测试签名ci

Author: ShadowLemoon

.github/workflows/build-release.yml

@@ -7,17 +7,27 @@ on:
   workflow_dispatch:
     inputs:
       create_release:
-        description: 'Create a release with current build'
+        description: 'Release'
+        required: true
+        default: false
+        type: boolean
+      sign:
+        description: 'Sign'
         required: true
         default: false
         type: boolean
 
 jobs:
   build:
     runs-on: windows-latest
+    outputs:
+      version: ${{ steps.get_version.outputs.version }}
+      tag: ${{ steps.get_version.outputs.tag }}
+      unsigned_artifact_id: ${{ steps.upload-unsigned-artifact.outputs.artifact-id }}
 
     steps:
-    - uses: actions/checkout@v4
+    - name: Checkout code
+      uses: actions/checkout@v4
       with:
         fetch-depth: 1
 
@@ -134,27 +144,89 @@ jobs:
         # 压缩生成的 wheels 目录
         Compress-Archive -Path deploy/dist/wheels/* -DestinationPath deploy/dist/ZenlessZoneZero-OneDragon-Environment.zip
 
-    - name: Upload Installer
+    - name: Upload Dist
       uses: actions/upload-artifact@v4
       with:
-        name: Installer
-        path: deploy/dist/OneDragon-Installer.exe
+        name: dist
+        if-no-files-found: error
+        path: deploy/dist
 
-    - name: Upload Launcher
+    - name: Upload Unsigned Artifact
+      if: ${{ (github.event_name == 'workflow_dispatch' && inputs.create_release == true) || startsWith(github.ref, 'refs/tags/') }}
+      id: upload-unsigned-artifact
       uses: actions/upload-artifact@v4
       with:
-        name: Launcher
-        path: deploy/dist/OneDragon-Launcher.exe
-
-    - name: Upload Wheels
+        # 上传后是 unsigned.zip
+        name: unsigned
+        if-no-files-found: error
+        path: |
+          .\deploy\dist\OneDragon-Launcher.exe
+          .\deploy\dist\OneDragon-Installer.exe
+
+  sign:
+    runs-on: windows-latest
+    needs: build
+    if: ${{ (github.event_name == 'workflow_dispatch' && inputs.sign == true) || startsWith(github.ref, 'refs/tags/') }}
+    env:
+      SIGNED_DIR: 'signed'
+      SIGNPATH_SIGNING_POLICY_SLUG: 'test-signing'
+    steps:
+    - name: Sign Artifact
+      if: ${{ needs.build.outputs.unsigned_artifact_id != '' }}
+      uses: signpath/github-action-submit-signing-request@v1.1
+      with:
+        api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
+        organization-id: '${{ vars.SIGNPATH_ORGANIZATION_ID }}'
+        project-slug: 'ZenlessZoneZero-OneDragon'
+        signing-policy-slug: '${{ env.SIGNPATH_SIGNING_POLICY_SLUG }}'
+        github-artifact-id: "${{ needs.build.outputs.unsigned_artifact_id }}"
+        wait-for-completion: true
+        # 签名后会自动下载到这个目录并解压 文件名和原来的一样
+        output-artifact-directory: '${{ env.SIGNED_DIR }}'
+
+    - name: Upload signed executables
       uses: actions/upload-artifact@v4
       with:
-        name: Wheels
-        path: deploy/dist/ZenlessZoneZero-OneDragon-Environment.zip
+        name: signed
+        if-no-files-found: error
+        path: ${{ env.SIGNED_DIR }}
+
+  release:
+    runs-on: windows-latest
+    needs:
+      - build
+      - sign
+    if: ${{ (github.event_name == 'workflow_dispatch' && inputs.create_release == true) || startsWith(github.ref, 'refs/tags/') }}
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 1
+
+    - name: Download dist
+      uses: actions/download-artifact@v4
+      with:
+        name: dist
+        path: deploy/dist
+
+    - name: Download signed executables
+      if: ${{ needs.sign.result == 'success' }}
+      uses: actions/download-artifact@v4
+      with:
+        name: signed
+        path: deploy/dist/signed
+
+    - name: Replace unsigned executables with signed ones
+      if: ${{ needs.sign.result == 'success' }}
+      shell: pwsh
+      run: |
+        Copy-Item "deploy/dist/signed/OneDragon-Installer.exe" -Destination "deploy/dist/OneDragon-Installer.exe" -Force
+        Copy-Item "deploy/dist/signed/OneDragon-Launcher.exe" -Destination "deploy/dist/OneDragon-Launcher.exe" -Force
 
     - name: Prepare release directory and models
-      if: ${{ (github.event_name == 'workflow_dispatch' && inputs.create_release == true) || startsWith(github.ref, 'refs/tags/') }}
       shell: pwsh
+      env:
+        RELEASE_VERSION: ${{ needs.build.outputs.version }}
       run: |
         # 将 dist 移动到当前目录的父目录下
         $distDir = "deploy/dist"
@@ -320,7 +392,7 @@ jobs:
         }
 
         # 获取版本号
-        $version = "${{ steps.get_version.outputs.version }}"
+        $version = $env:RELEASE_VERSION
 
         # 打包前删除不需要的目录
         Remove-Item -Path "deploy/build" -Recurse -Force -ErrorAction SilentlyContinue
@@ -346,10 +418,11 @@ jobs:
 
     - name: Generate Changelog
       id: changelog
-      if: ${{ (github.event_name == 'workflow_dispatch' && inputs.create_release == true) || startsWith(github.ref, 'refs/tags/') }}
       shell: pwsh
+      env:
+        CURRENT_TAG: ${{ needs.build.outputs.tag }}
       run: |
-        $current_version_tag = "${{ steps.get_version.outputs.tag }}" # 从 get_version 步骤获取的标签
+        $current_version_tag = $env:CURRENT_TAG
         $commits = @()
 
         if ($env:GITHUB_REF -like 'refs/tags/*') {
@@ -450,17 +523,16 @@ jobs:
         echo $delimiter | Out-File -FilePath $env:GITHUB_OUTPUT -Append
 
     - name: Create Release
-      if: ${{ (github.event_name == 'workflow_dispatch' && inputs.create_release == true) || startsWith(github.ref, 'refs/tags/') }}
       uses: softprops/action-gh-release@v1
       with:
-        tag_name: ${{ steps.get_version.outputs.tag }}
-        name: "Release ${{ steps.get_version.outputs.version }}"
+        tag_name: ${{ needs.build.outputs.tag }}
+        name: "Release ${{ needs.build.outputs.version }}"
         body: |
           # 安装方式
 
-          - `ZenlessZoneZero-OneDragon-${{ steps.get_version.outputs.version }}-Full-Environment.zip` 为带环境的完整包，不需要额外下载资源。
-          - `ZenlessZoneZero-OneDragon-${{ steps.get_version.outputs.version }}-Full.zip` 为完整包，解压后选择解压目录为安装目录，只需要下载环境依赖。
-          - `ZenlessZoneZero-OneDragon-${{ steps.get_version.outputs.version }}-Installer.exe` 为精简安装程序，运行后会自动下载所需的资源。
+          - `ZenlessZoneZero-OneDragon-${{ needs.build.outputs.version }}-Full-Environment.zip` 为带环境的完整包，不需要额外下载资源。
+          - `ZenlessZoneZero-OneDragon-${{ needs.build.outputs.version }}-Full.zip` 为完整包，解压后选择解压目录为安装目录，只需要下载环境依赖。
+          - `ZenlessZoneZero-OneDragon-${{ needs.build.outputs.version }}-Installer.exe` 为精简安装程序，运行后会自动下载所需的资源。
           - 如果你想更新启动器，前往主程序【设置】-【资源下载】页面更新，或者下载 `ZenlessZoneZero-OneDragon-Launcher.zip`，解压后替换。
           - __不要下载Source Code__
 
@@ -471,12 +543,12 @@ jobs:
 
           ${{ steps.changelog.outputs.clean_changelog }}
         files: |
-          ZenlessZoneZero-OneDragon-${{ steps.get_version.outputs.version }}-Full-Environment.zip
-          ZenlessZoneZero-OneDragon-${{ steps.get_version.outputs.version }}-Full.zip
-          ZenlessZoneZero-OneDragon-${{ steps.get_version.outputs.version }}-Installer.exe
+          ZenlessZoneZero-OneDragon-${{ needs.build.outputs.version }}-Full-Environment.zip
+          ZenlessZoneZero-OneDragon-${{ needs.build.outputs.version }}-Full.zip
+          ZenlessZoneZero-OneDragon-${{ needs.build.outputs.version }}-Installer.exe
           ZenlessZoneZero-OneDragon-Environment.zip
           ZenlessZoneZero-OneDragon-Launcher.zip
         generate_release_notes: false
-        prerelease: ${{ contains(steps.get_version.outputs.tag, '-beta.') }}
+        prerelease: ${{ contains(needs.build.outputs.tag, '-beta.') }}
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}