66 description : ' Include tracy profiling builds'
77 required : false
88 default : ' false'
9+ override_signing :
10+ description : ' Manual builds are not signned by default. Force code signing for this run.'
11+ required : false
12+ default : ' false'
913 push :
1014 branches :
1115 - " Firestorm*.*.*"
@@ -141,7 +145,18 @@ jobs:
141145 echo "Building for channel ${FS_RELEASE_CHAN}"
142146 viewer_channel=${FS_RELEASE_CHAN}
143147shell : bash
144-
148+ - name : Check if release type is signable
149+ if : runner.os == 'Windows'
150+ run : |
151+ if [[ "${FS_RELEASE_TYPE}" == "Release" || "${FS_RELEASE_TYPE}" == "Beta" ]]; then
152+ CODESIGNING_ENABLED=true
153+ else
154+ CODESIGNING_ENABLED=false
155+ fi
156+ echo "CODESIGNING_ENABLED=${CODESIGNING_ENABLED}" >> $GITHUB_ENV
157+ echo "Codesigning enabled: ${CODESIGNING_ENABLED}"
158+ shell : bash
159+
145160 - name : Get the code
146161 uses : actions/checkout@v4
147162 with :
@@ -261,7 +276,7 @@ jobs:
261276 done
262277shell : bash
263278
264- - name : Set expiration days based on FS_RELEASE_TYPE
279+ - name : Set expiration days and codesigning based on FS_RELEASE_TYPE
265280 run : |
266281 case "${{ env.FS_RELEASE_TYPE }}" in
267282 "Nightly" | "Manual" | "Profiling")
@@ -293,7 +308,17 @@ jobs:
293308 if : ${{ matrix.variant == 'avx' }}
294309 shell : bash
295310 run : echo "EXTRA_ARGS=${{ env.EXTRA_ARGS }} --avx2" >> $GITHUB_ENV
296-
311+ - name : Add custom UA string if provided
312+ env :
313+ FS_PF_UA : ${{ secrets.FS_PF_UA }}
314+ run : |
315+ if [ -n "${FS_PF_UA}" ]; then
316+ echo "EXTRA_ARGS=${{ env.EXTRA_ARGS }} -DFS_PF_USER_AGENT=\"${FS_PF_UA}\"" >> $GITHUB_ENV
317+ echo "Building with custom user-agent string."
318+ else
319+ echo "No custom user-agent string provided."
320+ fi
321+ shell : bash
297322 - name : Clean up packages to give more space
298323 run : rm *${{ env.fallback_platform }}*bz2
299324 shell : bash
@@ -302,6 +327,78 @@ jobs:
302327 autobuild configure -c ReleaseFS -A${addrsize} -- --package --chan ${{env.FS_RELEASE_CHAN}} ${{env.EXTRA_ARGS}} ${{env.FS_GRID}}
303328 echo "BUGSPLAT_DB=$BUGSPLAT_DB" >> $GITHUB_ENV
304329shell : bash
330+ - name : Generate metadata.json
331+ if : runner.os == 'Windows'
332+ run : |
333+ echo '{
334+ "Endpoint": "${{ secrets.AZURE_ENDPOINT }}",
335+ "CodeSigningAccountName": "${{ secrets.AZURE_CODE_SIGNING_NAME }}",
336+ "CertificateProfileName": "${{ secrets.AZURE_CERT_PROFILE_NAME }}",
337+ "ExcludeCredentials": [
338+ "ManagedIdentityCredential"
339+ ]
340+ }' > ${{github.workspace}}/metadata.json
341+ echo "CODESIGNING_METADATA_PATH=${{github.workspace}}/metadata.json" >> $env:GITHUB_ENV
342+ shell : pwsh
343+ - name : Validate Windows 10 SDK version and find signtool.exe IFF codesigning is enabled for these builds or overridden
344+ if : ${{ runner.os == 'Windows' && (env.CODESIGNING_ENABLED == 'true' || github.event.inputs.override_signing == 'true') }}
345+ id : validate-sdk
346+ run : |
347+ try {
348+ $Arch = ($env:RUNNER_ARCH).ToLower()
349+ $SearchBase = "${env:ProgramFiles(x86)}\Windows Kits\10\bin"
350+
351+ "Searching `"$SearchBase`" for signtool ($Arch)..."
352+ $Tool = Get-ChildItem $SearchBase -Recurse -Force -ErrorAction SilentlyContinue |
353+ Where-Object {$_.Name -eq 'signtool.exe' -and $_.Directory -like "*\$Arch"} |
354+ Sort-Object -Descending |
355+ Select-Object -First 1
356+
357+ if (!($Tool)) {throw [System.IO.FileNotFoundException]::new('File not found.', 'signtool.exe')}
358+
359+ 'Adding signtool to PATH'
360+ $Tool.Directory.FullName | Out-File $env:GITHUB_PATH -Append
361+ "signtool-$Arch=$($Tool.FullName)" | Out-File $env:GITHUB_OUTPUT -Append
362+ $env:PATH = "$($Tool.Directory.FullName);$env:PATH"
363+
364+ signtool.exe /h
365+ } catch {
366+ Write-Output "::error::$($_.Exception)"
367+ Write-Output '::endgroup::'
368+
369+ exit 1
370+ }
371+ echo "SIGNTOOL_PATH=signtool.exe" >> $env:GITHUB_ENV
372+ shell : pwsh
373+ - name : Install nuget.exe
374+ if : runner.os == 'Windows'
375+ run : |
376+ Invoke-WebRequest -Uri https://dist.nuget.org/win-x86-commandline/latest/nuget.exe -OutFile nuget.exe
377+ shell : pwsh
378+
379+ - name : Install Microsoft.Trusted.Signing.Client
380+ if : runner.os == 'Windows'
381+ run : |
382+ .\nuget.exe install Microsoft.Trusted.Signing.Client -Version 1.0.86 -OutputDirectory .
383+ shell : pwsh
384+
385+ - name : Locate Azure.CodeSigning.Dlib.dll
386+ if : runner.os == 'Windows'
387+ run : |
388+ $dllPath = (Get-ChildItem ".\Microsoft.Trusted.Signing.Client.1.0.86\bin\x64\Azure.CodeSigning.Dlib.dll" -Recurse -File | Select-Object -First 1).FullName
389+ if (-not $dllPath) {
390+ Write-Error "Azure.CodeSigning.Dlib.dll not found."
391+ exit 1
392+ }
393+ echo "CODESIGNING_DLIB_PATH=$dllPath" >> $env:GITHUB_ENV
394+ shell : pwsh
395+ - name : Prep env for Trusted code on Windows only
396+ if : runner.os == 'Windows'
397+ run : |
398+ echo "AZURE_CLIENT_ID=${{ secrets.AZURE_CLIENT_ID }}" >> $GITHUB_ENV
399+ echo "AZURE_CLIENT_SECRET=${{ secrets.AZURE_CLIENT_SECRET }}" >> $GITHUB_ENV
400+ echo "AZURE_TENANT_ID=${{ secrets.AZURE_TENANT_ID }}" >> $GITHUB_ENV
401+ shell : bash
305402 - name : build
306403 id : build
307404 run : autobuild build -c ReleaseFS -A${addrsize} --no-configure
0 commit comments