mirror of
https://github.com/storytold/craft-common-actions.git
synced 2026-11-05 18:20:28 +00:00
Dylan M. Taylor
96b8516a40
A new optional LINUX_SIGNING_KEY secret (an unprotected OpenPGP signing subkey, from the release environment) signs each Linux format the way its tools check it: - rpm: embedded signature (rpmsign), for `rpm -K` and dnf/zypper gpgcheck - deb: embedded _gpgorigin member (debsigs) and a detached .asc - Arch: <file>.sig, which pacman looks for - AppImage, tar.gz, zsync: detached .asc - Flatpak bundle: signed commit and embedded public key (flatpak-bundle.sh, via the scaffold's new step 4), so `flatpak install` verifies it, plus a detached .asc - Flatpak OCI image: a containers/image signature for ghcr.io/<repo>@<digest>, which Flatpak checks from its signature lookaside; the flatpak job records the pushed manifest for it - SHA256SUMS.txt.asc over every release asset, and release-signing-key.asc The draft-release action signs before computing checksums (embedded signatures change the rpm and deb files) and verifies every signature against the exported public key. The new import-signing-key action is shared by the flatpak and release jobs and refuses a key that needs a passphrase. Without the secret, releases are published unsigned with a warning.
109 lines
4.2 KiB
YAML
109 lines
4.2 KiB
YAML
name: "Draft GitHub Release"
|
|
description: "Collects release artifacts, signs the Linux packages when given a key, computes (and signs) sha256 checksums, and creates or updates a draft GitHub Release"
|
|
|
|
inputs:
|
|
version:
|
|
description: "Release version string without 'v' prefix"
|
|
required: true
|
|
app-title:
|
|
description: "Human-readable application name"
|
|
required: true
|
|
prerelease:
|
|
description: "Whether release is marked as prerelease"
|
|
required: false
|
|
default: "false"
|
|
github-token:
|
|
description: "GitHub token for authenticating gh CLI"
|
|
required: true
|
|
signing-key:
|
|
description: "ASCII-armored OpenPGP secret key (LINUX_SIGNING_KEY) that signs the Linux packages and SHA256SUMS.txt; empty publishes them unsigned"
|
|
required: false
|
|
default: ""
|
|
|
|
runs:
|
|
using: "composite"
|
|
steps:
|
|
- name: Download all release artifacts
|
|
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
|
|
with:
|
|
pattern: release-*
|
|
path: artifacts
|
|
merge-multiple: true
|
|
|
|
- name: Import the Linux signing key
|
|
id: key
|
|
uses: storytold/craft-common-actions/actions/import-signing-key@main
|
|
with:
|
|
key: ${{ inputs.signing-key }}
|
|
|
|
- name: Install the signing tools
|
|
if: steps.key.outputs.enabled == 'true'
|
|
uses: storytold/craft-common-actions/actions/install-apt-packages@main
|
|
with:
|
|
packages: rpm debsigs skopeo binutils
|
|
|
|
- name: Sign the Linux packages
|
|
shell: bash
|
|
working-directory: artifacts
|
|
env:
|
|
SIGNING_ENABLED: ${{ steps.key.outputs.enabled }}
|
|
run: |
|
|
if [ "$SIGNING_ENABLED" != "true" ]; then
|
|
# shortcut: unsigned when the caller passes no LINUX_SIGNING_KEY; fail on the release branch, like macOS and Windows, once every app's caller passes it.
|
|
echo "::warning::LINUX_SIGNING_KEY is empty, so the Linux packages and SHA256SUMS.txt are published unsigned."
|
|
exit 0
|
|
fi
|
|
# The registry and repository Flatpak pulls the OCI images from (the identity it checks).
|
|
OCI_REGISTRY="ghcr.io/${GITHUB_REPOSITORY,,}" "$GITHUB_ACTION_PATH/sign-linux.sh" .
|
|
|
|
- name: Compute checksums
|
|
shell: bash
|
|
working-directory: artifacts
|
|
env:
|
|
SIGNING_ENABLED: ${{ steps.key.outputs.enabled }}
|
|
run: |
|
|
sha256sum -- * | tee SHA256SUMS.txt
|
|
if [ "$SIGNING_ENABLED" = "true" ]; then
|
|
gpg --batch --yes --local-user "$SIGNING_FPR" --armor --detach-sign -o SHA256SUMS.txt.asc SHA256SUMS.txt
|
|
gpgv --quiet --keyring "$SIGNING_PUBKEY" SHA256SUMS.txt.asc SHA256SUMS.txt
|
|
fi
|
|
|
|
- name: Create or update draft release
|
|
shell: bash
|
|
working-directory: artifacts
|
|
env:
|
|
VERSION: ${{ inputs.version }}
|
|
APP_TITLE: ${{ inputs.app-title }}
|
|
PRERELEASE: ${{ inputs.prerelease }}
|
|
GH_TOKEN: ${{ inputs.github-token }}
|
|
GH_REPO: ${{ github.repository }}
|
|
run: |
|
|
tag="v$VERSION"
|
|
title="$APP_TITLE v$VERSION"
|
|
pre=()
|
|
if [ "$PRERELEASE" = "true" ]; then pre=(--prerelease); fi
|
|
if draft="$(gh release view "$tag" --json isDraft --jq .isDraft 2>/dev/null)"; then
|
|
if [ "$draft" != "true" ]; then
|
|
echo "::error::Release $tag is already published. Bump the version (cargo xtask version set) before pushing to release."
|
|
exit 1
|
|
fi
|
|
echo "Updating draft $tag: replacing its assets"
|
|
gh release view "$tag" --json assets --jq '.assets[].name' | while read -r asset; do
|
|
gh release delete-asset "$tag" "$asset" --yes
|
|
done
|
|
gh release edit "$tag" --draft --title "$title" --target "$GITHUB_SHA" --prerelease="$PRERELEASE"
|
|
gh release upload "$tag" --clobber -- *
|
|
else
|
|
echo "Creating draft $tag"
|
|
gh release create "$tag" --draft --title "$title" --target "$GITHUB_SHA" --generate-notes "${pre[@]}" -- *
|
|
fi
|
|
{
|
|
echo "Draft release **$title** at \`${GITHUB_SHA::9}\`:"
|
|
echo
|
|
sed 's/^/ /' SHA256SUMS.txt
|
|
if [ -n "${SIGNING_FPR:-}" ]; then
|
|
echo
|
|
echo "Linux packages and SHA256SUMS.txt signed with \`$SIGNING_FPR\` (release-signing-key.asc)."
|
|
fi
|
|
} >>"$GITHUB_STEP_SUMMARY"
|