Build & EV Sign Windows builds (#517

* Add way to provide apple ID and app password to notarise script * Add utility to generate electron-builder.json for release & nightly builds * Run Build & Test on staging too * First attempt at build & deploy for macOS with signing and notarisation * Fix quote mismatch * use correct quotes * add runs-on * Fix inputs.mode usage * remove quotes * chmod +x * Fix artifact paths * Fix deploy condition * Fix deploy condition * Fix artifact path * Iterate * Fix workflow * Fix env * Iterate * Fix missing env * Fix version calculation * Iterate * Fix config not taking effect * Update build_and_deploy.yaml * Fix alignments * delint * Fix alignment * Update build_macos.yaml * Add ability to EV sign using eSigner CKA * Initial work to build & sign Windows nightlies in CI * Format * Format * Fix gha * fix winSign * Fix install command * Add signtool to path * Update build_and_deploy.yaml * Fix quotes * Test * Fix comments * Fix cmd * Try again * arg slashes * Fix exe path * Fix matrix strategy * Use ampersand-call * fwd slash ftw? * ls * * 🌲 * tree dist * prepend path * Specify /fd and /td to modern signtool * /tr not /t for CKA * Test signing * missing comma * 🤦‍♂️ * Fix wrong mv * Lets sign * Fix config gen * Debug * Fix typo * Multiple drives why * Try NVL sandbox creds * Update * Attempt to disable logger * Try again * Iterate * Update build_macos.yaml * Update build_and_deploy.yaml * Update build_macos.yaml * Update build_and_deploy.yaml * Update build_and_deploy.yaml * Try custom build of eSigner CKA * Fix typos * Update build_windows.yaml * Update build_and_deploy.yaml * Update build_windows.yaml * Update build_and_deploy.yaml * Fix symlinking * Fix working-directory incantation * exe * remove debug * Prettier * Vendor check in SSL.com executable * Download CKA from packages.element.io instead * Use demo creds * StrictMode * Switch back to 0207 (unsigned) * Fix call syntax * Revert env inc * Partial rollback * Trace * Trace less * Fix CN being passed wrong * DEBUG * Debug 2 * Fix ConvertFrom-StringData * 0214 * Test * Test * Untested * Revert to 0207 * stash * Try with 20230221 * Restore scripts/electron_winSign.js * Prepare for merge * Update build_windows.yaml * Update build_and_deploy.yaml * Restore .github/workflows/build_and_deploy.yaml * Restore .github/workflows/build_and_deploy.yaml * Fix bad restore
2023-02-22 13:51:19 +00:00
parent c9d7e37e09
commit a0a9ec830c
9 changed files with 379 additions and 219 deletions
@@ -69,14 +69,14 @@ jobs:
              if: steps.cache.outputs.cache-hit != 'true'
              run: "yarn build:native:universal"

-            - name: '[Nightly] Resolve version'
+            - name: "[Nightly] Resolve version"
              id: nightly
              if: inputs.version != ''
              run: |
                  echo "config-args=--nightly '${{ inputs.version }}'" >> $GITHUB_OUTPUT

            # We split these because electron-builder gets upset if we set CSC_LINK even to an empty string
-            - name: '[Signed] Build App'
+            - name: "[Signed] Build App"
              if: inputs.sign != ''
              run: |
                  scripts/generate-builder-config.ts ${{ steps.nightly.outputs.config-args }}
@@ -88,7 +88,7 @@ jobs:
                  CSC_KEY_PASSWORD: ${{ secrets.APPLE_CSC_KEY_PASSWORD }}
                  CSC_LINK: ${{ secrets.APPLE_CSC_LINK }}

-            - name: '[Unsigned] Build App'
+            - name: "[Unsigned] Build App"
              if: inputs.sign == ''
              run: |
                  scripts/generate-builder-config.ts ${{ steps.nightly.outputs.config-args }}
@@ -103,11 +103,11 @@ jobs:
                  mkdir -p dist/install/macos dist/update/macos
                  mv _dist/*-mac.zip dist/update/macos/
                  mv _dist/*.dmg dist/install/macos/
-        
+
                  PKG_JSON_VERSION=$(cat package.json | jq -r .version)
                  LATEST=$(find dist -type f -iname "*-mac.zip" | xargs -0 -n1 -- basename)
                  URL="${{ inputs.base-url }}/update/macos/$LATEST"
-        
+
                  jq -n --arg version "${VERSION:-$PKG_JSON_VERSION}" --arg url "$URL" '
                    {
                      currentRelease: $version,
@@ -127,12 +127,12 @@ jobs:
                  VERSION: ${{ inputs.version }}

            # We don't wish to store the installer for every nightly ever, so we only keep the latest
-            - name: '[Nightly] Strip version from installer file'
+            - name: "[Nightly] Strip version from installer file"
              if: inputs.deploy-mode && inputs.version != ''
              run: |
                  mv dist/install/macos/*.dmg "dist/install/macos/Element Nightly.dmg"

-            - name: '[Release] Prepare release latest symlink'
+            - name: "[Release] Prepare release latest symlink"
              if: inputs.deploy-mode && inputs.version == ''
              run: |
                  ln -s "$(find . -type f -iname "*.dmg" | xargs -0 -n1 -- basename)" "Element.dmg"