mirror of
https://github.com/clash-verge-rev/clash-verge-rev.git
synced 2026-10-14 21:20:48 +08:00
91 lines
2.7 KiB
YAML
91 lines
2.7 KiB
YAML
name: SignPath Test
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
actions: read
|
|
|
|
env:
|
|
CARGO_INCREMENTAL: 0
|
|
HUSKY: 0
|
|
|
|
jobs:
|
|
sign-windows:
|
|
runs-on: windows-latest
|
|
timeout-minutes: 90
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Install Rust
|
|
uses: dtolnay/rust-toolchain@master
|
|
with:
|
|
toolchain: '1.99.0'
|
|
targets: x86_64-pc-windows-msvc
|
|
|
|
- name: Install Node
|
|
uses: actions/setup-node@v7
|
|
with:
|
|
node-version: '24.21.0'
|
|
|
|
- name: Install pnpm
|
|
uses: pnpm/action-setup@v6
|
|
with:
|
|
run_install: false
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Prepare build resources
|
|
run: pnpm run prebuild x86_64-pc-windows-msvc
|
|
|
|
- name: Build test installer
|
|
shell: pwsh
|
|
env:
|
|
NODE_OPTIONS: '--max-old-space-size=4096'
|
|
run: |
|
|
$configPath = Join-Path $env:RUNNER_TEMP 'signpath-test.json'
|
|
'{"bundle":{"createUpdaterArtifacts":false}}' |
|
|
Set-Content -LiteralPath $configPath -Encoding utf8
|
|
pnpm exec tauri build --target x86_64-pc-windows-msvc --bundles nsis --config $configPath
|
|
|
|
- name: Upload unsigned installer
|
|
id: unsigned
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: windows-x64-unsigned
|
|
path: target/x86_64-pc-windows-msvc/release/bundle/nsis/*-setup.exe
|
|
if-no-files-found: error
|
|
|
|
- name: Sign with SignPath test certificate
|
|
uses: signpath/github-action-submit-signing-request@v3
|
|
with:
|
|
api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
|
|
organization-id: '5b298f4d-010d-4bae-b665-70551a58839c'
|
|
project-slug: 'clash-verge-rev'
|
|
signing-policy-slug: 'test-signing'
|
|
artifact-configuration-slug: 'initial'
|
|
github-artifact-id: ${{ steps.unsigned.outputs.artifact-id }}
|
|
wait-for-completion: true
|
|
output-artifact-directory: signed
|
|
|
|
- name: Inspect installer signature
|
|
shell: pwsh
|
|
run: |
|
|
Get-ChildItem -Path signed/*-setup.exe | ForEach-Object {
|
|
$signature = Get-AuthenticodeSignature -LiteralPath $_.FullName
|
|
if (-not $signature.SignerCertificate) {
|
|
throw "No Authenticode signer certificate found for $($_.Name)"
|
|
}
|
|
$signature | Format-List Path, Status, StatusMessage, SignerCertificate
|
|
}
|
|
|
|
- name: Upload signed test installer
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: windows-x64-test-signed
|
|
path: signed/*-setup.exe
|
|
if-no-files-found: error
|