed or reported infected files. Exit code: $LASTEXITCODE"
|
|
}
|
|
Write-Host "ClamAV scan completed successfully. No infected files reported."
|
|
|
|
- name: upload artifacts
|
|
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
|
|
with:
|
|
# Carry the release's own flag. The action defaults `prerelease` to
|
|
# false and writes it back, so attaching assets silently promoted a
|
|
# pre-release to the latest release -- which also fires `released`,
|
|
# pushing :latest to GHCR, and makes the in-app updater offer a build
|
|
# that was never verified.
|
|
prerelease: ${{ github.event.release.prerelease }}
|
|
files: |
|
|
dist/StemDeck-Windows-x64.NVIDIA.zip
|
|
dist/StemDeck-Windows-x64.NVIDIA.zip.sha256
|
|
dist/StemDeck-Windows-x64.zip
|
|
dist/StemDeck-Windows-x64.zip.sha256
|
|
dist/StemDeck-Windows-x64-app.zip
|
|
dist/StemDeck-Windows-x64-app.zip.sha256
|
|
dist/StemDeck-Windows-x64-runtime-version.json
|