feat: add github action to sign installer

Author: kkostov

.github/workflows/build.yml

@@ -1,10 +1,11 @@
 name: Build
 on:
   push:
+    branches: ['**']
 
 # prevent duplicate runs on the same branch
 concurrency:
-  group: ${{ github.workflow }}-${{ github.sha }}
+  group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
@@ -13,7 +14,6 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        #os: [ubuntu-latest, windows-latest, macos-latest]
         os: [ubuntu-latest, windows-latest]
     steps:
       - name: Check out code

.github/workflows/publish.yml

@@ -1,23 +1,25 @@
 name: Publish
 on:
   release:
-    types: [released, prereleased]
+    types: [published]
   pull_request:
     branches:
       - master
 
+permissions:
+  contents: write
+
 # prevent duplicate runs on the same branch
 concurrency:
-  group: ${{ github.workflow }}-${{ github.sha }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'release' }}
 
 jobs:
   publish:
     name: Build
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        #os: [ubuntu-latest, windows-latest, macos-latest, ubuntu-24.04-arm]
         os: [ubuntu-latest, windows-latest, ubuntu-24.04-arm]
     steps:
       - name: Check out code
@@ -33,48 +35,62 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v6
 
-      - name: Package App
+      - name: Read version
         working-directory: ./pretixscan
         shell: bash
-        run: ./gradlew packageDistributionForCurrentOS -PappPackageName="${{ runner.os == 'Windows' && 'pretixSCAN Desktop' || 'pretixSCAN' }}"
+        run: |
+          version="$(./gradlew -q printVersion | sed -n 's/^pretixVersion=//p' | tr -d '\r')"
+          test -n "$version"
+          echo "pretixVersion=$version" >> "$GITHUB_ENV"
 
-      - name: Read version
+      - name: Package App
         working-directory: ./pretixscan
         shell: bash
-        run: ./gradlew -q printVersion >> $GITHUB_ENV
-
-      # - name: Sign Windows Installer
-      #   if: matrix.os == 'windows-latest'
-      #   working-directory: ./pretixscan
-      #   shell: bash
-      #   run: ./gradlew signWindowsMsi
+        run: ./gradlew packageDistributionForCurrentOS -PappPackageName="${{ runner.os == 'Windows' && 'pretixSCAN Desktop' || 'pretixSCAN' }}"
 
-      # Upload Windows executables and installers
-      - name: Upload Windows Apps
-        if: matrix.os == 'windows-latest'
-        uses: actions/upload-artifact@v7
+      # Only sign on releases to stay within the monthly signature quota
+      - name: Sign Windows Installer
+        if: matrix.os == 'windows-latest' && github.event_name == 'release'
+        uses: azure/artifact-signing-action@v2
         with:
-          name: pretixSCAN-${{ env.pretixVersion }}-win-x86_64.msi
-          path: ./pretixscan/composeApp/build/compose/binaries/main/msi/pretixSCAN Desktop-${{ env.pretixVersion }}.msi
+          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
+          endpoint: https://neu.codesigning.azure.net/
+          signing-account-name: pretix
+          certificate-profile-name: pretix
+          files-folder: ${{ github.workspace }}\pretixscan\composeApp\build\compose\binaries\main\msi
+          files-folder-filter: msi
+          file-digest: SHA256
+          timestamp-rfc3161: http://timestamp.acs.microsoft.com
+          timestamp-digest: SHA256
+          exclude-azure-cli-credential: true
 
-      - name: Upload Linux amd64
-        if: matrix.os == 'ubuntu-latest'
-        uses: actions/upload-artifact@v7
-        with:
-          name: pretixSCAN-${{ env.pretixVersion }}-linux-amd64.deb
-          path: ./pretixscan/composeApp/build/compose/binaries/main/deb/pretixscan_${{ env.pretixVersion }}_amd64.deb
+      - name: Collect installer
+        shell: bash
+        run: |
+          mkdir dist
+          binaries=./pretixscan/composeApp/build/compose/binaries/main
+          case "${{ matrix.os }}" in
+            windows-latest)
+              cp "$binaries/msi/pretixSCAN Desktop-${pretixVersion}.msi" "dist/pretixSCAN-${pretixVersion}-win-x86_64.msi" ;;
+            ubuntu-latest)
+              cp "$binaries/deb/pretixscan_${pretixVersion}_amd64.deb" "dist/pretixSCAN-${pretixVersion}-linux-amd64.deb" ;;
+            ubuntu-24.04-arm)
+              cp "$binaries/deb/pretixscan_${pretixVersion}_arm64.deb" "dist/pretixSCAN-${pretixVersion}-linux-arm64.deb" ;;
+          esac
+          echo "installer=$(ls dist)" >> "$GITHUB_ENV"
 
-      - name: Upload Linux arm
-        if: matrix.os == 'ubuntu-24.04-arm'
+      - name: Upload workflow artifact
         uses: actions/upload-artifact@v7
         with:
-          name: pretixSCAN-${{ env.pretixVersion }}-linux-arm64.deb
-          path: ./pretixscan/composeApp/build/compose/binaries/main/deb/pretixscan_${{ env.pretixVersion }}_arm64.deb
+          name: ${{ env.installer }}
+          path: dist/${{ env.installer }}
+          if-no-files-found: error
 
-      # Upload MacOS package
-      - name: Upload MacOS App
-        if: matrix.os == 'macos-latest'
-        uses: actions/upload-artifact@v7
-        with:
-          name: pretixSCAN-${{ env.pretixVersion }}-macOS.dmg
-          path: ./pretixscan/composeApp/build/compose/binaries/main/dmg/pretixscan-${{ env.pretixVersion }}.dmg
+      - name: Attach installer to release
+        if: github.event_name == 'release'
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release upload "${{ github.event.release.tag_name }}" "dist/${installer}" --clobber

.github/workflows/sbom.yml

@@ -3,7 +3,6 @@ name: SBOM
 on:
   push:
     branches: [ master, main, sbom ]
-    tags: [ 'v.*' ]
 
 permissions:
   contents: read  #  to fetch code (actions/checkout)
@@ -16,7 +15,9 @@ jobs:
     runs-on: ubuntu-latest
     name: Submission
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
+        with:
+          submodules: true # needed for libpretixsync and libpretixprint
       - name: Set up Python
         uses: actions/setup-python@v5
         with:

RELEASE_CHECKLIST.txt

@@ -1,2 +1,11 @@
-- [ ] Bump version in all places
-- [ ] Commit
+- [ ] Set `version` and `versionCode` in `pretixscan/gradle.properties`.
+      - `version` must be plain numeric MAJOR.MINOR.PATCH, and greater than the previous value so the MSI upgrades an existing install.
+      - `versionCode` is sent to the pretix server as the device software version.
+- [ ] `cd pretixscan && ./gradlew clean build` passes.
+- [ ] Commit as `Bump to X.Y.Z` on a branch and open a PR to `master`.
+- [ ] Build and Publish workflows succeeded on the PR.
+- [ ] Merge the PR.
+- [ ] Confirm the SBOM workflow for the merge has succeeded.
+- [ ] Create a GitHub release targeting master with a new tag `vX.Y.Z`.
+- [ ] The "Sign Windows Installer" job succeeds.
+- [ ] The MSI and DEBs installers are attached to the release.