Skip to content

Commit 823be36

Browse files
polldopolldo
committed
CI: Add release workflow (#39)
Add a github workflow that uses a Taskfile to cross-compile the project for the main operating systems. The gon configuration, used to notarize the binary for mac-os, has been fixed. A new release will be generated on every push of a tag named with a version format. * CI: Add release workflow * Disable upload to aws * Enable macos notarization * Edit release archive (- license, + binaries) * Fix release version * Add todos
1 parent 0f89463 commit 823be36

File tree

5 files changed

+472
-3
lines changed

5 files changed

+472
-3
lines changed

‎.github/workflows/release-go-task.yml

+171
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/release-go-task.md
2+
name: Release
3+
4+
env:
5+
# As defined by the Taskfile's PROJECT_NAME variable
6+
PROJECT_NAME: arduino-cloud-cli
7+
# As defined by the Taskfile's DIST_DIR variable
8+
DIST_DIR: dist
9+
# The project's folder on Arduino's download server for uploading builds
10+
AWS_PLUGIN_TARGET: TODO
11+
ARTIFACT_NAME: dist
12+
# TODO: Remember to REMOVE binaries folder as soon as it is removed from the project
13+
PROVISIONING_BINARIES_FOLDER: binaries
14+
15+
on:
16+
push:
17+
tags:
18+
- "[0-9]+.[0-9]+.[0-9]+*"
19+
20+
jobs:
21+
create-release-artifacts:
22+
runs-on: ubuntu-latest
23+
24+
steps:
25+
- name: Checkout repository
26+
uses: actions/checkout@v2
27+
with:
28+
fetch-depth: 0
29+
30+
- name: Create changelog
31+
uses: arduino/create-changelog@v1
32+
with:
33+
tag-regex: '^[0-9]+\.[0-9]+\.[0-9]+.*$'
34+
filter-regex: '^\[(skip|changelog)[ ,-](skip|changelog)\].*'
35+
case-insensitive-regex: true
36+
changelog-file-path: "${{ env.DIST_DIR }}/CHANGELOG.md"
37+
38+
- name: Install Task
39+
uses: arduino/setup-task@v1
40+
with:
41+
repo-token: ${{ secrets.GITHUB_TOKEN }}
42+
version: 3.x
43+
44+
- name: Build
45+
run: task dist:all
46+
47+
- name: Upload artifacts
48+
uses: actions/upload-artifact@v2
49+
with:
50+
if-no-files-found: error
51+
name: ${{ env.ARTIFACT_NAME }}
52+
path: ${{ env.DIST_DIR }}
53+
54+
notarize-macos:
55+
runs-on: macos-latest
56+
needs: create-release-artifacts
57+
58+
steps:
59+
- name: Checkout repository
60+
uses: actions/checkout@v2
61+
62+
- name: Download artifacts
63+
uses: actions/download-artifact@v2
64+
with:
65+
name: ${{ env.ARTIFACT_NAME }}
66+
path: ${{ env.DIST_DIR }}
67+
68+
- name: Import Code-Signing Certificates
69+
env:
70+
KEYCHAIN: "sign.keychain"
71+
INSTALLER_CERT_MAC_PATH: "/tmp/ArduinoCerts2020.p12"
72+
KEYCHAIN_PASSWORD: keychainpassword # Arbitrary password for a keychain that exists only for the duration of the job, so not secret
73+
run: |
74+
echo "${{ secrets.MACOS_SIGN_CERTIFICATE_P12 }}" | base64 --decode > "${{ env.INSTALLER_CERT_MAC_PATH }}"
75+
security create-keychain -p "${{ env.KEYCHAIN_PASSWORD }}" "${{ env.KEYCHAIN }}"
76+
security default-keychain -s "${{ env.KEYCHAIN }}"
77+
security unlock-keychain -p "${{ env.KEYCHAIN_PASSWORD }}" "${{ env.KEYCHAIN }}"
78+
security import \
79+
"${{ env.INSTALLER_CERT_MAC_PATH }}" \
80+
-k "${{ env.KEYCHAIN }}" \
81+
-f pkcs12 \
82+
-A \
83+
-T "/usr/bin/codesign" \
84+
-P "${{ secrets.MACOS_SIGN_CERTIFICATE_PASSWORD }}"
85+
security set-key-partition-list \
86+
-S apple-tool:,apple: \
87+
-s \
88+
-k "${{ env.KEYCHAIN_PASSWORD }}" \
89+
"${{ env.KEYCHAIN }}"
90+
91+
- name: Install gon for code signing and app notarization
92+
run: |
93+
wget -q https://github.com/mitchellh/gon/releases/download/v0.2.3/gon_macos.zip
94+
unzip gon_macos.zip -d /usr/local/bin
95+
96+
- name: Sign and notarize binary
97+
env:
98+
AC_USERNAME: ${{ secrets.AC_USERNAME }}
99+
AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
100+
run: |
101+
gon gon.config.hcl
102+
103+
- name: Re-package binary and update checksum
104+
# This step performs the following:
105+
# 1. Repackage the signed binary replaced in place by Gon (ignoring the output zip file)
106+
# 2. Recalculate package checksum and replace it in the nnnnnn-checksums.txt file
107+
# TODO: Add again the LICENSE.txt as soon as we have it
108+
# TODO: Remember to REMOVE binaries folder as soon as it is removed from the project ({{.PROVISIONING_BINARIES_FOLDER}})
109+
run: |
110+
# GitHub's upload/download-artifact@v2 actions don't preserve file permissions,
111+
# so we need to add execution permission back until the action is made to do this.
112+
chmod +x ${{ env.DIST_DIR }}/${{ env.PROJECT_NAME }}_osx_darwin_amd64/${{ env.PROJECT_NAME }}
113+
TAG="${GITHUB_REF/refs\/tags\//}"
114+
tar -czvf "${{ env.DIST_DIR }}/${{ env.PROJECT_NAME }}_${TAG}_macOS_64bit.tar.gz" \
115+
-C ${{ env.DIST_DIR }}/${{ env.PROJECT_NAME }}_osx_darwin_amd64/ ${{ env.PROJECT_NAME }} \
116+
-C ../../ ${{ env.PROVISIONING_BINARIES_FOLDER }}
117+
CHECKSUM="$(shasum -a 256 ${{ env.DIST_DIR }}/${{ env.PROJECT_NAME }}_${TAG}_macOS_64bit.tar.gz | cut -d " " -f 1)"
118+
perl \
119+
-pi \
120+
-w \
121+
-e "s/.*${{ env.PROJECT_NAME }}_${TAG}_macOS_64bit.tar.gz/${CHECKSUM} ${{ env.PROJECT_NAME }}_${TAG}_macOS_64bit.tar.gz/g;" \
122+
${{ env.DIST_DIR }}/*-checksums.txt
123+
124+
- name: Upload artifacts
125+
uses: actions/upload-artifact@v2
126+
with:
127+
if-no-files-found: error
128+
name: ${{ env.ARTIFACT_NAME }}
129+
path: ${{ env.DIST_DIR }}
130+
131+
create-release:
132+
runs-on: ubuntu-latest
133+
needs: notarize-macos
134+
135+
steps:
136+
- name: Download artifact
137+
uses: actions/download-artifact@v2
138+
with:
139+
name: ${{ env.ARTIFACT_NAME }}
140+
path: ${{ env.DIST_DIR }}
141+
142+
- name: Identify Prerelease
143+
# This is a workaround while waiting for create-release action
144+
# to implement auto pre-release based on tag
145+
id: prerelease
146+
run: |
147+
wget -q -P /tmp https://github.com/fsaintjacques/semver-tool/archive/3.0.0.zip
148+
unzip -p /tmp/3.0.0.zip semver-tool-3.0.0/src/semver >/tmp/semver && chmod +x /tmp/semver
149+
if [[ "$(/tmp/semver get prerel "${GITHUB_REF/refs\/tags\//}")" ]]; then echo "::set-output name=IS_PRE::true"; fi
150+
151+
- name: Create Github Release and upload artifacts
152+
uses: ncipollo/release-action@v1
153+
with:
154+
token: ${{ secrets.GITHUB_TOKEN }}
155+
bodyFile: ${{ env.DIST_DIR }}/CHANGELOG.md
156+
draft: false
157+
prerelease: ${{ steps.prerelease.outputs.IS_PRE }}
158+
# NOTE: "Artifact is a directory" warnings are expected and don't indicate a problem
159+
# (all the files we need are in the DIST_DIR root)
160+
artifacts: ${{ env.DIST_DIR }}/*
161+
162+
# TODO
163+
# - name: Upload release files on Arduino downloads servers
164+
# uses: docker://plugins/s3
165+
# env:
166+
# PLUGIN_SOURCE: "${{ env.DIST_DIR }}/*"
167+
# PLUGIN_TARGET: ${{ env.AWS_PLUGIN_TARGET }}
168+
# PLUGIN_STRIP_PREFIX: "${{ env.DIST_DIR }}/"
169+
# PLUGIN_BUCKET: ${{ secrets.DOWNLOADS_BUCKET }}
170+
# AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
171+
# AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

‎.github/workflows/test-go-task.yml

+1
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@ jobs:
9393
GO_MODULE_PATH: ${{ matrix.module.path }}
9494
run: task go:test
9595

96+
# TODO
9697
# - name: Send unit tests coverage to Codecov
9798
# if: runner.os == 'Linux'
9899
# uses: codecov/codecov-action@v2

0 commit comments

Comments
 (0)