templates/ci/desktop-release-github-actions.yml · aaronrene/overseer-kit

& signtool sign /f $env:WINDOWS_PFX_PATH /p $env:WINDOWS_CERTIFICATE_PASSWORD /tr http://timestamp.digicert.com /td sha256 /fd sha256 $env:ARTIFACT_PATH

318

if ($LASTEXITCODE -ne 0) { throw "signtool failed" }

319

320

- name: Sign Linux AppImage (minisign detached)

321

if: matrix.platform == 'linux' && needs.version-check.outputs.publish == 'true'

322

shell: bash

323

env:

324

LINUX_SIGNING_KEY: ${{ secrets.LINUX_SIGNING_KEY }}

325

LINUX_SIGNING_KEY_PASSWORD: ${{ secrets.LINUX_SIGNING_KEY_PASSWORD }}

326

ARTIFACT_PATH: ${{ steps.locate.outputs.path }}

327

run: |

328

set -euo pipefail

329

curl -fsSL -o "$RUNNER_TEMP/minisign.tar.gz" \

330

https://github.com/jedisct1/minisign/releases/download/0.11/minisign-0.11-linux.tar.gz

331

tar -xzf "$RUNNER_TEMP/minisign.tar.gz" -C "$RUNNER_TEMP"

332

MINISIGN="$(find "$RUNNER_TEMP" -type f -name minisign | head -n 1)"

333

test -x "$MINISIGN"

334

KEY_PATH="$RUNNER_TEMP/linux-signing.key"

335

printf '%s' "$LINUX_SIGNING_KEY" > "$KEY_PATH"

336

if [ -n "${LINUX_SIGNING_KEY_PASSWORD:-}" ]; then

337

"$MINISIGN" -S -s "$KEY_PATH" -m "$ARTIFACT_PATH" -x "${ARTIFACT_PATH}.minisig" <<< "$LINUX_SIGNING_KEY_PASSWORD"

338

else

339

"$MINISIGN" -S -s "$KEY_PATH" -m "$ARTIFACT_PATH" -x "${ARTIFACT_PATH}.minisig"

340

fi

341

SIG="${ARTIFACT_PATH}.minisig"

342

test -f "$SIG"

343

cp "$SIG" "release-artifacts/$(basename "$SIG")"

344

rm -f "$KEY_PATH"

345

346

- name: Hash artifact after signing

id: hash

shell: bash

env:

ARTIFACT_PATH: ${{ steps.locate.outputs.path }}

run: |

set -euo pipefail

python - <<'PY'

import os

from pathlib import Path

356

from tools.desktop_release.checksums import sha256_file

357

358

path = Path(os.environ["ARTIFACT_PATH"])

359

digest = sha256_file(path)

360

with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as fh:

361

fh.write(f"sha256={digest}\n")

362

print(f"sha256={digest}")

363

PY

364

365

- name: Write platform manifest fragment

366

shell: bash

367

env:

368

PLATFORM: ${{ matrix.platform }}

369

VERSION: ${{ needs.version-check.outputs.version }}

370

FILENAME: ${{ steps.locate.outputs.filename }}

371

SHA256: ${{ steps.hash.outputs.sha256 }}

372

PUBLISH: ${{ needs.version-check.outputs.publish }}

run: |

set -euo pipefail

python - <<'PY'

import json

import os

from pathlib import Path

379

380

platform = os.environ["PLATFORM"]

381

method = {

382

"macos": "developer_id_notarized",

383

"windows": "authenticode",

384

"linux": "minisign_detached",

385

}[platform]

386

status = "signed" if os.environ.get("PUBLISH", "true").lower() == "true" else "unsigned"

387

arch = {"macos": "aarch64", "windows": "x86_64", "linux": "x86_64"}[platform]

388

frag = {

389

"platform": platform,

390

"filename": os.environ["FILENAME"],

391

"sha256": os.environ["SHA256"],

392

"arch": arch,

393

"signing": {"status": status, "method": method if status == "signed" else "none"},

394

}

395

out = Path("release-artifacts") / f"fragment-{platform}.json"

396

out.write_text(json.dumps(frag, indent=2) + "\n", encoding="utf-8")

397

PY

398

399

- name: Upload platform workflow artifacts

400

uses: actions/upload-artifact@v4

401

with:

402

403

path: release-artifacts/

404

if-no-files-found: error

retention-days: 14

finalize:

needs: [version-check, build]

409

runs-on: ubuntu-22.04

410

if: always() && needs.version-check.result == 'success'

411

steps:

412

- uses: actions/checkout@v4

413

414

- uses: actions/setup-python@v5

415

with:

416

python-version: "3.11"

417

418

- name: Download platform artifacts

419

uses: actions/download-artifact@v4

420

with:

421

path: gathered

422

pattern: desktop-*-${{ needs.version-check.outputs.version }}

423

merge-multiple: false

424

425

- name: Assemble manifest + SHA256SUMS + allowlist gate

id: assemble

shell: bash

env:

VERSION: ${{ needs.version-check.outputs.version }}

430

PUBLISH: ${{ needs.version-check.outputs.publish }}

431

ALLOW_PARTIAL: ${{ needs.version-check.outputs.allow_partial }}

432

GIT_SHA: ${{ github.sha }}

run: |

set -euo pipefail

python - <<'PY'

import json

import os

import sys

from pathlib import Path

440

from tools.desktop_release.allowlist import AllowlistError, refuse_disallowed_asset

441

from tools.desktop_release.checksums import write_sha256sums

442

from tools.desktop_release.constants import MANIFEST_FILENAME_TEMPLATE, SHA256SUMS_FILENAME

443

from tools.desktop_release.manifest import ManifestError, build_manifest, canonical_manifest_bytes

444

445

version = os.environ["VERSION"]

446

publish = os.environ.get("PUBLISH", "true").lower() == "true"

447

allow_partial = os.environ.get("ALLOW_PARTIAL", "false").lower() == "true"

448

git_sha = os.environ["GIT_SHA"]

449

root = Path("gathered")

450

fragments = sorted(root.rglob("fragment-*.json"))

451

if not fragments and publish and not allow_partial:

452

print("no platform fragments found", file=sys.stderr)

sys.exit(1)

artifacts = []

for frag_path in fragments:

457

data = json.loads(frag_path.read_text(encoding="utf-8"))

458

artifacts.append(data)

459

460

platforms_present = {a["platform"] for a in artifacts}

461

required = {"macos", "windows", "linux"}

462

missing = sorted(required - platforms_present)

463

if missing and publish and not allow_partial:

464

print(f"missing platforms: {missing}", file=sys.stderr)

sys.exit(1)

for plat in missing:

artifacts.append(

{

"platform": plat,

"filename": f"UNAVAILABLE-{plat}",

471

"sha256": "0" * 64,

472

"signing": {"status": "unavailable", "method": "none"},

}

)

out = Path("release-dist")

477

out.mkdir(parents=True, exist_ok=True)

478

479

# Copy allowlisted installer + sidecar files into release-dist

480

for path in root.rglob("*"):

481

if not path.is_file():

482

continue

483

if path.name.startswith("fragment-"):

484

continue

485

try:

486

refuse_disallowed_asset(path.name, version=version)

487

except AllowlistError:

488

print(f"skipping non-allowlisted file: {path.name}", file=sys.stderr)

489

continue

490

dest = out / path.name

491

dest.write_bytes(path.read_bytes())

492

493

# Drop unavailable placeholder rows that are not real files

494

real_artifacts = [a for a in artifacts if a["signing"]["status"] != "unavailable"]

495

unavailable = [a for a in artifacts if a["signing"]["status"] == "unavailable"]

496

497

if publish and not allow_partial:

498

for a in real_artifacts:

499

if a["signing"]["status"] != "signed":

500

print(f"unsigned artifact on publish: {a['filename']}", file=sys.stderr)

sys.exit(1)

try:

manifest = build_manifest(

505

version=version,

506

git_sha=git_sha,

507

artifacts=real_artifacts + unavailable,

508

)

509

except ManifestError as exc:

510

print(exc, file=sys.stderr)

511

sys.exit(1)

512

513

# Manifest must not claim signed for unavailable placeholders with fake hashes

514

# when allow_partial — already status unavailable.

515

516

manifest_name = MANIFEST_FILENAME_TEMPLATE.format(version=version)

517

(out / manifest_name).write_bytes(canonical_manifest_bytes(manifest))

518

sums = [(a["sha256"], a["filename"]) for a in real_artifacts]

519

write_sha256sums(out / SHA256SUMS_FILENAME, sums)

520

521

notes = [

522

f"Overseer Kit desktop {version}",

523

f"Commit: {git_sha}",

524

"",

525

"Verify checksums with SHA256SUMS.txt and the release manifest.",

526

"Operator runbook: docs/TRACK-Q-DESKTOP-OPERATOR-RUNBOOK.md",

527

"Installers still require Python 3.11+ on the host.",

]

if unavailable:

notes.append("")

notes.append("Unavailable platforms (not signed): " + ", ".join(a["platform"] for a in unavailable))

532

notes.append("Do not call this a complete signed release.")

533

Path("release-notes.md").write_text("\n".join(notes) + "\n", encoding="utf-8")

534

print(f"assembled {len(real_artifacts)} artifacts")

535

PY

536

537

- name: Publish GitHub Release assets

538

if: needs.version-check.outputs.publish == 'true'

539

uses: softprops/action-gh-release@v2

540

with:

541

tag_name: v${{ needs.version-check.outputs.version }}

542

543

body_path: release-notes.md

544

files: release-dist/*

545

fail_on_unmatched_files: true

546

env:

547

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}