Skip to content

Commit ef8e38e

Browse files
ldenningtonldennington
authored
release: sign Linux tarball and .NET tool (#985)
Update release workflow to: 1. Split the Linux `build.sh` script and the .NET tool `pack-tool.sh` script to more closely align with our compilation and packaging for macOS. 2. Sign Linux tarball in addition to the Debian package.and sign/validate/publish .NET tool `.nupkg`. 3. Sign/validate/publish the .NET tool `.nupkg` with every release. I validated these changes with [this successful workflow run](https://github.com/ldennington/git-credential-manager/actions/runs/3651681219) in my fork.
2 parents 79087fd + 80cc677 commit ef8e38e

File tree

6 files changed

+554
-262
lines changed

6 files changed

+554
-262
lines changed

‎.github/workflows/release.yml

Lines changed: 210 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -378,29 +378,28 @@ jobs:
378378
- name: Lay out
379379
run: |
380380
mkdir -p linux-build/deb linux-build/tar
381-
mv out/linux/Packaging.Linux/deb/Release/*.deb linux-build/deb
382-
mv out/linux/Packaging.Linux/tar/Release/*.tar.gz linux-build/tar
381+
mv out/linux/Packaging.Linux/Release/deb/*.deb linux-build/deb
382+
mv out/linux/Packaging.Linux/Release/tar/*.tar.gz linux-build/tar
383383
384384
- name: Upload artifacts
385385
uses: actions/upload-artifact@v3
386386
with:
387-
name: linux-build
387+
name: tmp.linux-build
388388
path: |
389389
linux-build
390390
391391
linux-sign:
392-
name: Sign Debian package
392+
name: Sign Linux tarball and Debian package
393+
needs: linux-build
393394
# ESRP service requires signing to run on Windows
394395
runs-on: windows-latest
395-
needs: linux-build
396396
steps:
397397
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
398398

399399
- name: Download artifacts
400400
uses: actions/download-artifact@v3
401401
with:
402-
name: linux-build
403-
path: artifacts
402+
name: tmp.linux-build
404403

405404
- uses: azure/login@v1
406405
with:
@@ -422,14 +421,197 @@ jobs:
422421
LINUX_KEY_CODE: ${{ secrets.LINUX_KEY_CODE }}
423422
LINUX_OP_CODE: ${{ secrets.LINUX_OPERATION_CODE }}
424423
run: |
425-
python .github/run_esrp_signing.py artifacts/deb $env:LINUX_KEY_CODE $env:LINUX_OP_CODE
424+
python .github/run_esrp_signing.py deb $env:LINUX_KEY_CODE $env:LINUX_OP_CODE
425+
python .github/run_esrp_signing.py tar $env:LINUX_KEY_CODE $env:LINUX_OP_CODE
426426
427-
- name: Upload signed Debian package
427+
- name: Upload signed tarball and Debian package
428428
uses: actions/upload-artifact@v3
429429
with:
430430
name: linux-sign
431431
path: |
432432
signed
433+
434+
# ================================
435+
# .NET Tool
436+
# ================================
437+
dotnet-tool-build:
438+
name: Build .NET tool
439+
runs-on: ubuntu-latest
440+
steps:
441+
- uses: actions/checkout@v3
442+
with:
443+
fetch-depth: 0 # Indicate full history so Nerdbank.GitVersioning works.
444+
445+
- name: Setup .NET
446+
uses: actions/[email protected]
447+
with:
448+
dotnet-version: 6.0.201
449+
450+
- uses: dotnet/nbgv@master
451+
with:
452+
setCommonVars: true
453+
454+
- name: Build .NET tool
455+
run: |
456+
src/shared/DotnetTool/layout.sh --configuration=Release
457+
458+
- name: Upload .NET tool artifacts
459+
uses: actions/upload-artifact@v3
460+
with:
461+
name: tmp.dotnet-tool-build
462+
path: |
463+
out/shared/DotnetTool/nupkg/Release
464+
465+
dotnet-tool-payload-sign:
466+
name: Sign .NET tool payload
467+
# ESRP service requires signing to run on Windows
468+
runs-on: windows-latest
469+
needs: dotnet-tool-build
470+
steps:
471+
- name: Check out repository
472+
uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
473+
474+
- name: Download payload
475+
uses: actions/download-artifact@v3
476+
with:
477+
name: tmp.dotnet-tool-build
478+
479+
- name: Zip unsigned payload
480+
shell: pwsh
481+
run: |
482+
Compress-Archive -Path payload payload/payload.zip
483+
cd payload
484+
Get-ChildItem -Exclude payload.zip | Remove-Item -Recurse -Force
485+
486+
- uses: azure/login@v1
487+
with:
488+
creds: ${{ secrets.AZURE_CREDENTIALS }}
489+
490+
- name: Set up ESRP client
491+
shell: pwsh
492+
env:
493+
AZURE_VAULT: ${{ secrets.AZURE_VAULT }}
494+
AUTH_CERT: ${{ secrets.AZURE_VAULT_AUTH_CERT_NAME }}
495+
REQUEST_SIGNING_CERT: ${{ secrets.AZURE_VAULT_REQUEST_SIGNING_CERT_NAME }}
496+
run: |
497+
.github\set_up_esrp.ps1
498+
499+
- name: Run ESRP client
500+
shell: pwsh
501+
env:
502+
AZURE_AAD_ID: ${{ secrets.AZURE_AAD_ID }}
503+
NUGET_KEY_CODE: ${{ secrets.NUGET_KEY_CODE }}
504+
NUGET_OPERATION_CODE: ${{ secrets.NUGET_OPERATION_CODE }}
505+
run: |
506+
python .github\run_esrp_signing.py payload `
507+
$env:NUGET_KEY_CODE $env:NUGET_OPERATION_CODE
508+
509+
- name: Lay out signed payload, images, and symbols
510+
shell: bash
511+
run: |
512+
mkdir dotnet-tool-payload-sign
513+
rm -rf payload
514+
mv images payload.sym -t dotnet-tool-payload-sign
515+
unzip signed/payload.zip -d dotnet-tool-payload-sign
516+
517+
- name: Upload signed payload
518+
uses: actions/upload-artifact@v3
519+
with:
520+
name: dotnet-tool-payload-sign
521+
path: |
522+
dotnet-tool-payload-sign
523+
524+
dotnet-tool-pack:
525+
name: Package .NET tool
526+
runs-on: ubuntu-latest
527+
needs: dotnet-tool-payload-sign
528+
steps:
529+
- uses: actions/checkout@v3
530+
with:
531+
fetch-depth: 0 # Indicate full history so Nerdbank.GitVersioning works.
532+
533+
- name: Download signed payload
534+
uses: actions/download-artifact@v3
535+
with:
536+
name: dotnet-tool-payload-sign
537+
path: signed
538+
539+
- name: Setup .NET
540+
uses: actions/[email protected]
541+
with:
542+
dotnet-version: 6.0.201
543+
544+
- uses: dotnet/nbgv@master
545+
with:
546+
setCommonVars: true
547+
548+
- name: Package tool
549+
run: |
550+
src/shared/DotnetTool/pack.sh --configuration=Release \
551+
--version=$GitBuildVersionSimple --publish-dir=$(pwd)/signed
552+
553+
- name: Upload unsigned package
554+
uses: actions/upload-artifact@v3
555+
with:
556+
name: tmp.dotnet-tool-package-unsigned
557+
path: |
558+
out/shared/DotnetTool/nupkg/Release/*.nupkg
559+
560+
dotnet-tool-sign:
561+
name: Sign .NET tool package
562+
# ESRP service requires signing to run on Windows
563+
runs-on: windows-latest
564+
needs: dotnet-tool-pack
565+
steps:
566+
- name: Check out repository
567+
uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
568+
569+
- name: Download unsigned package
570+
uses: actions/download-artifact@v3
571+
with:
572+
name: tmp.dotnet-tool-package-unsigned
573+
path: nupkg
574+
575+
- name: Zip unsigned package
576+
shell: pwsh
577+
run: |
578+
Compress-Archive -Path nupkg/*.nupkg nupkg/gcm-nupkg.zip
579+
cd nupkg
580+
Get-ChildItem -Exclude gcm-nupkg.zip | Remove-Item -Recurse -Force
581+
582+
- uses: azure/login@v1
583+
with:
584+
creds: ${{ secrets.AZURE_CREDENTIALS }}
585+
586+
- name: Set up ESRP client
587+
shell: pwsh
588+
env:
589+
AZURE_VAULT: ${{ secrets.AZURE_VAULT }}
590+
AUTH_CERT: ${{ secrets.AZURE_VAULT_AUTH_CERT_NAME }}
591+
REQUEST_SIGNING_CERT: ${{ secrets.AZURE_VAULT_REQUEST_SIGNING_CERT_NAME }}
592+
run: |
593+
.github\set_up_esrp.ps1
594+
595+
- name: Sign package
596+
shell: pwsh
597+
env:
598+
AZURE_AAD_ID: ${{ secrets.AZURE_AAD_ID }}
599+
NUGET_KEY_CODE: ${{ secrets.NUGET_KEY_CODE }}
600+
NUGET_OPERATION_CODE: ${{ secrets.NUGET_OPERATION_CODE }}
601+
run: |
602+
python .github\run_esrp_signing.py nupkg $env:NUGET_KEY_CODE $env:NUGET_OPERATION_CODE
603+
604+
- name: Unzip signed package
605+
shell: pwsh
606+
run: |
607+
Expand-Archive -LiteralPath signed\gcm-nupkg.zip -DestinationPath .\signed -Force
608+
Remove-Item signed\gcm-nupkg.zip -Force
609+
610+
- name: Publish signed package
611+
uses: actions/upload-artifact@v3
612+
with:
613+
name: dotnet-tool-sign
614+
path: signed/*.nupkg
433615

434616
# ================================
435617
# Validate
@@ -452,8 +634,11 @@ jobs:
452634
# Windows due to its placement on the PATH. For this reason, we use
453635
# the full path to our installation to validate the Windows version.
454636
command: "$PROGRAMFILES (x86)/Git Credential Manager/git-credential-manager.exe"
637+
- os: ubuntu-latest
638+
artifact: dotnet-tool-sign
639+
command: git-credential-manager
455640
runs-on: ${{ matrix.component.os }}
456-
needs: [ osx-sign, win-sign, linux-sign ]
641+
needs: [ osx-sign, win-sign, linux-sign, dotnet-tool-sign ]
457642
steps:
458643
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
459644
with:
@@ -479,7 +664,7 @@ jobs:
479664
}
480665
481666
- name: Install Linux
482-
if: contains(matrix.component.os, 'ubuntu')
667+
if: contains(matrix.component.os, 'ubuntu') && contains(matrix.component.artifact, 'linux')
483668
run: |
484669
debpath=$(find ./*.deb)
485670
sudo apt install $debpath
@@ -491,6 +676,13 @@ jobs:
491676
# Only validate x64, given arm64 agents are not available
492677
pkgpath=$(find ./*.pkg)
493678
sudo installer -pkg $pkgpath -target /
679+
680+
- name: Install .NET tool
681+
if: contains(matrix.component.os, 'ubuntu') && contains(matrix.component.artifact, 'dotnet-tool')
682+
run: |
683+
nupkgpath=$(find ./*.nupkg)
684+
dotnet tool install -g --add-source $(dirname "$nupkgpath") git-credential-manager
685+
"${{ matrix.component.command }}" configure
494686
495687
- name: Validate
496688
shell: bash
@@ -596,33 +788,12 @@ jobs:
596788
597789
// Upload Linux artifacts
598790
uploadDirectoryToRelease('linux-sign'),
599-
uploadDirectoryToRelease('linux-build/tar')
600-
]);
601791
602-
create-dotnet-tool:
603-
name: Publish dotnet tool
604-
runs-on: ubuntu-latest
605-
steps:
606-
- uses: actions/checkout@v3
607-
with:
608-
fetch-depth: 0 # Indicate full history so Nerdbank.GitVersioning works.
609-
610-
- name: Setup .NET
611-
uses: actions/[email protected]
612-
with:
613-
dotnet-version: 6.0.201
614-
615-
- uses: dotnet/nbgv@master
616-
with:
617-
setCommonVars: true
618-
619-
- name: Package tool
620-
run: |
621-
src/shared/DotnetTool/pack-tool.sh \
622-
--version=$GitBuildVersionSimple \
623-
--configuration=Release
792+
// Upload .NET tool package
793+
uploadDirectoryToRelease('dotnet-tool-sign'),
794+
]);
624795
625-
- name: Publish tool
626-
run: |
627-
dotnet nuget push ./out/shared/DotnetTool/nupkg/Release/*.nupkg \
628-
--api-key ${{ secrets.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json
796+
- name: Publish .NET tool to nuget.org
797+
run: |
798+
dotnet nuget push dotnet-tool-sign/signed/*.nupkg \
799+
--api-key ${{ secrets.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json

0 commit comments

Comments
 (0)