CI for publishing windows

Author: tanin

.github/workflows/create-release-mac.yml

@@ -22,8 +22,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref_name }}
       - name: Import Signing Certificate
         run: |
           # Create a temporary keychain

.github/workflows/create-release-windows.yml

@@ -1,4 +1,4 @@
-name: create-release-mac
+name: create-release-windows
 
 on:
   push:
@@ -18,66 +18,79 @@ permissions:
 jobs:
   build:
     runs-on: windows-latest
+    defaults:
+      run:
+        shell: msys2 {0}
 
     steps:
+      - uses: msys2/setup-msys2@v2
+        with:
+          update: true
+          install: >-
+            curl
+            git 
+            gcc
+            unzip
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref_name }}
+      - name: Install Node modules
+        run: |
+          export PATH="${PATH}:/c/hostedtoolcache/windows/node/22.21.1/x64"
+          npm install
       - uses: actions/setup-java@v4
         with:
           distribution: temurin
           java-version: '21'
           cache: 'gradle'
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22'
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v3
         with:
           cache-read-only: ${{ github.ref != 'refs/heads/main' }}
       - name: Get version
         id: version
-        run: echo "VERSION=$(./gradlew -q printInternalVersion)" >> "$GITHUB_OUTPUT"
+        run: |
+          version=$(./gradlew -q printInternalVersion)
+          echo "VERSION=$version" >> $GITHUB_OUTPUT
       - name: Validate the tag name
         run: |
-          if [ "${{ github.event_name }}" == "workflow_dispatch" ] && [ ! -z "${{ github.event.inputs.tag }}" ]; then
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" && ! -z "${{ github.event.inputs.tag }}" ]]; then
             TAG=${{ github.event.inputs.tag }}
           else
             TAG=${GITHUB_REF#refs/tags/}
           fi
           if [[ ! "$TAG" =~ ^v ]]; then
             echo "Error: Tag ($TAG) must start with 'v'"
             exit 1
-          fi
+          fi 
           if [[ ! $TAG == v${{ steps.version.outputs.VERSION }} ]]; then
             echo "Error: Git tag version ($TAG) doesn't match project version (v${{ steps.version.outputs.VERSION }})"
             exit 1
           fi
-      - name: Install Node modules
-        run: npm install
       - name: Download CodeSignTool and extract
         run: |
           $ProgressPreference = 'SilentlyContinue'
           New-Item -ItemType Directory -Force -Path "./build-tools/codesign"
           Invoke-WebRequest -Uri "https://www.ssl.com/download/codesigntool-for-windows/" -OutFile "./build-tools/CodeSignTool.zip"
           Expand-Archive -Path "./build-tools/CodeSignTool.zip" -DestinationPath "./build-tools/codesign" -Force
           Remove-Item "./build-tools/CodeSignTool.zip"
-        shell: pwsh
+        shell: powershell
       - name: Download wixtool 3 and extract
         run: |
           $ProgressPreference = 'SilentlyContinue'
           New-Item -ItemType Directory -Force -Path "./build-tools/wixtool"
           Invoke-WebRequest -Uri "https://github.com/wixtoolset/wix3/releases/download/wix3141rtm/wix314-binaries.zip" -OutFile "./build-tools/wix-binaries.zip"
           Expand-Archive -Path "./build-tools/wix-binaries.zip" -DestinationPath "./build-tools/wixtool" -Force
           Remove-Item "./build-tools/wix-binaries.zip"
-        shell: pwsh
+        shell: powershell
       - name: Build an MSI
         run: |
-          export PATH="$PATH:$PWD/build-tools/wixtool"
+          export PATH="${PATH}:$PWD/build-tools/wixtool:/c/hostedtoolcache/windows/node/22.21.1/x64"
+          export CODESIGN_TOOL_DIR="$PWD/build-tools/codesign"
           ./gradlew clean jpackage
         env:
-          CODESIGN_TOOL_DIR: "./build-tools/codesign"
           SSL_COM_USERNAME: ${{ secrets.SSL_COM_USERNAME }}
           SSL_COM_PASSWORD: ${{ secrets.SSL_COM_PASSWORD }}
           SSL_COM_TOTP_SECRET: ${{ secrets.SSL_COM_TOTP_SECRET }}

.github/workflows/publish-mac-testflight.yml

@@ -19,8 +19,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref_name }}
       - name: Import Signing Certificate
         run: |
           # Create a temporary keychain

build.gradle.kts

@@ -1,7 +1,7 @@
 import org.gradle.api.tasks.testing.logging.TestExceptionFormat
+import org.gradle.internal.extensions.stdlib.toDefaultLowerCase
 import java.nio.file.Files
 import java.nio.file.Paths
-import java.util.Locale
 import kotlin.io.path.absolutePathString
 import kotlin.io.path.createTempDirectory
 import kotlin.io.path.isExecutable
@@ -256,8 +256,19 @@ tasks.register("copyJar", Copy::class) {
     from(tasks.jar).into(layout.buildDirectory.dir("jmods"))
 }
 
+private fun maskSecret(args: Array<out String>): List<String> {
+    return args.map { arg ->
+        val sanitized = arg.toDefaultLowerCase()
+        if (sanitized.contains("password") || sanitized.contains("secret")) {
+            "<REDACTED>"
+        } else {
+            arg
+        }
+    }
+}
+
 private fun runCmd(currentDir: File, vararg args: String): String {
-    println("Executing command: ${args.joinToString(" ")}")
+    println("Executing command: ${maskSecret(args).joinToString(" ")} at ${currentDir.absolutePath}")
 
     val output = StringBuilder()
     val process = ProcessBuilder(*args)
@@ -607,21 +618,15 @@ tasks.register("jpackageForWindows") {
         outputAppDir.mkdirs()
 
         runCmd(
-            File(System.getenv("CODESIGN_TOOL_DIR")),
-            "bash",
-            "-c",
-            listOf(
-                "CodeSignTool.bat",
-                "sign",
-                "-input_file_path=${inputs.files.singleFile.absolutePath}",
-                "-output_dir_path=${outputAppDir.absolutePath}",
-                "-program_name=Backdoor",
-                $$"-username=$SSL_COM_USERNAME",
-                $$"-password=$SSL_COM_PASSWORD",
-                $$"-totp_secret=$SSL_COM_TOTP_SECRET",
-            )
-                .joinToString(" ")
-                .replace("\\", "/")
+            File(System.getenv("CODESIGN_TOOL_DIR")).canonicalFile,
+            "CodeSignTool.bat",
+            "sign",
+            "-input_file_path=${inputs.files.singleFile.absolutePath}",
+            "-output_dir_path=${outputAppDir.absolutePath}",
+            "-program_name=Backdoor",
+            "-username=${System.getenv("SSL_COM_USERNAME")}",
+            "-password=${System.getenv("SSL_COM_PASSWORD")}",
+            "-totp_secret=${System.getenv("SSL_COM_TOTP_SECRET")}",
         )
     }
 }

src/main/c/WindowsApi.c

@@ -17,7 +17,7 @@ __declspec(dllexport) char* openFileDialog(long hwnd, bool isSaved) {
 
   ZeroMemory(&ofn, sizeof(ofn));
   ofn.lStructSize = sizeof(ofn);
-  ofn.hwndOwner = (HWND) (uintptr_t) hwnd;
+  ofn.hwndOwner = (HWND) (size_t) hwnd;
   ofn.lpstrFile = szFile;
   ofn.lpstrFile[0] = '\0';
   ofn.nMaxFile = sizeof(szFile);