v0.6.1: Remote Control #219
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches-ignore: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| release: | |
| types: [created] | |
| permissions: | |
| contents: write # Needed for softprops/action-gh-release | |
| jobs: | |
| test-and-lint: | |
| runs-on: windows-latest | |
| if: github.event_name == 'pull_request' || github.event_name == 'push' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 # Use latest checkout action | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 # Use latest setup-go action | |
| with: | |
| go-version: 'stable' # Or pin to a specific version e.g., '1.22.x' | |
| cache: true | |
| - name: Install GCC (if not cached) | |
| run: choco install mingw -y --no-progress | |
| - name: Install make (if not cached) | |
| run: choco install make -y --no-progress | |
| # Removed redundant 'go get fyne...' step here | |
| - name: golangci-lint | |
| uses: golangci/golangci-lint-action@v6 | |
| with: | |
| version: v1.64.6 # Pinned to a recent stable version | |
| args: --timeout=10m ./... | |
| - name: Run tests | |
| run: go test ./... | |
| shell: pwsh # Explicitly use pwsh for consistency if needed | |
| build: | |
| runs-on: windows-latest | |
| if: github.event_name == 'pull_request' || github.event_name == 'release' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.25.3' # Or pin to a specific version e.g., '1.22.x' | |
| cache: true | |
| - name: Cache Chocolatey packages | |
| uses: actions/cache@v4 | |
| with: | |
| path: C:\ProgramData\chocolatey\lib # Correct default Chocolatey lib path | |
| key: ${{ runner.os }}-chocolatey-${{ hashFiles('**/tools.txt') }} # Assuming you might have a tools.txt | |
| restore-keys: | | |
| ${{ runner.os }}-chocolatey- | |
| - name: Install GCC (if not cached) | |
| run: choco install mingw -y --no-progress | |
| - name: Install make (if not cached) | |
| run: choco install make -y --no-progress | |
| - name: Update version.txt (if release) | |
| if: github.event_name == 'release' | |
| run: | | |
| echo "${{ github.event.release.tag_name }}" | Out-File -Encoding UTF8 version.txt | |
| Get-Content version.txt | |
| shell: pwsh # Use PowerShell for file writing | |
| - name: Build Application | |
| # Assuming Makefile's build-win-amd64 outputs to bin/Spice.exe | |
| # And Makefile doesn't need -v anymore | |
| run: make build-win-amd64 | |
| - name: Verify Build Output File | |
| run: | | |
| echo "--- Verifying Spice.exe exists ---" | |
| dir .\bin\Spice.exe | |
| echo "--- Calculating SHA256 ---" | |
| certutil -hashfile .\bin\Spice.exe SHA256 | |
| shell: cmd # Use cmd for dir and certutil | |
| - name: Build Setup (if release) | |
| if: github.event_name == 'release' | |
| uses: Minionguyjpro/Inno-Setup-Action@v1.2.2 | |
| with: | |
| path: Spice.iss | |
| # Pass defines using native PowerShell variables from previous step | |
| options: /Q /DMyAppPlatform=amd64 | |
| - name: Upload build artifact (contains Spice.exe and maybe Spice-Setup-*.exe) | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: spice-release-build | |
| path: bin/ # Uploads contents of bin directory | |
| release: | |
| runs-on: windows-latest | |
| needs: build | |
| if: github.event_name == 'release' # Only run this job for release events | |
| # Removed invalid 'env:' block that caused the error | |
| steps: | |
| - name: Download build artifact | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: spice-release-build | |
| # This downloads the contents of the 'bin' dir from the artifact | |
| # into the current workspace directory (e.g., Spice.exe, Spice-Setup-*.exe) | |
| - name: Define filenames | |
| id: filenames | |
| run: | | |
| # Extract version number from tag using PowerShell | |
| $tagName = '${{ github.event.release.tag_name }}' | |
| $appVersion = $tagName -replace '^v' # Remove leading 'v' | |
| $appPlatform = "amd64" # Define platform | |
| # Define the expected names based on extracted/defined variables | |
| $exeName = "Spice.exe" | |
| $setupName = "Spice-Setup-${appVersion}-${appPlatform}.exe" | |
| # Set step outputs | |
| echo "EXE_NAME=$exeName" >> $env:GITHUB_OUTPUT | |
| echo "SETUP_NAME=$setupName" >> $env:GITHUB_OUTPUT | |
| # Optional: Log expected names | |
| echo "Expected files:" | |
| echo "* $exeName" | |
| echo "* $setupName" | |
| shell: pwsh | |
| - name: List downloaded files # Diagnostic step | |
| run: dir . | |
| shell: cmd | |
| - name: Calculate checksums and create .sha256 files | |
| # This step assumes both files exist in the current directory after download | |
| run: | | |
| certutil -hashfile "${{ steps.filenames.outputs.EXE_NAME }}" SHA256 | findstr /V /B /C:"CertUtil" /C:"SHA256" > "${{ steps.filenames.outputs.EXE_NAME }}.sha256" | |
| certutil -hashfile "${{ steps.filenames.outputs.SETUP_NAME }}" SHA256 | findstr /V /B /C:"CertUtil" /C:"SHA256" > "${{ steps.filenames.outputs.SETUP_NAME }}.sha256" | |
| shell: cmd # Use cmd for certutil and findstr piping | |
| - name: Sign executables with Azure Trusted Signing | |
| uses: azure/trusted-signing-action@v0 | |
| with: | |
| azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
| azure-client-id: ${{ secrets.AZURE_CLIENT_ID }} | |
| azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }} | |
| endpoint: https://weu.codesigning.azure.net/ | |
| trusted-signing-account-name: SpiceOSS | |
| certificate-profile-name: Spice | |
| files-folder: ${{ github.workspace }} # Sign files in the root workspace | |
| # Sign both the raw exe and the setup exe using the step outputs | |
| files-folder-filter: "${{ steps.filenames.outputs.EXE_NAME }},${{ steps.filenames.outputs.SETUP_NAME }}" | |
| file-digest: SHA256 | |
| timestamp-rfc3161: http://timestamp.acs.microsoft.com | |
| timestamp-digest: SHA256 | |
| - name: Upload binaries to GitHub Release | |
| uses: softprops/action-gh-release@v2 | |
| env: | |
| # Use the default GITHUB_TOKEN unless MY_GITHUB_TOKEN is specifically needed | |
| # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITHUB_TOKEN: ${{ secrets.MY_GITHUB_TOKEN }} # Keep if you need specific permissions | |
| # No need for explicit 'if' here, job level 'if' handles it | |
| with: | |
| # List the files to upload using the dynamic names from step outputs | |
| files: | | |
| ${{ steps.filenames.outputs.EXE_NAME }} | |
| ${{ steps.filenames.outputs.EXE_NAME }}.sha256 | |
| ${{ steps.filenames.outputs.SETUP_NAME }} | |
| ${{ steps.filenames.outputs.SETUP_NAME }}.sha256 | |
| build-and-release-mac: | |
| runs-on: macos-latest | |
| if: github.event_name == 'release' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| # Pinned to your exact local version | |
| go-version: '1.25.3' | |
| - name: Install create-dmg | |
| run: brew install create-dmg | |
| - name: Install Fyne CLI | |
| # Pinned to your exact local version | |
| run: go install fyne.io/tools/cmd/fyne@v1.6.2 | |
| - name: Update version.txt from release tag | |
| run: echo "${{ github.event.release.tag_name }}" > version.txt | |
| - name: Import Apple Certificate | |
| run: | | |
| echo "${{ secrets.MACOS_CERTIFICATE }}" | base64 --decode > certificate.p12 | |
| security create-keychain -p "${{ runner.temp }}" build.keychain | |
| security default-keychain -s build.keychain | |
| security unlock-keychain -p "${{ runner.temp }}" build.keychain | |
| security import certificate.p12 -k build.keychain -P "${{ secrets.MACOS_CERTIFICATE_PASSWORD }}" -T /usr/bin/codesign | |
| security set-key-partition-list -S apple-tool:,apple: -s -k "${{ runner.temp }}" build.keychain | |
| rm certificate.p12 | |
| - name: Set up notarytool credentials | |
| run: | | |
| xcrun notarytool store-credentials "AC_PASSWORD" --apple-id "${{ secrets.APPLE_ID }}" --password "${{ secrets.APPLE_ID_PASSWORD }}" --team-id "${{ secrets.APPLE_TEAM_ID }}" | |
| - name: Build and Sign macOS App | |
| env: | |
| SIGNING_IDENTITY: "Developer ID Application: Karl Kwong (T96W95GY4U)" | |
| run: make build-darwin-arm64 | |
| - name: Notarize macOS App | |
| run: make notarize-mac-arm64 | |
| - name: Define Release Asset Names | |
| id: assets | |
| run: | | |
| VERSION=$(cat version.txt) | |
| echo "DMG_NAME=Spice-${VERSION}-arm64.dmg" >> $GITHUB_OUTPUT | |
| - name: Create Checksum for DMG | |
| run: shasum -a 256 "dist/${{ steps.assets.outputs.DMG_NAME }}" > "dist/${{ steps.assets.outputs.DMG_NAME }}.sha256" | |
| - name: Upload macOS Release Assets | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| files: | | |
| dist/${{ steps.assets.outputs.DMG_NAME }} | |
| dist/${{ steps.assets.outputs.DMG_NAME }}.sha256 |