Skip to content

Commit a700d59

Browse files
maennchenmaennchen
committed
Fix Release Signing (#14099)
1 parent 40a73d7 commit a700d59

File tree

1 file changed

+85
-53
lines changed

1 file changed

+85
-53
lines changed

‎.github/workflows/release.yml‎

Lines changed: 85 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -77,42 +77,6 @@ jobs:
7777
otp: ${{ matrix.otp }}
7878
build_docs: ${{ matrix.build_docs }}
7979

80-
- name: "Sign files with Trusted Signing"
81-
if: github.repository == 'elixir-lang/elixir'
82-
uses: azure/[email protected]
83-
with:
84-
azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
85-
azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
86-
azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
87-
endpoint: https://eus.codesigning.azure.net/
88-
trusted-signing-account-name: trusted-signing-elixir
89-
certificate-profile-name: Elixir
90-
files-folder: ${{ github.workspace }}
91-
files-folder-filter: exe
92-
file-digest: SHA256
93-
timestamp-rfc3161: http://timestamp.acs.microsoft.com
94-
timestamp-digest: SHA256
95-
96-
- name: "Attest release .exe provenance"
97-
uses: actions/attest-build-provenance@v2
98-
id: attest-exe-provenance
99-
with:
100-
subject-path: "elixir-otp-${{ matrix.otp }}.exe"
101-
- name: "Copy release .exe provenance"
102-
run: cp "$ATTESTATION" elixir-otp-${{ matrix.otp }}.exe.sigstore
103-
env:
104-
ATTESTATION: "${{ steps.attest-exe-provenance.outputs.bundle-path }}"
105-
106-
- name: "Attest release .zip provenance"
107-
uses: actions/attest-build-provenance@v2
108-
id: attest-zip-provenance
109-
with:
110-
subject-path: "elixir-otp-${{ matrix.otp }}.zip"
111-
- name: "Copy release .zip provenance"
112-
run: cp "$ATTESTATION" elixir-otp-${{ matrix.otp }}.zip.sigstore
113-
env:
114-
ATTESTATION: "${{ steps.attest-zip-provenance.outputs.bundle-path }}"
115-
11680
- name: "Attest docs provenance"
11781
uses: actions/attest-build-provenance@v2
11882
id: attest-docs-provenance
@@ -125,42 +89,108 @@ jobs:
12589
env:
12690
ATTESTATION: "${{ steps.attest-docs-provenance.outputs.bundle-path }}"
12791

128-
- name: Create Release Hashes
129-
run: |
130-
shasum -a 1 elixir-otp-${{ matrix.otp }}.zip > elixir-otp-${{ matrix.otp }}.zip.sha1sum
131-
shasum -a 256 elixir-otp-${{ matrix.otp }}.zip > elixir-otp-${{ matrix.otp }}.zip.sha256sum
132-
shasum -a 1 elixir-otp-${{ matrix.otp }}.exe > elixir-otp-${{ matrix.otp }}.exe.sha1sum
133-
shasum -a 256 elixir-otp-${{ matrix.otp }}.exe > elixir-otp-${{ matrix.otp }}.exe.sha256sum
13492
- name: Create Docs Hashes
13593
if: ${{ matrix.build_docs }}
13694
run: |
13795
shasum -a 1 Docs.zip > Docs.zip.sha1sum
13896
shasum -a 256 Docs.zip > Docs.zip.sha256sum
13997
140-
- name: "Upload release artifacts"
98+
- name: "Upload linux release artifacts"
99+
uses: actions/upload-artifact@v4
100+
with:
101+
name: build-linux-elixir-otp-${{ matrix.otp }}
102+
path: elixir-otp-${{ matrix.otp }}.zip
103+
104+
- name: "Upload windows release artifacts"
141105
uses: actions/upload-artifact@v4
142106
with:
143-
name: elixir-otp-${{ matrix.otp }}
144-
path: elixir-otp-${{ matrix.otp }}*
107+
name: build-windows-elixir-otp-${{ matrix.otp }}
108+
path: elixir-otp-${{ matrix.otp }}.exe
145109

146110
- name: "Upload doc artifacts"
147111
uses: actions/upload-artifact@v4
148112
if: ${{ matrix.build_docs }}
149113
with:
150114
name: Docs
151115
path: Docs.zip*
116+
117+
sign:
118+
needs: [build]
119+
strategy:
120+
fail-fast: true
121+
matrix:
122+
otp: [26, 27]
123+
flavor: [windows, linux]
152124

153-
upload-release:
154-
needs: [build, create_draft_release]
155-
runs-on: windows-2022
125+
env:
126+
RELEASE_FILE: elixir-otp-${{ matrix.otp }}.${{ matrix.flavor == 'linux' && 'zip' || 'exe' }}
127+
128+
runs-on: ${{ matrix.flavor == 'linux' && 'ubuntu-22.04' || 'windows-2022' }}
156129

157130
steps:
158131
- uses: actions/download-artifact@v4
132+
with:
133+
name: build-${{ matrix.flavor }}-elixir-otp-${{ matrix.otp }}
159134

160-
- run: |
161-
mv elixir-otp-*/* .
162-
mv Docs/* .
135+
- name: "Sign files with Trusted Signing"
136+
if: github.repository == 'elixir-lang/elixir' && matrix.flavor == 'windows'
137+
uses: azure/[email protected]
138+
with:
139+
azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
140+
azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
141+
azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
142+
endpoint: https://eus.codesigning.azure.net/
143+
trusted-signing-account-name: trusted-signing-elixir
144+
certificate-profile-name: Elixir
145+
files-folder: ${{ github.workspace }}
146+
files-folder-filter: exe
147+
file-digest: SHA256
148+
timestamp-rfc3161: http://timestamp.acs.microsoft.com
149+
timestamp-digest: SHA256
150+
151+
- name: "Attest release provenance"
152+
uses: actions/attest-build-provenance@v2
153+
id: attest-provenance
154+
with:
155+
subject-path: ${{ env.RELEASE_FILE }}
156+
- name: "Copy release .zip provenance"
163157
shell: bash
158+
run: cp "$ATTESTATION" "${RELEASE_FILE}.sigstore"
159+
env:
160+
ATTESTATION: "${{ steps.attest-provenance.outputs.bundle-path }}"
161+
162+
- name: Create Release Hashes
163+
if: matrix.flavor == 'windows'
164+
shell: pwsh
165+
run: |
166+
$sha1 = Get-FileHash "$env:RELEASE_FILE" -Algorithm SHA1
167+
$sha1.Hash.ToLower() + " " + $env:RELEASE_FILE | Out-File "$env:RELEASE_FILE.sha1sum"
168+
169+
$sha256 = Get-FileHash "$env:RELEASE_FILE" -Algorithm SHA256
170+
$sha256.Hash.ToLower() + " " + $env:RELEASE_FILE | Out-File "$env:RELEASE_FILE.sha256sum"
171+
172+
- name: Create Release Hashes
173+
if: matrix.flavor == 'linux'
174+
shell: bash
175+
run: |
176+
shasum -a 1 "$RELEASE_FILE" > "${RELEASE_FILE}.sha1sum"
177+
shasum -a 256 "$RELEASE_FILE" > "${RELEASE_FILE}.sha256sum"
178+
179+
- name: "Upload linux release artifacts"
180+
uses: actions/upload-artifact@v4
181+
with:
182+
name: sign-${{ matrix.flavor }}-elixir-otp-${{ matrix.otp }}
183+
path: ${{ env.RELEASE_FILE }}*
184+
185+
upload-release:
186+
needs: [create_draft_release, build, sign]
187+
runs-on: ubuntu-22.04
188+
189+
steps:
190+
- uses: actions/download-artifact@v4
191+
with:
192+
pattern: '{sign-*-elixir-otp-*,Docs}'
193+
merge-multiple: true
164194

165195
- name: Upload Pre-built
166196
shell: bash
@@ -188,7 +218,7 @@ jobs:
188218
Docs.zip.sigstore
189219
190220
upload-builds-hex-pm:
191-
needs: build
221+
needs: [build, sign]
192222
runs-on: ubuntu-22.04
193223
concurrency: builds-hex-pm
194224
env:
@@ -202,6 +232,9 @@ jobs:
202232
OTP_GENERIC_VERSION: "25"
203233
steps:
204234
- uses: actions/download-artifact@v4
235+
with:
236+
pattern: '{sign-*-elixir-otp-*,Docs}'
237+
merge-multiple: true
205238

206239
- name: Init purge keys file
207240
run: |
@@ -211,7 +244,6 @@ jobs:
211244
run: |
212245
ref_name=${{ github.ref_name }}
213246
214-
mv elixir-otp-*/* .
215247
for zip in $(find . -type f -name 'elixir-otp-*.zip' | sed 's/^\.\///'); do
216248
dest=${zip/elixir/${ref_name}}
217249
surrogate_key=${dest/.zip$/}

0 commit comments

Comments
 (0)