release.yml

name: Release

env:
  # The name of the project
  PROJECT_NAME: imgtool
  DIST_DIR: dist
  ARTIFACT_PREFIX: dist-
  # The project's folder on Arduino's download server for uploading builds
  AWS_PLUGIN_TARGET: /tools/
  # See: https://github.com/actions/setup-python/tree/main#available-versions-of-python
  PYTHON_VERSION: "3.7"
  MCUBOOT_PATH: ${{ github.workspace }}/mcuboot
  IMGTOOL_PACKING_PATH: ${{ github.workspace }}/imgtool-packing
  AWS_REGION: "us-east-1"

on:
  push:
    tags:
      - "[0-9]+.[0-9]+.[0-9]+*"

jobs:
  build:
    name: build (${{ matrix.package_platform }})
    strategy:
      matrix:
        os: [windows-latest, ubuntu-latest, macos-latest]
        python_arch: [x64]
        include:
          - os: windows-latest
            package_platform: Windows_32bit
            python_arch: x86
          - os: windows-latest
            package_platform: Windows_64bit
          - os: ubuntu-latest
            package_platform: Linux_64bit
            archive_util: tar
          - os: macos-latest
            package_platform: macOS_64bit
            archive_util: gtar # https://github.com/actions/virtual-environments/issues/2619
    defaults:
      run:
        shell: bash

    runs-on: ${{ matrix.os }}

    steps:
      - name: Checkout mcuboot repository
        uses: actions/checkout@v6
        with:
          repository: mcu-tools/mcuboot
          path: ${{ env.MCUBOOT_PATH }}
          ref: v1.8.0 # the patches apply only to this version

      - name: Checkout imgtool-packing repository
        uses: actions/checkout@v6
        with:
          path: ${{ env.IMGTOOL_PACKING_PATH }}

      - name: Set the version
        working-directory: ${{ env.IMGTOOL_PACKING_PATH }}/patches/
        run: perl -pi -e "s/ARDUINO_VERSION_PLACEHOLDER/${GITHUB_REF/refs\/tags\//}/g" 0008-Imgtool-Append-arduino-to-version-string.patch

      - name: Apply patches
        working-directory: ${{ env.MCUBOOT_PATH }}/scripts/
        run: git apply -v "${{ env.IMGTOOL_PACKING_PATH }}/patches/"*.patch

      - name: Set up Python ${{ env.PYTHON_VERSION }}
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          architecture: ${{ matrix.python_arch }}

      - name: Upgrade PIP
        run: python -m pip install --upgrade pip setuptools wheel

      - name: Install python dependencies
        working-directory: ${{ env.MCUBOOT_PATH }}/scripts/
        run: pip install -r requirements.txt

      - name: Install pyinstaller
        run: pip install pyinstaller==5.0.1

      - name: Build
        if: runner.os != 'macOS'
        working-directory: ${{ env.MCUBOOT_PATH }}/scripts/
        run: pyinstaller --onefile main.py -n ${{ env.PROJECT_NAME }}

      - name: Build macOS
        if: runner.os == 'macOS'
        working-directory: ${{ env.MCUBOOT_PATH }}/scripts/
        run: pyinstaller --osx-entitlements-file ${{ env.IMGTOOL_PACKING_PATH }}/entitlements.plist --onefile main.py -n ${{ env.PROJECT_NAME }}

      - name: Package
        if: runner.os == 'Windows'
        working-directory: ${{ env.MCUBOOT_PATH }}/scripts/${{ env.DIST_DIR }}
        run: | # we need to create the subdir where to place binaries
          mkdir ${{ env.PROJECT_NAME }}_${{ matrix.package_platform }}
          mv -v ./${{ env.PROJECT_NAME }}.exe ${{ env.PROJECT_NAME }}_${{ matrix.package_platform }}
          mv -v "${{ env.IMGTOOL_PACKING_PATH }}/LICENSE.txt" ${{ env.PROJECT_NAME }}_${{ matrix.package_platform }}
          7z a ${{ env.PROJECT_NAME }}_${GITHUB_REF/refs\/tags\//}_${{ matrix.package_platform }}.zip ${{ env.PROJECT_NAME }}_${{ matrix.package_platform }}

      - name: Package
        if: runner.os != 'Windows'
        working-directory: ${{ env.MCUBOOT_PATH }}/scripts/${{ env.DIST_DIR }}
        run: | # we need to create the subdir where to place binaries
          mkdir ${{ env.PROJECT_NAME }}_${{ matrix.package_platform }}
          chmod +x ./${{ env.PROJECT_NAME }}
          mv -v ./${{ env.PROJECT_NAME }} ${{ env.PROJECT_NAME }}_${{ matrix.package_platform }}
          mv -v ${{ env.IMGTOOL_PACKING_PATH }}/LICENSE.txt ${{ env.PROJECT_NAME }}_${{ matrix.package_platform }}
          ${{ matrix.archive_util }} -cz ${{ env.PROJECT_NAME }}_${{ matrix.package_platform }} -f ${{ env.PROJECT_NAME }}_${GITHUB_REF/refs\/tags\//}_${{ matrix.package_platform }}.tar.gz

      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          if-no-files-found: error
          name: ${{ env.ARTIFACT_PREFIX }}${{ matrix.package_platform }}
          path: ${{ env.MCUBOOT_PATH }}/scripts/dist/${{ env.PROJECT_NAME }}_*

  build-crosscompile:
    name: build (${{ matrix.package_platform }})
    strategy:
      matrix:
        package_platform: [Linux_32bit, Linux_ARMv6, Linux_ARM64]
        include:
          - package_platform: Linux_32bit
            docker_image: i386/python:3.7-buster
          - package_platform: Linux_ARMv6
            docker_image: arm32v5/python:3.7-buster # buster is not available for arm32v6, but should be backward compatible
          - package_platform: Linux_ARM64
            docker_image: arm64v8/python:3.7-buster

    runs-on: ubuntu-latest
    steps:
      - name: Checkout mcuboot repository
        uses: actions/checkout@v6
        with:
          repository: mcu-tools/mcuboot
          path: ${{ env.MCUBOOT_PATH }}
          ref: v1.8.0 # the patches apply only to this version

      - name: Checkout imgtool-packing repository
        uses: actions/checkout@v6
        with:
          path: ${{ env.IMGTOOL_PACKING_PATH }}

      - name: Set the version
        working-directory: ${{ env.IMGTOOL_PACKING_PATH }}/patches/
        run: perl -pi -e "s/ARDUINO_VERSION_PLACEHOLDER/${GITHUB_REF/refs\/tags\//}/g" 0008-Imgtool-Append-arduino-to-version-string.patch

      - name: Apply patches
        working-directory: ${{ env.MCUBOOT_PATH }}/scripts/
        run: git apply -v "${{ env.IMGTOOL_PACKING_PATH }}/patches/"*.patch

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2
        with:
          image: tonistiigi/binfmt:latest
          platforms: all

      - name: Copy build script
        working-directory: ${{ env.IMGTOOL_PACKING_PATH }}
        run: cp build.sh ${{ env.MCUBOOT_PATH }}/scripts/imgtool/

      # Docker containers used to crosscompile:
      # https://github.com/docker-library/official-images#architectures-other-than-amd64
      - name: Build
        working-directory: ${{ env.MCUBOOT_PATH }}/scripts
        run: docker run -v "$(pwd)":/workspace ${{ matrix.docker_image }} ./workspace/imgtool/build.sh

      - name: Smoke test build
        working-directory: ${{ env.MCUBOOT_PATH }}/scripts
        run: docker run -v "$(pwd)":/workspace ${{ matrix.docker_image }} ./workspace/dist/imgtool

      - name: Package
        working-directory: ${{ env.MCUBOOT_PATH }}/scripts/${{ env.DIST_DIR }}
        run: | # we need to create the subdir where to place binaries
          sudo mkdir ${{ env.PROJECT_NAME }}_${{ matrix.package_platform }}
          sudo chmod +x ./${{ env.PROJECT_NAME }}
          sudo mv -v ./${{ env.PROJECT_NAME }} ${{ env.PROJECT_NAME }}_${{ matrix.package_platform }}
          sudo mv -v ${{ env.IMGTOOL_PACKING_PATH }}/LICENSE.txt ${{ env.PROJECT_NAME }}_${{ matrix.package_platform }}
          sudo tar -cz ${{ env.PROJECT_NAME }}_${{ matrix.package_platform }} -f ${{ env.PROJECT_NAME }}_${GITHUB_REF/refs\/tags\//}_${{ matrix.package_platform }}.tar.gz #dist dir is created in the container with different user/grp

      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          if-no-files-found: error
          name: ${{ env.ARTIFACT_PREFIX }}${{ matrix.package_platform }}
          path: ${{ env.MCUBOOT_PATH }}/scripts/dist/${{ env.PROJECT_NAME }}_*

  notarize-macos:
    runs-on: macos-latest
    needs: build

    env:
      ARTIFACT_SUFFIX: macOS_64bit

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Download non-notarized artifact
        uses: actions/download-artifact@v8
        with:
          name: ${{ env.ARTIFACT_PREFIX }}${{ env.ARTIFACT_SUFFIX }}
          path: ${{ env.DIST_DIR }}

      - name: Remove non-notarized artifact
        uses: geekyeggo/delete-artifact@v5
        with:
          name: ${{ env.ARTIFACT_PREFIX }}${{ env.ARTIFACT_SUFFIX }}

      - name: Import Code-Signing Certificates
        env:
          KEYCHAIN: "sign.keychain"
          INSTALLER_CERT_MAC_PATH: "/tmp/ArduinoCerts2020.p12"
          KEYCHAIN_PASSWORD: keychainpassword # Arbitrary password for a keychain that exists only for the duration of the job, so not secret
        run: |
          echo "${{ secrets.INSTALLER_CERT_MAC_P12 }}" | base64 --decode > "${{ env.INSTALLER_CERT_MAC_PATH }}"
          security create-keychain -p "${{ env.KEYCHAIN_PASSWORD }}" "${{ env.KEYCHAIN }}"
          security default-keychain -s "${{ env.KEYCHAIN }}"
          security unlock-keychain -p "${{ env.KEYCHAIN_PASSWORD }}" "${{ env.KEYCHAIN }}"
          security import \
            "${{ env.INSTALLER_CERT_MAC_PATH }}" \
            -k "${{ env.KEYCHAIN }}" \
            -f pkcs12 \
            -A \
            -T "/usr/bin/codesign" \
            -P "${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}"
          security set-key-partition-list \
            -S apple-tool:,apple: \
            -s \
            -k "${{ env.KEYCHAIN_PASSWORD }}" \
            "${{ env.KEYCHAIN }}"

      - name: Install gon for code signing and app notarization
        run: |
          wget -q https://github.com/Bearer/gon/releases/download/v0.0.27/gon_macos.zip
          unzip gon_macos.zip -d /usr/local/bin

      - name: Sign and notarize binary
        env:
          AC_USERNAME: ${{ secrets.AC_USERNAME }}
          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
          AC_PROVIDER: ${{ secrets.AC_PROVIDER }}
        run: |
          gon gon.config.hcl

      - name: Re-package binary
        working-directory: ${{ env.DIST_DIR }}
        # This step performs the following:
        # 1. Repackage the signed binary replaced in place by Gon (ignoring the output zip file)
        run: |
          # GitHub's upload/download-artifact@v2 actions don't preserve file permissions,
          # so we need to add execution permission back until the action is made to do this.
          chmod +x "${{ env.PROJECT_NAME }}_macOS_64bit/${{ env.PROJECT_NAME }}"
          TAG="${GITHUB_REF/refs\/tags\//}"
          PACKAGE_FILENAME="${{ env.PROJECT_NAME }}_${TAG}_macOS_64bit.tar.gz"
          tar -czvf "${PACKAGE_FILENAME}" "${{ env.PROJECT_NAME }}_macOS_64bit"

      - name: Upload notarized artifact
        uses: actions/upload-artifact@v7
        with:
          if-no-files-found: error
          name: ${{ env.ARTIFACT_PREFIX }}${{ env.ARTIFACT_SUFFIX }}
          path: ${{ env.DIST_DIR }}

  create-release:
    runs-on: ubuntu-latest
    environment: production
    needs: [build, build-crosscompile, notarize-macos]
    permissions:
      contents: write
      id-token: write # This is required for requesting the JWT

    steps:
      - name: Checkout repository # we need package_index.template
        uses: actions/checkout@v6

      - name: Download artifact
        uses: actions/download-artifact@v8
        with:
          merge-multiple: true
          path: ${{ env.DIST_DIR }}
          pattern: ${{ env.ARTIFACT_PREFIX }}*

      - name: Identify Prerelease
        # This is a workaround while waiting for create-release action
        # to implement auto pre-release based on tag
        id: prerelease
        run: |
          wget -q -P /tmp https://github.com/fsaintjacques/semver-tool/archive/3.2.0.zip
          unzip -p /tmp/3.2.0.zip semver-tool-3.2.0/src/semver >/tmp/semver && chmod +x /tmp/semver
          if [[ "$(/tmp/semver get prerel "${GITHUB_REF/refs\/tags\//}")" ]]; then echo "::set-output name=IS_PRE::true"; fi

      - name: Prepare artifacts for the release and handle package_index
        run: |
          package_index=`cat package_index.template | sed s/%%VERSION%%/${GITHUB_REF/refs\/tags\//}/`
          declare -a target_folders=("Windows_32bit" "Windows_64bit" "Linux_64bit" "macOS_64bit" "Linux_32bit" "Linux_ARMv6" "Linux_ARM64")
          cd dist
          for folder in "${target_folders[@]}"
          do
            if [[ $folder = "Windows_32bit" || $folder = "Windows_64bit" ]]; then
              ARCHIVE_NAME=${{ env.PROJECT_NAME }}_${GITHUB_REF/refs\/tags\//}_${folder}.zip
            else
              ARCHIVE_NAME=${{ env.PROJECT_NAME }}_${GITHUB_REF/refs\/tags\//}_${folder}.tar.gz
            fi
            T_OS=`echo ${folder} | awk '{print toupper($0)}'`
            SHASUM=`sha256sum ${ARCHIVE_NAME} | cut -f1 -d" "`
            SIZE=`stat --printf="%s" ${ARCHIVE_NAME}`
            package_index=`echo "$package_index" |
              sed s/%%FILENAME_${T_OS}%%/${ARCHIVE_NAME}/ |
              sed s/%%FILENAME_${T_OS}%%/${ARCHIVE_NAME}/ |
              sed s/%%SIZE_${T_OS}%%/${SIZE}/ |
              sed s/%%SHA_${T_OS}%%/${SHASUM}/`
          done
          cd ..
          echo ================== CUT ME HERE =====================
          echo "${package_index}"
          echo "${package_index}" > dist/package_index_draft.json

      - name: Create Github Release and upload artifacts
        uses: ncipollo/release-action@v1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          draft: false
          prerelease: ${{ steps.prerelease.outputs.IS_PRE }}
          # NOTE: "Artifact is a directory" warnings are expected and don't indicate a problem
          # (all the files we need are in the DIST_DIR root)
          artifacts: ${{ env.DIST_DIR }}/*

      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          role-session-name: "github_${{ env.PROJECT_NAME }}"
          aws-region: ${{ env.AWS_REGION }}

      - name: Upload release files on Arduino downloads servers
        run: aws s3 sync ${{ env.DIST_DIR }} s3://${{ secrets.DOWNLOADS_BUCKET }}${{ env.AWS_PLUGIN_TARGET }}