Release #66
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: [ 'v*' ] | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: 'Wersja bez literki v (np. 1.0.1)' | |
| required: true | |
| default: '1.0.0' | |
| dry-run: | |
| description: 'Tylko build + podpis (bez publikacji release)' | |
| type: boolean | |
| default: false | |
| permissions: | |
| contents: write | |
| id-token: write | |
| jobs: | |
| build: | |
| runs-on: windows-latest | |
| environment: release | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: actions/setup-dotnet@v5 | |
| with: | |
| # Pinned so the same commit always builds with the same SDK. Raise deliberately when | |
| # Microsoft ships a new .NET 8 servicing release. | |
| dotnet-version: '8.0.424' | |
| - name: Ustal wersje | |
| id: ver | |
| shell: pwsh | |
| run: | | |
| if ($env:GITHUB_REF -like 'refs/tags/v*') { | |
| $v = $env:GITHUB_REF -replace 'refs/tags/v', '' | |
| } else { | |
| $v = '${{ github.event.inputs.version }}' | |
| } | |
| "version=$v" | Out-File -FilePath $env:GITHUB_OUTPUT -Append | |
| Write-Host "Wersja: $v" | |
| - name: Publish (single-file, framework-dependent) | |
| shell: pwsh | |
| run: | | |
| dotnet publish GhostDeck.csproj -c Release -r win-x64 --self-contained false ` | |
| -p:PublishSingleFile=true -p:DebugType=none ` | |
| -p:Version=${{ steps.ver.outputs.version }} -o publish | |
| - name: Azure login (OIDC) | |
| uses: azure/login@v3 | |
| with: | |
| client-id: ${{ vars.AZURE_CLIENT_ID }} | |
| tenant-id: ${{ vars.AZURE_TENANT_ID }} | |
| subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} | |
| - name: Podpisz exe (Azure Artifact Signing) | |
| uses: azure/artifact-signing-action@v2 | |
| with: | |
| endpoint: https://eus.codesigning.azure.net/ | |
| signing-account-name: ghostdeck-signing | |
| certificate-profile-name: ghostdeck-public | |
| files-folder: ${{ github.workspace }}\publish | |
| files-folder-filter: exe | |
| file-digest: SHA256 | |
| timestamp-rfc3161: http://timestamp.acs.microsoft.com | |
| timestamp-digest: SHA256 | |
| - name: Zweryfikuj podpis (hard gate) | |
| shell: pwsh | |
| run: | | |
| $sig = Get-AuthenticodeSignature publish/GhostDeck.exe | |
| Write-Host "Status : $($sig.Status)" | |
| Write-Host "Signer : $($sig.SignerCertificate.Subject)" | |
| Write-Host "Stamp : $($sig.TimeStamperCertificate.Subject)" | |
| if ($sig.Status -ne 'Valid') { | |
| Write-Error "Plik nie ma poprawnego podpisu - przerywam wydanie." | |
| exit 1 | |
| } | |
| if ($sig.SignerCertificate.Subject -notlike '*FENIX INSPIRE*') { | |
| Write-Error "Nieoczekiwany podmiot podpisu: $($sig.SignerCertificate.Subject)" | |
| exit 1 | |
| } | |
| # The published asset is renamed after signing. Renaming a signed file does not affect | |
| # Authenticode, and the build keeps producing GhostDeck.exe, so AssemblyName, the process | |
| # name and the app identity are unchanged. The new asset name is what stops the in-app | |
| # updater in <= 1.34.x from swapping a self-contained install for a framework-dependent | |
| # build: it looks for an asset called exactly "GhostDeck.exe", does not find one, and falls | |
| # back to opening the release page instead of replacing the running exe. | |
| - name: Nazwij asset wydania | |
| shell: pwsh | |
| run: Rename-Item publish/GhostDeck.exe GhostDeck-win-x64.exe | |
| - name: Artefakt testowy (dry-run) | |
| if: ${{ github.event_name == 'workflow_dispatch' && inputs.dry-run }} | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: GhostDeck-signed-${{ steps.ver.outputs.version }} | |
| path: publish/GhostDeck-win-x64.exe | |
| - name: Extract release notes from CHANGELOG | |
| if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.dry-run) }} | |
| shell: pwsh | |
| run: | | |
| $v = '${{ steps.ver.outputs.version }}' | |
| $body = "Release $v" | |
| if (Test-Path CHANGELOG.md) { | |
| $cl = Get-Content CHANGELOG.md -Raw | |
| $m = [regex]::Match($cl, "(?ms)^##\s*\[?$([regex]::Escape($v))\]?.*?(?=^##\s|\z)") | |
| if ($m.Success) { $body = $m.Value.Trim() } | |
| } | |
| $body | Out-File release_notes.md -Encoding utf8 | |
| - name: Utworz Release i dolacz exe | |
| if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.dry-run) }} | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| tag_name: v${{ steps.ver.outputs.version }} | |
| name: GhostDeck v${{ steps.ver.outputs.version }} | |
| body_path: release_notes.md | |
| generate_release_notes: true | |
| files: publish/GhostDeck-win-x64.exe |