templates/ci/desktop-release-github-actions.yml · aaronrene/overseer-kit

& signtool sign /f $env:WINDOWS_PFX_PATH /p $env:WINDOWS_CERTIFICATE_PASSWORD /tr http://timestamp.digicert.com /td sha256 /fd sha256 $env:ARTIFACT_PATH

323

if ($LASTEXITCODE -ne 0) { throw "signtool failed" }

324

325

- name: Sign Linux AppImage (minisign detached)

326

if: matrix.platform == 'linux' && needs.version-check.outputs.publish == 'true'

327

shell: bash

328

env:

329

LINUX_SIGNING_KEY: ${{ secrets.LINUX_SIGNING_KEY }}

330

LINUX_SIGNING_KEY_PASSWORD: ${{ secrets.LINUX_SIGNING_KEY_PASSWORD }}

331

ARTIFACT_PATH: ${{ steps.locate.outputs.path }}

332

run: |

333

set -euo pipefail

334

curl -fsSL -o "$RUNNER_TEMP/minisign.tar.gz" \

335

https://github.com/jedisct1/minisign/releases/download/0.11/minisign-0.11-linux.tar.gz

336

tar -xzf "$RUNNER_TEMP/minisign.tar.gz" -C "$RUNNER_TEMP"

337

MINISIGN="$(find "$RUNNER_TEMP" -type f -name minisign | head -n 1)"

338

test -x "$MINISIGN"

339

KEY_PATH="$RUNNER_TEMP/linux-signing.key"

340

printf '%s' "$LINUX_SIGNING_KEY" > "$KEY_PATH"

341

if [ -n "${LINUX_SIGNING_KEY_PASSWORD:-}" ]; then

342

"$MINISIGN" -S -s "$KEY_PATH" -m "$ARTIFACT_PATH" -x "${ARTIFACT_PATH}.minisig" <<< "$LINUX_SIGNING_KEY_PASSWORD"

343

else

344

"$MINISIGN" -S -s "$KEY_PATH" -m "$ARTIFACT_PATH" -x "${ARTIFACT_PATH}.minisig"

345

fi

346

SIG="${ARTIFACT_PATH}.minisig"

347

test -f "$SIG"

348

cp "$SIG" "release-artifacts/$(basename "$SIG")"

349

rm -f "$KEY_PATH"

350

351

- name: Hash artifact after signing

id: hash

shell: bash

env:

ARTIFACT_PATH: ${{ steps.locate.outputs.path }}

run: |

set -euo pipefail

python - <<'PY'

import os

from pathlib import Path

361

from tools.desktop_release.checksums import sha256_file

362

363

path = Path(os.environ["ARTIFACT_PATH"])

364

digest = sha256_file(path)

365

with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as fh:

366

fh.write(f"sha256={digest}\n")

367

print(f"sha256={digest}")

368

PY

369

370

- name: Write platform manifest fragment

371

shell: bash

372

env:

373

PLATFORM: ${{ matrix.platform }}

374

VERSION: ${{ needs.version-check.outputs.version }}

375

FILENAME: ${{ steps.locate.outputs.filename }}

376

SHA256: ${{ steps.hash.outputs.sha256 }}

377

PUBLISH: ${{ needs.version-check.outputs.publish }}

run: |

set -euo pipefail

python - <<'PY'

import json

import os

from pathlib import Path

384

385

platform = os.environ["PLATFORM"]

386

method = {

387

"macos": "developer_id_notarized",

388

"windows": "authenticode",

389

"linux": "minisign_detached",

390

}[platform]

391

status = "signed" if os.environ.get("PUBLISH", "true").lower() == "true" else "unsigned"

392

arch = {"macos": "aarch64", "windows": "x86_64", "linux": "x86_64"}[platform]

393

frag = {

394

"platform": platform,

395

"filename": os.environ["FILENAME"],

396

"sha256": os.environ["SHA256"],

397

"arch": arch,

398

"signing": {"status": status, "method": method if status == "signed" else "none"},

399

}

400

out = Path("release-artifacts") / f"fragment-{platform}.json"

401

out.write_text(json.dumps(frag, indent=2) + "\n", encoding="utf-8")

402

PY

403

404

- name: Upload platform workflow artifacts

405

uses: actions/upload-artifact@v4

406

with:

407

408

path: release-artifacts/

409

if-no-files-found: error

retention-days: 14

finalize:

needs: [version-check, build]

414

runs-on: ubuntu-22.04

415

if: always() && needs.version-check.result == 'success'

416

steps:

417

- uses: actions/checkout@v4

418

419

- uses: actions/setup-python@v5

420

with:

421

python-version: "3.11"

422

423

- name: Download platform artifacts

424

uses: actions/download-artifact@v4

425

with:

426

path: gathered

427

pattern: desktop-*-${{ needs.version-check.outputs.version }}

428

merge-multiple: false

429

430

- name: Assemble manifest + SHA256SUMS + allowlist gate

id: assemble

shell: bash

env:

VERSION: ${{ needs.version-check.outputs.version }}

435

PUBLISH: ${{ needs.version-check.outputs.publish }}

436

ALLOW_PARTIAL: ${{ needs.version-check.outputs.allow_partial }}

437

GIT_SHA: ${{ github.sha }}

run: |

set -euo pipefail

python - <<'PY'

import json

import os

import sys

from pathlib import Path

445

from tools.desktop_release.allowlist import AllowlistError, refuse_disallowed_asset

446

from tools.desktop_release.checksums import write_sha256sums

447

from tools.desktop_release.constants import MANIFEST_FILENAME_TEMPLATE, SHA256SUMS_FILENAME

448

from tools.desktop_release.manifest import ManifestError, build_manifest, canonical_manifest_bytes

449

450

version = os.environ["VERSION"]

451

publish = os.environ.get("PUBLISH", "true").lower() == "true"

452

allow_partial = os.environ.get("ALLOW_PARTIAL", "false").lower() == "true"

453

git_sha = os.environ["GIT_SHA"]

454

root = Path("gathered")

455

fragments = sorted(root.rglob("fragment-*.json"))

456

if not fragments and publish and not allow_partial:

457

print("no platform fragments found", file=sys.stderr)

sys.exit(1)

artifacts = []

for frag_path in fragments:

462

data = json.loads(frag_path.read_text(encoding="utf-8"))

463

artifacts.append(data)

464

465

platforms_present = {a["platform"] for a in artifacts}

466

required = {"macos", "windows", "linux"}

467

missing = sorted(required - platforms_present)

468

if missing and publish and not allow_partial:

469

print(f"missing platforms: {missing}", file=sys.stderr)

sys.exit(1)

for plat in missing:

artifacts.append(

{

"platform": plat,

"filename": f"UNAVAILABLE-{plat}",

476

"sha256": "0" * 64,

477

"signing": {"status": "unavailable", "method": "none"},

}

)

out = Path("release-dist")

482

out.mkdir(parents=True, exist_ok=True)

483

484

# Copy allowlisted installer + sidecar files into release-dist

485

for path in root.rglob("*"):

486

if not path.is_file():

487

continue

488

if path.name.startswith("fragment-"):

489

continue

490

try:

491

refuse_disallowed_asset(path.name, version=version)

492

except AllowlistError:

493

print(f"skipping non-allowlisted file: {path.name}", file=sys.stderr)

494

continue

495

dest = out / path.name

496

dest.write_bytes(path.read_bytes())

497

498

# Drop unavailable placeholder rows that are not real files

499

real_artifacts = [a for a in artifacts if a["signing"]["status"] != "unavailable"]

500

unavailable = [a for a in artifacts if a["signing"]["status"] == "unavailable"]

501

502

if publish and not allow_partial:

503

for a in real_artifacts:

504

if a["signing"]["status"] != "signed":

505

print(f"unsigned artifact on publish: {a['filename']}", file=sys.stderr)

sys.exit(1)

try:

manifest = build_manifest(

510

version=version,

511

git_sha=git_sha,

512

artifacts=real_artifacts + unavailable,

513

)

514

except ManifestError as exc:

515

print(exc, file=sys.stderr)

516

sys.exit(1)

517

518

# Manifest must not claim signed for unavailable placeholders with fake hashes

519

# when allow_partial — already status unavailable.

520

521

manifest_name = MANIFEST_FILENAME_TEMPLATE.format(version=version)

522

(out / manifest_name).write_bytes(canonical_manifest_bytes(manifest))

523

sums = [(a["sha256"], a["filename"]) for a in real_artifacts]

524

write_sha256sums(out / SHA256SUMS_FILENAME, sums)

525

526

notes = [

527

f"Overseer Kit desktop {version}",

528

f"Commit: {git_sha}",

529

"",

530

"Verify checksums with SHA256SUMS.txt and the release manifest.",

531

"Operator runbook: docs/TRACK-Q-DESKTOP-OPERATOR-RUNBOOK.md",

532

"Installers still require Python 3.11+ on the host.",

]

if unavailable:

notes.append("")

notes.append("Unavailable platforms (not signed): " + ", ".join(a["platform"] for a in unavailable))

537

notes.append("Do not call this a complete signed release.")

538

Path("release-notes.md").write_text("\n".join(notes) + "\n", encoding="utf-8")

539

print(f"assembled {len(real_artifacts)} artifacts")

540

PY

541

542

- name: Publish GitHub Release assets

543

if: needs.version-check.outputs.publish == 'true'

544

uses: softprops/action-gh-release@v2

545

with:

546

tag_name: v${{ needs.version-check.outputs.version }}

547

548

body_path: release-notes.md

549

files: release-dist/*

550

fail_on_unmatched_files: true

551

env:

552

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}