Skip to content

Commit 3cbcef2

Browse files
DigHuangDigHuang
committed
chore(ci): update release workflow, add Windows sign
1 parent fcba8b8 commit 3cbcef2

3 files changed

Lines changed: 134 additions & 34 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 47 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ on:
1515

1616
permissions:
1717
contents: write
18+
actions: read
1819

1920
jobs:
2021
release:
@@ -32,31 +33,19 @@ jobs:
3233

3334
steps:
3435
- name: Checkout code
35-
uses: actions/checkout@v4
36+
uses: actions/checkout@v6
3637
with:
3738
fetch-depth: 0
3839

39-
- name: Setup Node.js
40-
uses: actions/setup-node@v4
41-
with:
42-
node-version: '20'
43-
4440
- name: Setup pnpm
4541
uses: pnpm/action-setup@v4
46-
47-
- name: Get pnpm store directory
48-
shell: bash
49-
run: |
50-
echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
51-
52-
- name: Setup pnpm cache
53-
uses: actions/cache@v4
42+
43+
- name: Setup Node.js
44+
uses: actions/setup-node@v6
5445
with:
55-
path: ${{ env.STORE_PATH }}
56-
key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
57-
restore-keys: |
58-
${{ runner.os }}-pnpm-store-
59-
46+
node-version: '24'
47+
cache: 'pnpm'
48+
6049
- name: Install dependencies
6150
run: pnpm install
6251

@@ -76,7 +65,6 @@ jobs:
7665
- name: Build macOS
7766
if: matrix.platform == 'mac'
7867
env:
79-
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
8068
# Code signing
8169
CSC_LINK: ${{ secrets.MAC_CERTS }}
8270
CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTS_PASSWORD }}
@@ -94,18 +82,46 @@ jobs:
9482
# Windows specific steps
9583
- name: Build Windows
9684
if: matrix.platform == 'win'
97-
env:
98-
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
99-
# For code signing (optional)
100-
# CSC_LINK: ${{ secrets.WIN_CERTS }}
101-
# CSC_KEY_PASSWORD: ${{ secrets.WIN_CERTS_PASSWORD }}
10285
run: pnpm run package:win
10386

87+
- name: Upload unsigned Windows artifacts for SignPath
88+
if: matrix.platform == 'win'
89+
id: upload-unsigned-windows-artifact
90+
uses: actions/upload-artifact@v4
91+
with:
92+
name: unsigned-win-exe-${{ github.run_id }}-${{ github.run_attempt }}
93+
path: release/*.exe
94+
retention-days: 1
95+
96+
- name: Sign Windows artifacts via SignPath
97+
if: matrix.platform == 'win'
98+
id: signpath-sign-windows
99+
uses: signpath/github-action-submit-signing-request@v2
100+
with:
101+
api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
102+
organization-id: "c120e8c0-b9a7-4615-abd7-b131436e366f"
103+
project-slug: "valuecell"
104+
signing-policy-slug: "test-signing"
105+
github-artifact-id: ${{ steps.upload-unsigned-windows-artifact.outputs.artifact-id }}
106+
wait-for-completion: true
107+
output-artifact-directory: release/signed
108+
109+
- name: Replace unsigned executables with signed ones
110+
if: matrix.platform == 'win'
111+
shell: pwsh
112+
run: |
113+
$signedExeFiles = Get-ChildItem -Path "release/signed" -Filter *.exe -File -Recurse
114+
if (-not $signedExeFiles) {
115+
throw "No signed .exe files found in release/signed"
116+
}
117+
foreach ($file in $signedExeFiles) {
118+
Copy-Item -Path $file.FullName -Destination "release/$($file.Name)" -Force
119+
}
120+
Write-Host "Signed executables copied to release/"
121+
104122
# Linux specific steps
105123
- name: Build Linux
106124
if: matrix.platform == 'linux'
107-
env:
108-
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
109125
run: pnpm run package:linux
110126

111127
- name: Upload artifacts
@@ -133,10 +149,11 @@ jobs:
133149
- name: Checkout code
134150
uses: actions/checkout@v4
135151

136-
- name: Download all artifacts
152+
- name: Download release artifacts only
137153
uses: actions/download-artifact@v4
138154
with:
139155
path: release-artifacts
156+
pattern: release-*
140157

141158
- name: List all downloaded artifacts
142159
run: |
@@ -222,10 +239,11 @@ jobs:
222239
- name: Checkout code
223240
uses: actions/checkout@v4
224241

225-
- name: Download all artifacts
242+
- name: Download release artifacts only
226243
uses: actions/download-artifact@v4
227244
with:
228245
path: release-artifacts
246+
pattern: release-*
229247

230248
- name: Extract version and channel
231249
id: version

‎.github/workflows/win-build-test.yml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
name: Windows Build Test
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
version:
7+
description: "Version for SignPath parameter (e.g., 1.0.0-test.1)"
8+
required: false
9+
default: "dev"
10+
11+
permissions:
12+
contents: read
13+
actions: read
14+
15+
jobs:
16+
windows-build-sign:
17+
runs-on: windows-latest
18+
19+
steps:
20+
- name: Checkout code
21+
uses: actions/checkout@v6
22+
with:
23+
fetch-depth: 0
24+
25+
- name: Setup pnpm
26+
uses: pnpm/action-setup@v4
27+
28+
- name: Setup Node.js
29+
uses: actions/setup-node@v6
30+
with:
31+
node-version: "24"
32+
cache: "pnpm"
33+
34+
- name: Install dependencies
35+
run: pnpm install
36+
37+
- name: Download uv binaries for Windows
38+
run: pnpm run uv:download:win
39+
40+
- name: Build Windows
41+
run: pnpm run package:win
42+
43+
# Required by SignPath Trusted Build: artifact must exist on GitHub first.
44+
- name: Upload unsigned Windows artifacts for SignPath
45+
id: upload-unsigned-windows-artifact
46+
uses: actions/upload-artifact@v4
47+
with:
48+
name: unsigned-win-exe-${{ github.run_id }}-${{ github.run_attempt }}
49+
path: release/*.exe
50+
retention-days: 1
51+
52+
- name: Sign Windows artifacts via SignPath
53+
id: signpath-sign-windows
54+
uses: signpath/github-action-submit-signing-request@v2
55+
with:
56+
api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
57+
organization-id: "c120e8c0-b9a7-4615-abd7-b131436e366f"
58+
project-slug: "valuecell"
59+
signing-policy-slug: "test-signing"
60+
github-artifact-id: ${{ steps.upload-unsigned-windows-artifact.outputs.artifact-id }}
61+
wait-for-completion: true
62+
output-artifact-directory: release/signed
63+
64+
- name: Replace unsigned executables with signed ones
65+
shell: pwsh
66+
run: |
67+
$signedExeFiles = Get-ChildItem -Path "release/signed" -Filter *.exe -File -Recurse
68+
if (-not $signedExeFiles) {
69+
throw "No signed .exe files found in release/signed"
70+
}
71+
foreach ($file in $signedExeFiles) {
72+
Copy-Item -Path $file.FullName -Destination "release/$($file.Name)" -Force
73+
}
74+
Write-Host "Signed executables copied to release/"
75+
76+
- name: Upload signed Windows artifacts
77+
uses: actions/upload-artifact@v4
78+
with:
79+
name: signed-win-exe-${{ github.run_id }}-${{ github.run_attempt }}
80+
path: |
81+
release/*.exe
82+
release/latest*.yml
83+
retention-days: 7

‎package.json‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,10 +32,9 @@
3232
"uv:download:all": "zx scripts/download-bundled-uv.mjs --all",
3333
"icons": "zx scripts/generate-icons.mjs",
3434
"package": "electron-builder",
35-
"package:mac": "vite build && zx scripts/bundle-openclaw.mjs && electron-builder --mac",
36-
"package:win": "vite build && zx scripts/bundle-openclaw.mjs && electron-builder --win",
37-
"package:linux": "vite build && zx scripts/bundle-openclaw.mjs && electron-builder --linux",
38-
"release": "pnpm run uv:download && vite build && electron-builder --publish always",
35+
"package:mac": "vite build && zx scripts/bundle-openclaw.mjs && electron-builder --mac --publish never",
36+
"package:win": "vite build && zx scripts/bundle-openclaw.mjs && electron-builder --win --publish never",
37+
"package:linux": "vite build && zx scripts/bundle-openclaw.mjs && electron-builder --linux --publish never",
3938
"version:patch": "pnpm version patch",
4039
"version:minor": "pnpm version minor",
4140
"version:major": "pnpm version major",
@@ -107,4 +106,4 @@
107106
"zx": "^8.8.5"
108107
},
109108
"packageManager": "pnpm@10.29.2+sha512.bef43fa759d91fd2da4b319a5a0d13ef7a45bb985a3d7342058470f9d2051a3ba8674e629672654686ef9443ad13a82da2beb9eeb3e0221c87b8154fff9d74b8"
110-
}
109+
}

0 commit comments

Comments
 (0)