WIP - Signing CD Action

sillsdev · Apr 18, 2024 · 67f887a · 67f887a
1 parent fd0ea8a
commit 67f887a
Show file tree

Hide file tree

Showing 4 changed files with 79 additions and 13 deletions.
diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
@@ -5,6 +5,11 @@ on:
   pull_request:
     branches: ["develop", "master"]
   workflow_dispatch:
+    inputs:
+      releaseType:
+        description: 'Alpha, Beta, Stable used to stamp release artifacts'
+        required: true
+        default: 'Alpha'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -38,15 +43,15 @@ jobs:
       - name: Add msbuild to PATH
         uses: microsoft/setup-msbuild@v2
 
+      # We need the dotnet runtime to execute overcrowdin
       - name: Setup dotnet
         uses: actions/setup-dotnet@v3
         with:
-          dotnet-version: | 
-            2.1.x
-            3.1.x
-            5.0.x
+          dotnet-version:
+            8.0.x
         if: github.event_name != 'pull_request'
 
+      # If we are just doing a CI build we don't need real localizations, but the location must exist
       - name: Add Fake Localizations for CI
         shell: bash
         run: echo > DistFiles/localizations/empty.xlf
@@ -62,11 +67,13 @@ jobs:
         shell: cmd
         run: msbuild build\FLExBridge.proj /t:Test
 
+      # All the following are used only when building an installer after a merge
       - name: Install Latest Overcrowdin
         shell: cmd
         run: dotnet tool install -g overcrowdin
         if: github.event_name != 'pull_request'
 
+
       - name: Restore L10n Packages
         shell: cmd
         run: |
@@ -81,7 +88,42 @@ jobs:
           msbuild l10n.proj /t:GetLatestL10ns;CopyL10nsToDistFiles
         if: github.event_name != 'pull_request'
 
-      - name: Build Installer
+      - name: Build Msi
         shell: cmd
-        run: msbuild build/FLExBridge.proj /t:Installer /p:UploadFolder=Alpha
+        run: msbuild build/FLExBridge.proj /t:CleanMasterOutputDir;PreparePublishingArtifactsInternal;BuildProductBaseMsi /p:UploadFolder=${{ inputs.environment || 'Alpha' }}
         if: github.event_name != 'pull_request'
+
+      - name: Find versioned msi file
+        id: find_file
+        run: |
+          find . -name "FLExBridge*.msi" > files.txt
+          
+          # Read the first matching file found (should only be one) and store it as an output variable
+          head -n 1 files.txt > first_file.txt
+          echo "::set-output name=fb_msi_path::$(cat first_file.txt)"
+
+      - name: Create Msi Digest
+        id: msi-digest
+        uses: sillsdev/codesign/generate-digest@v1
+        with:
+          path: ${{ steps.find_file.outputs.fb_msi_path }}
+          public-cert: ${{ secrets.CODESIGN_LSDEVSECTIGOEV }}
+        if: github.event_name != 'pull_request'
+
+  sign-msi:
+    needs: windows_debug_build_and_test
+    uses: sillsdev/codesign/.github/workflows/sign-digest@v1
+    with:
+      digest: ${{ needs.windows_debug_build_and_test.msi-digest.outputs.digest }}
+    if: github.event_name != 'pull_request'
+
+  build-installer-bundles:
+    needs: [windows_debug_build_and_test, sign-msi]
+    steps:
+    - name: Apply signing to msi
+      uses: sillsdev/codesign/apply-signed-digest@v1
+      with:
+        artifact: ${{ needs.windows_debug_build_and_test.outputs.intermediates }}
+        path: ${{ needs.windows_debug_build_and_test.steps.find_file.outputs.fb_msi_path }}
+        signed-digest: ${{ needs.sign-msi.outputs.signed-digest }}
+    if: github.event_name != 'pull_request'
diff --git a/build/WixPatchableInstaller.targets b/build/WixPatchableInstaller.targets
@@ -50,6 +50,9 @@
 		<AppBuildMasterDir>$(InstallersBaseDir)/$(SafeApplicationName)_Build_Master</AppBuildMasterDir>
 		<BinDirSuffix>objects/$(SafeApplicationName)</BinDirSuffix>
 		<DataDirSuffix>$(BinDirSuffix)_Data</DataDirSuffix>
+		<MsiFile>$(SafeApplicationName)_$(BuildVersion).msi</MsiFile>
+		<BaseBuildDir>$(RootDir)/src/WiXInstaller/BaseInstallerBuild</BaseBuildDir>
+		<BaseBuildArgs>"$(ApplicationName)" $(SafeApplicationName) $(BuildVersion) $(ProductIdGuid) $(UpgradeCodeGuid) "$(AppBuildDir)/$(BinDirSuffix)" "$(AppBuildDir)/$(DataDirSuffix)" $(CopyrightYear) "$(Manufacturer)" $(SafeManufacturer)</BaseBuildArgs>
 	</PropertyGroup>
 
 	<!-- Top Level Targets -->
@@ -184,14 +187,35 @@
 	</UsingTask>
 
 	<!-- Build Wix Product Targets -->
-	<Target Name="BuildProductBaseMsi" DependsOnTargets="GetDotNetFiles; InstallerVersionNumbers">
+
+	<!-- Attempt to build and sign the full installation package. Both the msi, and the Online and Offline bundles -->
+	<Target Name="BuildProductBase" DependsOnTargets="GetDotNetFiles; InstallerVersionNumbers">
+		<Exec WorkingDirectory="$(BaseBuildDir)" Command="buildBaseInstaller.bat $(BaseBuildArgs)" />
+
+		<ItemGroup>
+			<InstallerFiles Include="$(BaseBuildDir)/**/$(SafeApplicationName)_*.exe"/>
+			<InstallerFiles Include="$(BaseBuildDir)/**/$(SafeApplicationName)_*.msi"/>
+		</ItemGroup>
+		<Move SourceFiles="@(InstallerFiles)" DestinationFolder="$(InstallersBaseDir)"/>
+		<!-- The FieldWorks installer wants a stable installer name -->
+		<Move SourceFiles="$(InstallersBaseDir)/$(SafeApplicationName)_$(BuildVersion)_Offline.exe" DestinationFiles="$(InstallersBaseDir)/$(SafeApplicationName)_Offline.exe"/>
+		<Move SourceFiles="$(InstallersBaseDir)/$(SafeApplicationName)_$(BuildVersion)_Online.exe" DestinationFiles="$(InstallersBaseDir)/$(SafeApplicationName)_Online.exe"/>
+		<Move SourceFiles="$(InstallersBaseDir)/$(SafeApplicationName)_$(BuildVersion).msi" DestinationFiles="$(InstallersBaseDir)/$(SafeApplicationName).msi"/>
+	</Target>
+
+	<!-- Build the msi, useful for separating the signing step -->
+	<Target Name="BuildProductBaseMsi" DependsOnTargets="InstallerVersionNumbers">
 		<PropertyGroup>
-			<MsiFile>$(SafeApplicationName)_$(BuildVersion).msi</MsiFile>
-			<BaseBuildDir>$(RootDir)/src/WiXInstaller/BaseInstallerBuild</BaseBuildDir>
-			<BaseBuildArgs>"$(ApplicationName)" $(SafeApplicationName) $(BuildVersion) $(ProductIdGuid) $(UpgradeCodeGuid) "$(AppBuildDir)/$(BinDirSuffix)" "$(AppBuildDir)/$(DataDirSuffix)" $(CopyrightYear) "$(Manufacturer)" $(SafeManufacturer)</BaseBuildArgs>
+			<BuildArgsJIT>"$(ApplicationName)" $(SafeApplicationName) $(BuildVersion) $(ProductIdGuid) $(UpgradeCodeGuid) "$(AppBuildDir)/$(BinDirSuffix)" "$(AppBuildDir)/$(DataDirSuffix)" $(CopyrightYear) "$(Manufacturer)" $(SafeManufacturer)</BuildArgsJIT>
 		</PropertyGroup>
-		<Exec WorkingDirectory="$(BaseBuildDir)" Command="buildBaseInstaller.bat $(BaseBuildArgs)" />
+		<Exec WorkingDirectory="$(BaseBuildDir)" Command="buildMsi.bat $(BuildArgsJIT)" />
+	</Target>
 
+	<Target Name="BuildProductBaseBundles" DependsOnTargets="GetDotNetFiles; InstallerVersionNumbers" >
+		<PropertyGroup>
+			<BuildArgsJIT>"$(ApplicationName)" $(SafeApplicationName) $(BuildVersion) $(ProductIdGuid) $(UpgradeCodeGuid) "$(AppBuildDir)/$(BinDirSuffix)" "$(AppBuildDir)/$(DataDirSuffix)" $(CopyrightYear) "$(Manufacturer)" $(SafeManufacturer)</BuildArgsJIT>
+		</PropertyGroup>
+		<Exec WorkingDirectory="$(BaseBuildDir)" Command="buildexe.bat $(BuildArgsJIT)" />
 		<ItemGroup>
 			<InstallerFiles Include="$(BaseBuildDir)/**/$(SafeApplicationName)_*.exe"/>
 			<InstallerFiles Include="$(BaseBuildDir)/**/$(SafeApplicationName)_*.msi"/>

diff --git a/l10n/l10n.proj b/l10n/l10n.proj
@@ -37,7 +37,7 @@
   </Target>
 
   <Target Name="FetchLatestL10ns" DependsOnTargets="restore">
-    <Exec Command="overcrowdin download -e -f $(FwL10nsZip)" />
+    <Exec Command="overcrowdin download -f $(FwL10nsZip)" />
   </Target>
 
   <Target Name="ProcessL10ns"  DependsOnTargets="restore">

diff --git a/src/LibFLExBridge-ChorusPluginTests/LibFLExBridge-ChorusPluginTests.csproj b/src/LibFLExBridge-ChorusPluginTests/LibFLExBridge-ChorusPluginTests.csproj
@@ -12,7 +12,7 @@
     <PackageReference Include="GitVersion.MsBuild" Version="5.10.3" PrivateAssets="all" />
     <PackageReference Include="NUnit" Version="3.13.3" />
     <PackageReference Include="SIL.Chorus.LibChorus.TestUtilities" Version="$(ChorusVersion)" />
-    <PackageReference Include="SIL.Chorus.Mercurial" Version="6.5.1.25" IncludeAssets="build" />
+    <PackageReference Include="SIL.Chorus.Mercurial" Version="6.5.1.22" IncludeAssets="build" />
   </ItemGroup>
 
   <ItemGroup>