Merge pull request #1093 from GitGuardian/severine/fix-choco-publication

feat: 1 CI jobs to pack chocolatey package, 1 CI job to push it

Author: sevbch

.github/workflows/build_release_assets.yml

@@ -261,7 +261,6 @@ jobs:
           TEST_GG_VALID_TOKEN: ${{ secrets.TEST_GG_VALID_TOKEN }}
           TEST_GG_VALID_TOKEN_IGNORE_SHA: ${{ secrets.TEST_GG_VALID_TOKEN_IGNORE_SHA }}
           TEST_UNKNOWN_SECRET: ${{ secrets.TEST_UNKNOWN_SECRET }}
-
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with:
@@ -272,6 +271,7 @@ jobs:
             packages/ggshield-*.zip
             packages/ggshield-*.rpm
             packages/ggshield_*.deb
+            packages/ggshield.*.nupkg
 
   # Run some basic tests, the goal is to verify the ggshield binary has all the
   # libraries it needs to run

.github/workflows/tag.yml

@@ -82,6 +82,7 @@ jobs:
             packages/ggshield_*.deb \
             packages/ggshield-*.rpm \
             packages/ggshield-*.zip \
+            packages/ggshield.*.nupkg \
             packages/ggshield-*.gz
 
   update_vscode_extension:
@@ -151,19 +152,22 @@ jobs:
   push_to_chocolatey:
     needs: build_release_assets
     name: Push to Chocolatey
-    runs-on: chocolatey/choco
+    runs-on: windows-latest
     if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Download packages
+      - name: Download nupkg
+        id: download-nupkg
         uses: actions/download-artifact@v4
         with:
-          pattern: os-packages-windows-2022
+          pattern: ggshield.*.nupkg
           path: packages
-          merge-multiple: true
 
       - name: Push to Chocolatey
+        shell: bash
         run: |
-          scripts/push-to-chocolatey/push-to-chocolatey
+          scripts/chocolatey/push packages/ggshield.*.nupkg
+        env:
+          CHOCOLATEY_API_KEY: ${{ secrets.CHOCOLATEY_API_KEY }}

changelog.d/20250506_155224_severine.bonnechere_fix_choco_publication.md

@@ -0,0 +1,3 @@
+### Added
+
+- Added ggshield nukpg package (for installation with Chocolatey on Windows) to release assets.

scripts/build-os-packages/build-os-packages

@@ -114,6 +114,7 @@ init_system_vars() {
         EXE_EXT=".exe"
         HUMAN_OS=Windows
         TARGET="$arch-pc-windows-msvc"
+        REQUIREMENTS="$REQUIREMENTS choco"
         ;;
     *)
         die "Unknown OS. uname printed '$out'"
@@ -320,11 +321,8 @@ step_create_archive() {
         info "Archive created in $pkg_path & $archive_path"
         ;;
     Windows)
-        archive_path="$PACKAGES_DIR/$ARCHIVE_DIR_NAME.zip"
-        pushd "$PACKAGES_DIR"
-        7z a "$archive_path" "$ARCHIVE_DIR_NAME"
-        popd
-        info "Archive created in $archive_path"
+        create_windows_packages
+        test_chocolatey_package
         ;;
     esac
 }

scripts/build-os-packages/windows-functions.bash

@@ -26,3 +26,43 @@ windows_sign() {
         --input "$archive_dir/$INSTALL_PREFIX/ggshield.exe"
 }
 
+windows_create_archive() {
+    local archive_path="$PACKAGES_DIR/$ARCHIVE_DIR_NAME.zip"
+    pushd "$PACKAGES_DIR"
+    7z a "$archive_path" "$ARCHIVE_DIR_NAME"
+    popd
+    info "Archive created in $archive_path"
+}
+
+windows_build_chocolatey_package() {
+    # choco-package will contain everything needed to build the nupkg
+    # we delete it a the end.
+    mkdir choco-package
+    mkdir choco-package/tools
+
+    cp -r "$PACKAGES_DIR/$ARCHIVE_DIR_NAME/_internal" choco-package/tools
+    cp "$PACKAGES_DIR/$ARCHIVE_DIR_NAME/ggshield.exe" choco-package/tools
+    cp "$ROOT_DIR/scripts/chocolatey/ggshield.nuspec" choco-package
+    cp "$ROOT_DIR/scripts/chocolatey/VERIFICATION.txt" choco-package/tools
+    cp "$ROOT_DIR/LICENSE" choco-package/tools/LICENSE.txt
+    sed -i "s/__VERSION__/$VERSION/" choco-package/ggshield.nuspec
+
+    choco pack choco-package/* --version $VERSION --outdir $PACKAGES_DIR
+
+    info "Chocolatey package created in $PACKAGES_DIR/ggshield.$VERSION.nupkg"
+
+    rm -rf choco-package
+    
+}
+
+# cf https://docs.chocolatey.org/en-us/create/create-packages/#testing-your-package
+test_chocolatey_package() {
+    pushd "$PACKAGES_DIR"
+    choco install ggshield --debug --verbose --source . --noop
+    popd
+}
+
+create_windows_packages() {
+    windows_create_archive
+    windows_build_chocolatey_package
+}

scripts/push-to-chocolatey/README.md renamed to scripts/chocolatey/README.md

@@ -1,4 +1,4 @@
-# Push to Chocolatey
+# Chocolatey
 
 This folder contains everything necessary to build and publish the chocolatey package.
 

scripts/push-to-chocolatey/VERIFICATION.txt renamed to scripts/chocolatey/VERIFICATION.txt

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+die() {
+    echo $* >&2
+    exit 1
+}
+
+if [ -z "${CHOCOLATEY_API_KEY:-}" ] ; then
+    die '$CHOCOLATEY_API_KEY is not set'
+fi
+
+# parse command line arguments
+choco_nupkg=$1
+
+# push to chocolatey
+choco push $choco_nupkg --source https://push.chocolatey.org/ --api-key $CHOCOLATEY_API_KEY