-
Notifications
You must be signed in to change notification settings - Fork 13
336 lines (282 loc) · 11.9 KB
/
build.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
name: Build Binaries
on:
push:
tags:
- '**'
pull_request:
branches:
- '**'
concurrency:
group: ${{ github.ref }}-${{ github.workflow }}-${{ github.event_name }}
cancel-in-progress: true
permissions:
id-token: write
contents: write
jobs:
build:
name: Build Binaries
runs-on: ${{ matrix.runs-on }}
strategy:
matrix:
include:
- runs-on: ubuntu-latest
artifact-name: cadt-linux-x64
build-command: npm run create-linux-x64-dist
sqlite-path: ./node_modules/sqlite3/build/Release/
- runs-on: macos-latest
artifact-name: cadt-macos-x64
build-command: npm run create-mac-x64-dist
sqlite-path: ./node_modules/sqlite3/build/Release/
- runs-on: windows-2019
artifact-name: cadt-windows-x64
build-command: npm run create-win-x64-dist
sqlite-path: .\node_modules\sqlite3\build\Release\
steps:
- name: Clean workspace
uses: Chia-Network/actions/clean-workspace@main
- name: Checkout Code
uses: actions/checkout@v3
- name: Setup Node 20.x
uses: actions/setup-node@v3
with:
node-version: '20.16'
- name: Install Husky
run: npm install --save-dev husky
- name: Ignore Husky where not compatible
run: npm pkg delete scripts.prepare
if: matrix.runs-on != 'windows-2019'
- name: npm install
run: |
node --version
npm install
- name: npm cache clear --force
run: npm cache clear --force
- name: npm cache rm
run: npm cache rm --force
- name: npm cache verify
run: npm cache verify
- name: install global packages
run: npm i -g @babel/cli @babel/preset-env pkg
- name: create distributions
run: ${{ matrix.build-command }}
- name: Make binary executable
run: |
chmod +x dist/cadt
- name: Copy sqlite3
run: cp ${{ matrix.sqlite-path }}node_sqlite3.node ./dist/
- name: Test for secrets access
id: check_secrets
shell: bash
run: |
unset HAS_SIGNING_SECRET
if [ -n "$SIGNING_SECRET" ]; then HAS_SIGNING_SECRET='true' ; fi
echo "HAS_SIGNING_SECRET=${HAS_SIGNING_SECRET}" >> "$GITHUB_OUTPUT"
env:
SIGNING_SECRET: "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}"
# Windows Code Signing
- name: Sign windows artifacts
if: matrix.runs-on == 'windows-2019' && steps.check_secrets.outputs.HAS_SIGNING_SECRET
uses: chia-network/actions/digicert/windows-sign@main
with:
sm_api_key: ${{ secrets.SM_API_KEY }}
sm_client_cert_file_b64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
sm_client_cert_password: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
sm_code_signing_cert_sha1_hash: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
file: ${{ github.workspace }}/dist/cadt.exe
# Mac .pkg build + sign
- name: Import Apple installer signing certificate
if: matrix.runs-on == 'macos-latest' && steps.check_secrets.outputs.HAS_SIGNING_SECRET
uses: Apple-Actions/import-codesign-certs@v1
with:
keychain-password: ${{ secrets.KEYCHAIN_PASSWORD }}
p12-file-base64: ${{ secrets.APPLE_DEV_ID_INSTALLER }}
p12-password: ${{ secrets.APPLE_DEV_ID_INSTALLER_PASS }}
- name: Import Apple Application signing certificate
if: matrix.runs-on == 'macos-latest' && steps.check_secrets.outputs.HAS_SIGNING_SECRET
uses: Apple-Actions/import-codesign-certs@v1
with:
create-keychain: false # Created when importing the first cert
keychain-password: ${{ secrets.KEYCHAIN_PASSWORD }}
p12-file-base64: ${{ secrets.APPLE_DEV_ID_APP }}
p12-password: ${{ secrets.APPLE_DEV_ID_APP_PASS }}
- name: Prep building Mac .pkg
if: matrix.runs-on == 'macos-latest'
run: |
rm -rf ${{ github.workspace }}/build-scripts/macos/darwin/application || true
cp -r ${{ github.workspace }}/dist ${{ github.workspace }}/build-scripts/macos/application
- name: Sign Mac binaries
if: matrix.runs-on == 'macos-latest' && steps.check_secrets.outputs.HAS_SIGNING_SECRET
run: |
echo "Signing the binaries"
codesign -f -s "Developer ID Application: Chia Network Inc." --timestamp --options=runtime --entitlements ${{ github.workspace }}/build-scripts/macos/entitlements.mac.plist ${{ github.workspace }}/build-scripts/macos/application/cadt
codesign -f -s "Developer ID Application: Chia Network Inc." --timestamp ${{ github.workspace }}/build-scripts/macos/application/node_sqlite3.node
- name: Build Mac .pkg
if: matrix.runs-on == 'macos-latest'
run: |
# Makes the .pkg in ./build-scripts/macos/target/pkg
echo "Building the .pkg"
bash ${{ github.workspace }}/build-scripts/macos/build-macos.sh CADT
mkdir -p ${{ github.workspace }}/build-scripts/macos/target/ready-to-upload
cp ${{ github.workspace }}/build-scripts/macos/target/pkg/CADT-macos-installer-x64.pkg ${{ github.workspace }}/build-scripts/macos/target/ready-to-upload/CADT-macos-installer-x64.pkg
- name: Notarize Mac .pkg
if: matrix.runs-on == 'macos-latest' && steps.check_secrets.outputs.HAS_SIGNING_SECRET
run: |
mkdir -p ${{ github.workspace }}/build-scripts/macos/target/pkg-signed
echo "Signing the .pkg"
productsign --sign "Developer ID Installer: Chia Network Inc." ${{ github.workspace }}/build-scripts/macos/target/pkg/CADT-macos-installer-x64.pkg ${{ github.workspace }}/build-scripts/macos/target/pkg-signed/CADT-macos-installer-x64.pkg
echo "Notarizing the .pkg"
xcrun notarytool submit \
--wait \
--apple-id "${{ secrets.APPLE_NOTARIZE_USERNAME }}" \
--password "${{ secrets.APPLE_NOTARIZE_PASSWORD }}" \
--team-id "${{ secrets.APPLE_TEAM_ID }}" \
"${{ github.workspace }}/build-scripts/macos/target/pkg-signed/CADT-macos-installer-x64.pkg"
rm -f ${{ github.workspace }}/build-scripts/macos/target/ready-to-upload/*
mv ${{ github.workspace }}/build-scripts/macos/target/pkg-signed/CADT-macos-installer-x64.pkg ${{ github.workspace }}/build-scripts/macos/target/ready-to-upload/
- name: Upload Mac Installer
if: matrix.runs-on == 'macos-latest'
uses: actions/upload-artifact@v3
with:
name: cadt-mac-installer
path: ${{ github.workspace }}/build-scripts/macos/target/ready-to-upload
- name: Upload artifacts
uses: actions/upload-artifact@v3
with:
name: ${{ matrix.artifact-name }}
path: ${{ github.workspace }}/dist
build-linux-arm64:
name: Build Linux ARM64 Binaries
runs-on: ubuntu-latest
steps:
- name: Set up QEMU
uses: docker/setup-qemu-action@v2
with:
platforms: arm64
- uses: Chia-Network/actions/clean-workspace@main
- name: Checkout Code
uses: actions/checkout@v3
- name: Determine npm cache key
id: npm-cache
run: |
CACHE_KEY=node-linux-arm64-$(shasum package.json | awk '{ print $1 }')-$(shasum package-lock.json | awk '{ print $1 }')
echo "CACHE_KEY=$CACHE_KEY" >> $GITHUB_OUTPUT
- name: Setup NPM Cache
uses: actions/cache@v3
with:
path: node_modules
key: ${{ steps.npm-cache.outputs.CACHE_KEY }}
- name: Build arm 64 dist
run: |
mkdir pkgcache
docker run --rm --platform linux/arm64 -v $(pwd):/app -w /app -e PKG_CACHE_PATH=pkgcache node:20.16 /bin/bash -c "npm pkg delete scripts.prepare && npm install && npm i -g @babel/cli @babel/preset-env pkg && npm run create-linux-arm64-dist"
- name: Copy sqlite3
run: |
sudo cp ./node_modules/sqlite3/build/Release/node_sqlite3.node ./dist/
- name: Upload artifacts
uses: actions/upload-artifact@v3
with:
name: cadt-linux-arm64
path: ${{ github.workspace }}/dist
debs:
name: Build ${{ matrix.name }} deb
runs-on: ubuntu-latest
needs:
- build
- build-linux-arm64
strategy:
matrix:
include:
- name: cadt-linux-x64
platform: amd64
- name: cadt-linux-arm64
platform: arm64
steps:
- name: Checkout Code
uses: actions/checkout@v3
- name: Download Linux artifacts
uses: actions/download-artifact@v3
with:
name: ${{ matrix.name }}
path: ${{ matrix.name }}
- name: Get tag name
id: tag-name
run: |
echo "TAGNAME=$(echo $GITHUB_REF | cut -d / -f 3)" >> $GITHUB_OUTPUT
- name: Build .deb
env:
CADT_VERSION: ${{ steps.tag-name.outputs.TAGNAME }}
PLATFORM: ${{ matrix.platform }}
run: |
pip install j2cli
CLI_DEB_BASE="cadt_${{ steps.tag-name.outputs.TAGNAME }}-1_${PLATFORM}"
mkdir -p "deb/$CLI_DEB_BASE/opt/cadt"
mkdir -p "deb/$CLI_DEB_BASE/usr/bin"
mkdir -p "deb/$CLI_DEB_BASE/etc/systemd/system"
mkdir -p "deb/$CLI_DEB_BASE/DEBIAN"
j2 -o "deb/$CLI_DEB_BASE/DEBIAN/control" build-scripts/deb/control.j2
cp -r ${{ matrix.name }}/* "deb/$CLI_DEB_BASE/opt/cadt/"
cp build-scripts/deb/[email protected] deb/$CLI_DEB_BASE/etc/systemd/system/[email protected]
chmod +x deb/$CLI_DEB_BASE/opt/cadt/cadt
ln -s ../../opt/cadt/cadt "deb/$CLI_DEB_BASE/usr/bin/cadt"
dpkg-deb --build --root-owner-group "deb/$CLI_DEB_BASE"
- name: Upload deb
uses: actions/upload-artifact@v3
with:
name: ${{ matrix.name }}-deb
path: ${{ github.workspace }}/deb/*.deb
release:
runs-on: ubuntu-latest
if: startsWith(github.ref, 'refs/tags/')
needs:
- debs
steps:
- name: Download Windows artifacts
uses: actions/download-artifact@v3
with:
name: cadt-windows-x64
path: cadt-windows-x64
- name: Download MacOS artifacts
uses: actions/download-artifact@v3
with:
name: cadt-mac-installer
path: cadt-mac-installer
- name: Download Linux artifacts
uses: actions/download-artifact@v3
with:
name: cadt-linux-x64
path: cadt-linux-x64
- name: Download Linux x64 deb
uses: actions/download-artifact@v3
with:
name: cadt-linux-x64-deb
path: cadt-linux-x64-deb
- name: Download Linux arm64 deb
uses: actions/download-artifact@v3
with:
name: cadt-linux-arm64-deb
path: cadt-linux-arm64-deb
- name: Get tag name
id: tag-name
run: |
echo "TAGNAME=$(echo $GITHUB_REF | cut -d / -f 3)" >>$GITHUB_OUTPUT
- name: Create zips
run: |
zip -r cadt-windows-x64-${{ steps.tag-name.outputs.TAGNAME }}.zip cadt-windows-x64
zip -r cadt-macos-x64-${{ steps.tag-name.outputs.TAGNAME }}.zip cadt-mac-installer
zip -r cadt-linux-x64-${{ steps.tag-name.outputs.TAGNAME }}.zip cadt-linux-x64
- name: Release
uses: softprops/[email protected]
with:
files: |
cadt-windows-x64-${{ steps.tag-name.outputs.TAGNAME }}.zip
cadt-macos-x64-${{ steps.tag-name.outputs.TAGNAME }}.zip
cadt-linux-x64-${{ steps.tag-name.outputs.TAGNAME }}.zip
cadt-linux-x64-deb/*.deb
cadt-linux-arm64-deb/*.deb
- name: Trigger apt repo update
uses: Chia-Network/actions/github/glue@main
with:
json_data: '{"cadt_repo":"cadt","release_version":"${{ steps.tag-name.outputs.TAGNAME }}"}'
glue_url: ${{ secrets.GLUE_API_URL }}
glue_project: "cadt"
glue_path: "trigger"