Skip to content

Commit c5e43ba

Browse files
umbynosMaurizio Branca
umbynos
and
Maurizio Branca
authored
Port installer generation to github actions (#562)
* add a new release workflow 📦 * add `build_cli` to Taskfile to support `_cli` binary generation only 🏗️ * move win env vars from Taskfile to workflow * standardize test.yaml to release.yaml * remove old upload artifact no longer needed in test workflow Co-authored-by: Maurizio Branca <[email protected]>
1 parent 1da694d commit c5e43ba

File tree

4 files changed

+399
-46
lines changed

4 files changed

+399
-46
lines changed

‎.github/workflows/release.yml

+363
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,363 @@
1+
name: release
2+
3+
on:
4+
push:
5+
tags:
6+
- "[0-9]+.[0-9]+.[0-9]+*"
7+
8+
jobs:
9+
# The build job is responsible for: configuring the environment, testing and compiling process
10+
build:
11+
strategy:
12+
matrix:
13+
operating-system: [ubuntu-latest, windows-latest, macos-latest]
14+
15+
runs-on: ${{ matrix.operating-system }}
16+
17+
steps:
18+
- name: Disable EOL conversions
19+
run: git config --global core.autocrlf false
20+
21+
- name: Checkout
22+
uses: actions/checkout@v2
23+
24+
- name: Install Go
25+
uses: actions/setup-go@v2
26+
with:
27+
go-version: "1.15"
28+
29+
# dependencies used for compiling the GUI
30+
- name: Install Dependencies (Linux)
31+
run: sudo apt update && sudo apt install -y --no-install-recommends build-essential libgtk-3-dev libwebkit2gtk-4.0-dev libappindicator3-dev
32+
if: matrix.operating-system == 'ubuntu-latest'
33+
34+
- name: Install Go deps
35+
# Since 10/23/2019 pwsh is the default shell
36+
# on Windows, but pwsh fails to install protoc-gen-go so
37+
# we force bash as default shell for all OSes in this task
38+
run: |
39+
go get github.com/golangci/govet
40+
go get golang.org/x/lint/golint
41+
shell: bash
42+
43+
- name: Install Taskfile
44+
uses: arduino/actions/setup-taskfile@master
45+
with:
46+
version: '3.x'
47+
repo-token: ${{ secrets.GITHUB_TOKEN }}
48+
49+
- name: Check the code is good
50+
run: task check
51+
52+
- name: Run unit tests
53+
run: task test-unit
54+
55+
- name: Build the Agent
56+
run: task build
57+
if: matrix.operating-system != 'windows-latest'
58+
59+
# build the agent without GUI support (no tray icon)
60+
- name: Build the Agent-cli
61+
run: task build-cli
62+
if: matrix.operating-system == 'ubuntu-latest'
63+
64+
# the manifest is required by windows GUI apps, otherwise the binary will crash with: "Unable to create main window: TTM_ADDTOOL failed" (for reference https://github.com/lxn/walk/issues/28)
65+
# rsrc will produce *.syso files that should get automatically recognized by go build command and linked into an executable.
66+
- name: Embed manifest in win binary
67+
run: |
68+
go get github.com/akavel/rsrc
69+
rsrc -arch 386 -manifest manifest.xml
70+
if: matrix.operating-system == 'windows-latest'
71+
72+
# building the agent for win requires a different task because of an extra flag
73+
- name: Build the Agent for win32
74+
env:
75+
GOARCH: 386 # 32bit architecture (for support)
76+
GO386: 387 # support old instruction sets without MMX (used in the Pentium 4) (will be deprecated in GO > 1.15 https://golang.org/doc/go1.15)
77+
run: task build-win32
78+
if: matrix.operating-system == 'windows-latest'
79+
80+
# config.ini is required by the executable when it's run
81+
- name: Upload artifacts
82+
uses: actions/upload-artifact@v2
83+
with:
84+
name: arduino-create-agent-${{ matrix.operating-system }}
85+
path: |
86+
arduino-create-agent*
87+
config.ini
88+
if-no-files-found: error
89+
90+
# The code-sign-mac-executable job will download the macos artifact from the previous job, sign e notarize the binary and re-upload it.
91+
code-sign-mac-executable:
92+
needs: build
93+
runs-on: macos-latest
94+
95+
steps:
96+
- name: Checkout
97+
uses: actions/checkout@v2
98+
with:
99+
repository: 'bcmi-labs/arduino-create-agent-installer' # the repo which contains gon.config.hcl
100+
token: ${{ secrets.ARDUINO_CREATE_AGENT_CI_PAT }}
101+
102+
- name: Download artifact
103+
uses: actions/download-artifact@v2
104+
with:
105+
name: arduino-create-agent-macos-latest
106+
path: arduino-create-agent-macos-latest
107+
108+
- name: Import Code-Signing Certificates
109+
env:
110+
KEYCHAIN: "sign.keychain"
111+
INSTALLER_CERT_MAC_PATH: "/tmp/ArduinoCerts2020.p12"
112+
run: |
113+
echo "${{ secrets.INSTALLER_CERT_MAC_P12 }}" | base64 --decode > ${{ env.INSTALLER_CERT_MAC_PATH }}
114+
security create-keychain -p ${{ secrets.KEYCHAIN_PASSWORD }} ${{ env.KEYCHAIN }}
115+
security default-keychain -s ${{ env.KEYCHAIN }}
116+
security unlock-keychain -p ${{ secrets.KEYCHAIN_PASSWORD }} ${{ env.KEYCHAIN }}
117+
security import ${{ env.INSTALLER_CERT_MAC_PATH }} -k ${{ env.KEYCHAIN }} -f pkcs12 -A -T /usr/bin/codesign -P ${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}
118+
security set-key-partition-list -S apple-tool:,apple: -s -k ${{ secrets.KEYCHAIN_PASSWORD }} ${{ env.KEYCHAIN }}
119+
120+
- name: Install gon for code signing and app notarization
121+
run: |
122+
wget -q https://github.com/mitchellh/gon/releases/download/v0.2.3/gon_macos.zip
123+
unzip gon_macos.zip -d /usr/local/bin
124+
125+
- name: Code sign and notarize app
126+
env:
127+
AC_USERNAME: ${{ secrets.AC_USERNAME }}
128+
AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
129+
run: |
130+
gon -log-level=debug -log-json gon.config.hcl
131+
# gon will notarize executable in "arduino-create-agent-macos-latest/arduino-create-agent
132+
# The CI will ignore the zip output, using the signed binary only.
133+
timeout-minutes: 30
134+
135+
# This step will overwrite the non signed mac artifact (arduino-create-agent-macos-latest)
136+
- name: Upload artifact
137+
uses: actions/upload-artifact@v2
138+
with:
139+
name: arduino-create-agent-macos-latest
140+
path: arduino-create-agent-macos-latest
141+
if-no-files-found: error
142+
143+
# This job is responsible for generating the installers (using installbuilder)
144+
package:
145+
needs: code-sign-mac-executable
146+
runs-on: ubuntu-latest
147+
148+
env:
149+
# vars used by installbuilder
150+
INSTALLBUILDER_PATH: "/opt/installbuilder-20.9.0/bin/builder"
151+
INSTALLER_VARS: "project.outputDirectory=$PWD project.version=${GITHUB_REF##*/} workspace=$PWD realname=Arduino_Create_Bridge"
152+
# vars passed to installbuilder to install https certs automatically
153+
CERT_INSTALL: "ask_certificates_install=CI" # win(edge),mac(safari)
154+
NO_CERT_INSTALL: "ask_certificates_install=CS" # linux
155+
CHOICE_CERT_INSTALL: "ask_certificates_install=CC" # win,mac:(ff,chrome)
156+
CREATE_OSX_BUNDLED_MG: 0 # tell installbuilder to not create the DMG, gon will take care of that later
157+
# installbuilder will read this vars automatically (defined in installer.xml):
158+
INSTALLER_CERT_WINDOWS_PASSWORD: ${{ secrets.INSTALLER_CERT_WINDOWS_PASSWORD }}
159+
INSTALLER_CERT_WINDOWS_PFX: "/tmp/ArduinoCerts2020.pfx"
160+
INSTALLER_CERT_MAC_PASSWORD: ${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}
161+
INSTALLER_CERT_MAC_P12: "/tmp/ArduinoCerts2020.p12"
162+
163+
strategy:
164+
fail-fast: false # if one os is failing continue nonetheless
165+
matrix: # used to generate installers for different OS and not for runs-on
166+
operating-system: [ubuntu-latest, windows-latest, macos-latest]
167+
168+
include:
169+
- operating-system: ubuntu-latest
170+
install-builder-name: linux-x64
171+
executable-path: artifacts/linux-amd64/
172+
- operating-system: windows-latest
173+
browser: edge
174+
install-builder-name: windows
175+
executable-path: artifacts/windows/
176+
extension: .exe
177+
installer-extension: .exe
178+
- operating-system: macos-latest
179+
browser: safari
180+
install-builder-name: osx
181+
executable-path: 'skel/ArduinoCreateAgent.app/Contents/MacOS/'
182+
installer-extension: .app
183+
184+
container:
185+
image: floydpink/ubuntu-install-builder:20.9.0
186+
187+
steps:
188+
189+
- name: Checkout
190+
uses: actions/checkout@v2
191+
with:
192+
repository: 'bcmi-labs/arduino-create-agent-installer' # the repo which contains install.xml
193+
token: ${{ secrets.ARDUINO_CREATE_AGENT_CI_PAT }}
194+
195+
- name: Download artifact
196+
uses: actions/download-artifact@v2
197+
with:
198+
name: arduino-create-agent-${{ matrix.operating-system }}
199+
path: ${{ matrix.executable-path }} # path expected by installbuilder
200+
201+
# zip artifacts do not mantain executable permission
202+
- name: Make executable
203+
run: chmod -v +x ${{ matrix.executable-path }}arduino-create-agent*
204+
if: matrix.operating-system == 'ubuntu-latest' || matrix.operating-system == 'macos-latest'
205+
206+
- name: Rename executable to Arduino_Create_Bridge
207+
run: mv -v ${{ matrix.executable-path }}arduino-create-agent${{ matrix.extension }} ${{ matrix.executable-path }}Arduino_Create_Bridge${{ matrix.extension }}
208+
209+
- name: Rename executable to Arduino_Create_Bridge_cli
210+
run: mv -v ${{ matrix.executable-path }}arduino-create-agent_cli${{ matrix.extension }} ${{ matrix.executable-path }}Arduino_Create_Bridge_cli${{ matrix.extension }}
211+
if: matrix.operating-system == 'ubuntu-latest'
212+
213+
- name: Save InstallBuilder license to file
214+
run: echo "${{ secrets.INSTALLER_LICENSE }}" > /tmp/license.xml
215+
216+
- name: Save Win signing certificate to file
217+
run: echo "${{ secrets.INSTALLER_CERT_WINDOWS_PFX }}" | base64 --decode > ${{ env.INSTALLER_CERT_WINDOWS_PFX}}
218+
if: matrix.operating-system == 'windows-latest'
219+
220+
- name: Save macos signing certificate to file
221+
run: echo "${{ secrets.INSTALLER_CERT_MAC_P12 }}" | base64 --decode > ${{ env.INSTALLER_CERT_MAC_P12 }}
222+
if: matrix.operating-system == 'macos-latest'
223+
224+
# win(edge),mac(safari) -> CERT_INSTALL and win,mac:(ff,chrome) -> CHOICE_CERT_INSTALL
225+
# installbuilder reads the env vars with certs paths and use it to sign the installer.
226+
- name: Launch Bitrock installbuilder-20 with CERT_INSTALL && CHOICE_CERT_INSTALL
227+
run: |
228+
${{ env.INSTALLBUILDER_PATH }} build installer.xml ${{ matrix.install-builder-name }} --verbose --license /tmp/license.xml --setvars ${{ env.INSTALLER_VARS }} ${{ env.CERT_INSTALL }}
229+
mv -v ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CI${{matrix.installer-extension}} ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-${{matrix.browser}}${{matrix.installer-extension}}
230+
${{ env.INSTALLBUILDER_PATH }} build installer.xml ${{ matrix.install-builder-name }} --verbose --license /tmp/license.xml --setvars ${{ env.INSTALLER_VARS }} ${{ env.CHOICE_CERT_INSTALL }}
231+
cp -vr ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CC${{matrix.installer-extension}} ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-chrome${{matrix.installer-extension}}
232+
mv -v ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CC${{matrix.installer-extension}} ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-firefox${{matrix.installer-extension}}
233+
rm -r ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-C*
234+
if: matrix.operating-system == 'windows-latest' || matrix.operating-system == 'macos-latest'
235+
236+
# linux
237+
- name: Launch Bitrock installbuilder-20 with NO_CERT_INSTALL
238+
run: |
239+
${{ env.INSTALLBUILDER_PATH }} build installer.xml ${{ matrix.install-builder-name }} --verbose --license /tmp/license.xml --setvars ${{ env.INSTALLER_VARS }} ${{ env.NO_CERT_INSTALL }}
240+
cp -v ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CS.run ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-chrome.run
241+
mv -v ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CS.run ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-firefox.run
242+
cp -v ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CS.tar.gz ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-chrome.tar.gz
243+
mv -v ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CS.tar.gz ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-firefox.tar.gz
244+
if: matrix.operating-system == 'ubuntu-latest'
245+
246+
- name: Upload artifacts
247+
uses: actions/upload-artifact@v2
248+
with:
249+
name: ArduinoCreateAgent-${{ matrix.install-builder-name }}
250+
path: ArduinoCreateAgent*
251+
if-no-files-found: error
252+
253+
# This job will sign and notarize mac installers
254+
code-sign-mac-installers:
255+
needs: package
256+
runs-on: macos-latest
257+
258+
strategy:
259+
matrix:
260+
browser: [safari, firefox, chrome]
261+
262+
steps:
263+
264+
- name: Download artifact
265+
uses: actions/download-artifact@v2
266+
with:
267+
name: ArduinoCreateAgent-osx
268+
path: ArduinoCreateAgent-osx
269+
270+
# zip artifacts do not mantain executable permission
271+
- name: Make executable
272+
run: chmod -v +x ArduinoCreateAgent-osx/ArduinoCreateAgent-${GITHUB_REF##*/}-osx-installer-${{ matrix.browser }}.app/Contents/MacOS/*
273+
274+
- name: Import Code-Signing Certificates
275+
env:
276+
KEYCHAIN: "sign.keychain"
277+
INSTALLER_CERT_MAC_PATH: "/tmp/ArduinoCerts2020.p12"
278+
run: |
279+
echo "${{ secrets.INSTALLER_CERT_MAC_P12 }}" | base64 --decode > ${{ env.INSTALLER_CERT_MAC_PATH }}
280+
security create-keychain -p ${{ secrets.KEYCHAIN_PASSWORD }} ${{ env.KEYCHAIN }}
281+
security default-keychain -s ${{ env.KEYCHAIN }}
282+
security unlock-keychain -p ${{ secrets.KEYCHAIN_PASSWORD }} ${{ env.KEYCHAIN }}
283+
security import ${{ env.INSTALLER_CERT_MAC_PATH }} -k ${{ env.KEYCHAIN }} -f pkcs12 -A -T /usr/bin/codesign -P ${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}
284+
security set-key-partition-list -S apple-tool:,apple: -s -k ${{ secrets.KEYCHAIN_PASSWORD }} ${{ env.KEYCHAIN }}
285+
286+
- name: Install gon for code signing and app notarization
287+
run: |
288+
wget -q https://github.com/mitchellh/gon/releases/download/v0.2.3/gon_macos.zip
289+
unzip gon_macos.zip -d /usr/local/bin
290+
291+
- name: Write gon config to file
292+
# gon does not allow env variables in config file (https://github.com/mitchellh/gon/issues/20)
293+
run: |
294+
cat > gon.config_installer.hcl <<EOF
295+
source = ["ArduinoCreateAgent-osx/ArduinoCreateAgent-${GITHUB_REF##*/}-osx-installer-${{ matrix.browser }}.app"]
296+
bundle_id = "cc.arduino.arduino-agent-installer"
297+
298+
sign {
299+
application_identity = "Developer ID Application: ARDUINO SA (7KT7ZWMCJT)"
300+
}
301+
302+
dmg {
303+
output_path = "ArduinoCreateAgent-${GITHUB_REF##*/}-osx-installer-${{ matrix.browser }}.dmg"
304+
volume_name = "ArduinoCreateAgent"
305+
}
306+
EOF
307+
308+
- name: Code sign and notarize app
309+
env:
310+
AC_USERNAME: ${{ secrets.AC_USERNAME }}
311+
AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
312+
run: |
313+
echo "gon will notarize executable in ArduinoCreateAgent-osx/ArduinoCreateAgent-${GITHUB_REF##*/}-osx-installer-${{ matrix.browser }}.app"
314+
gon -log-level=debug -log-json gon.config_installer.hcl
315+
timeout-minutes: 30
316+
317+
# tar dmg file to keep executable permission
318+
- name: Tar files to keep permissions
319+
run: tar -cvf ArduinoCreateAgent-${GITHUB_REF##*/}-osx-installer-${{ matrix.browser }}.tar ArduinoCreateAgent-${GITHUB_REF##*/}-osx-installer-${{ matrix.browser }}.dmg
320+
321+
- name: Upload artifacts
322+
uses: actions/upload-artifact@v2
323+
with:
324+
name: ArduinoCreateAgent-osx
325+
path: ArduinoCreateAgent*.tar
326+
if-no-files-found: error
327+
328+
create-release:
329+
runs-on: ubuntu-latest
330+
needs: code-sign-mac-installers
331+
332+
steps:
333+
334+
- name: Download artifact
335+
uses: actions/download-artifact@v2 # download all the artifacts
336+
337+
# mandatory step because upload-release-action does not support multiple folders
338+
- name: prepare artifacts for the release
339+
run: |
340+
mkdir release
341+
chmod -v +x ArduinoCreateAgent-linux-x64/*.run
342+
mv -v ArduinoCreateAgent-linux-x64/* release/
343+
cat ArduinoCreateAgent-osx/*.tar | tar -xvf - -i -C release/
344+
mv -v ArduinoCreateAgent-windows/* release/
345+
346+
- name: Create Github Release
347+
uses: actions/create-release@v1
348+
env:
349+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
350+
with:
351+
tag_name: ${{ github.ref }}
352+
release_name: ${{ github.ref }}
353+
body: "THIS IS A TEST RELEASE"
354+
draft: false
355+
prerelease: true # see later how to handle this (maybe just a check on "-dev" will be sufficient)
356+
357+
- name: Upload release files on Github
358+
uses: svenstaro/upload-release-action@v2
359+
with:
360+
repo_token: ${{ secrets.GITHUB_TOKEN }}
361+
tag: ${{ github.ref }}
362+
file_glob: true # If set to true, the file argument can be a glob pattern
363+
file: release/*

0 commit comments

Comments
 (0)