From 9dd4f7085ca993d84f3938b4e5fa352f0937c190 Mon Sep 17 00:00:00 2001 From: Brandon Thomas Date: Sun, 11 Oct 2026 18:02:17 -0400 Subject: [PATCH] fix(ci): require signing secrets on release, pass riscv64 formats with spaces - macOS and Windows jobs fail on refs/heads/release when their signing secrets are empty, instead of letting the app's packaging warn and ship unsigned. A caller that doesn't list a secret name gets it empty, even though the value is in its release environment: craft-launcher 0.3.1 built unsigned Windows MSIs this way. - linux-riscv64 calls package.sh --formats "deb rpm tar". Every app's package.sh splits formats on spaces, so deb,rpm,tar matched nothing and the job failed with an empty dist/release. - README caller example lists the secrets instead of secrets: inherit. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release.yml | 48 ++++++++++++++++++++++++++++++++++- README.md | 18 ++++++++++++- 2 files changed, 64 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4827253..cf34361 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -160,6 +160,28 @@ jobs: WORDCRAFT_BUILD_SHA: ${{ github.sha }} INPUT_VERSION: ${{ inputs.version }} steps: + # A signed job reads only the secrets the caller lists in its `secrets:` block; values come + # from the repo's `release` environment. An unlisted name is empty, and the app's packaging + # would then warn and ship unsigned, so on the release branch fail here instead. + - name: Require signing secrets on the release branch + if: github.ref == 'refs/heads/release' + shell: bash + env: + APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} + APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} + KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} + APPLE_ID: ${{ secrets.APPLE_ID }} + APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }} + APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} + run: | + missing="" + for name in APPLE_CERTIFICATE APPLE_CERTIFICATE_PASSWORD KEYCHAIN_PASSWORD APPLE_ID APPLE_PASSWORD APPLE_TEAM_ID; do + [ -n "${!name}" ] || missing="$missing $name" + done + if [ -n "$missing" ]; then + echo "::error::macOS release builds must be signed and notarized, but these secrets are empty:$missing. List them in the caller's secrets: block and set them in the repo's release environment." + exit 1 + fi - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check out craft-fonts if: inputs.craft-fonts-ref != '' @@ -267,6 +289,30 @@ jobs: WORDCRAFT_BUILD_SHA: ${{ github.sha }} INPUT_VERSION: ${{ inputs.version }} steps: + # See the macOS job: unlisted secrets are empty, and the build would ship unsigned. + # Signing needs either the PFX pair or all six Azure Trusted Signing values. + - name: Require signing secrets on the release branch + if: github.ref == 'refs/heads/release' + shell: bash + env: + WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }} + WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }} + AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }} + AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }} + AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }} + AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }} + AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }} + AZURE_CERT_PROFILE: ${{ secrets.AZURE_CERT_PROFILE }} + run: | + if [ -n "$WINDOWS_CERTIFICATE" ] && [ -n "$WINDOWS_CERTIFICATE_PASSWORD" ]; then exit 0; fi + missing="" + for name in AZURE_TENANT_ID AZURE_CLIENT_ID AZURE_CLIENT_SECRET AZURE_SIGNING_ENDPOINT AZURE_SIGNING_ACCOUNT AZURE_CERT_PROFILE; do + [ -n "${!name}" ] || missing="$missing $name" + done + if [ -n "$missing" ]; then + echo "::error::Windows release builds must be signed, but there is no WINDOWS_CERTIFICATE pair and these Azure Trusted Signing secrets are empty:$missing. List them in the caller's secrets: block and set them in the repo's release environment." + exit 1 + fi - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check out craft-fonts if: inputs.craft-fonts-ref != '' @@ -751,7 +797,7 @@ jobs: CROSS_COMPILE: riscv64-linux-gnu- EMULATOR: qemu-riscv64 QEMU_LD_PREFIX: /usr/riscv64-linux-gnu - run: packaging/linux/package.sh --formats deb,rpm,tar + run: packaging/linux/package.sh --formats "deb rpm tar" - name: Check the packages run: | dpkg-deb --info dist/release/*-linux-riscv64.deb 2>/dev/null || true diff --git a/README.md b/README.md index 14bb0df..6932981 100644 --- a/README.md +++ b/README.md @@ -46,9 +46,25 @@ jobs: app-title: PhotoCraft craft-fonts-ref: abb83316d96aa59c1cf64784289e378fe9fa5695 version: ${{ inputs.version }} - secrets: inherit + secrets: + APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} + APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} + KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} + APPLE_ID: ${{ secrets.APPLE_ID }} + APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }} + APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} + WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }} + WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }} + AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }} + AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }} + AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }} + AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }} + AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }} + AZURE_CERT_PROFILE: ${{ secrets.AZURE_CERT_PROFILE }} ``` +List every signing secret explicitly. The signing jobs run in the caller repo's `release` environment and read the values from there, but only for the names listed here: an unlisted name is empty. On the `release` branch the macOS and Windows jobs fail when their signing secrets are empty, rather than shipping unsigned builds. + ### 2. `packaging-lint.yml` Lints all packaging configurations and metadata: - `actionlint` for workflow syntax