chore(deps): bump step-security/harden-runner from 2.20.1 to 2.21.0 #263
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - '*' | |
| permissions: | |
| attestations: write | |
| contents: read | |
| id-token: write | |
| jobs: | |
| build: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| platform: | |
| - host: macos-latest | |
| os_name: darwin | |
| file_name: doom-status | |
| - host: ubuntu-latest | |
| os_name: linux | |
| file_name: doom-status | |
| - host: windows-latest | |
| os_name: windows | |
| file_name: doom-status.exe | |
| runs-on: ${{ matrix.platform.host }} | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 | |
| with: | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| archive.ubuntu.com:80 | |
| azure.archive.ubuntu.com:80 | |
| api.github.com:443 | |
| crates.io:443 | |
| esm.ubuntu.com:443 | |
| fulcio.sigstore.dev:443 | |
| github.com:443 | |
| index.crates.io:443 | |
| motd.ubuntu.com:443 | |
| ppa.launchpadcontent.net:443 | |
| rekor.sigstore.dev:443 | |
| security.ubuntu.com:80 | |
| static.crates.io:443 | |
| static.rust-lang.org:443 | |
| - name: Install Dependencies (Linux) | |
| run: sudo apt-get install -y libgtk-3-dev libglib2.0-dev build-essential | |
| if: matrix.platform.host == 'ubuntu-latest' | |
| - name: Install extra tools (Windows) | |
| uses: ChristopheLav/windows-sdk-install@aceebd61475568479ce68465d0849f5de9a0bfe9 # v1.0.5 | |
| with: | |
| version-sdk: 22621 | |
| features: 'OptionId.DesktopCPPx64,OptionId.DesktopCPParm64' | |
| if: matrix.platform.host == 'windows-latest' | |
| - run: rustup target install aarch64-pc-windows-msvc | |
| if: matrix.platform.host == 'windows-latest' | |
| - run: rustup target install x86_64-apple-darwin | |
| if: matrix.platform.host == 'macos-latest' | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Setup Rust toolchain | |
| run: rustup show && rustup update | |
| - name: Build | |
| run: cargo build --release | |
| - name: Build Windows arm64 | |
| run: | | |
| cargo build --release --target=aarch64-pc-windows-msvc | |
| mv target/aarch64-pc-windows-msvc/release/doom-status.exe target/aarch64-pc-windows-msvc/release/doom-status-arm64.exe | |
| if: matrix.platform.host == 'windows-latest' | |
| - name: Build Mac x86_64 | |
| run: | | |
| cargo build --release --target=x86_64-apple-darwin | |
| lipo -create -output doom-status-universal target/release/doom-status target/x86_64-apple-darwin/release/doom-status | |
| cp doom-status-universal target/release/${{ matrix.platform.file_name }} | |
| mkdir Doom\ Status.app | |
| mkdir Doom\ Status.app/Contents | |
| mkdir Doom\ Status.app/Contents/MacOS | |
| mkdir Doom\ Status.app/Contents/Resources | |
| mv doom-status-universal Doom\ Status.app/Contents/MacOS/doom-status | |
| cp macos/AppIcon.icns Doom\ Status.app/Contents/Resources/ | |
| cp macos/Info.plist Doom\ Status.app/Contents/ | |
| cp macos/PkgInfo Doom\ Status.app/Contents/ | |
| mkdir -p private_keys/ | |
| echo -n "${{ secrets.CERTIFICATE_P12 }}" | base64 --decode -o private_keys/cert.p12 | |
| if: matrix.platform.host == 'macos-latest' | |
| - name: Sign Mac binary | |
| uses: indygreg/apple-code-sign-action@5e7a4a01fe4dffe948ef3bcf1f4538d963cb0c72 # v1.2 | |
| with: | |
| input_path: 'Doom Status.app' | |
| p12_file: private_keys/cert.p12 | |
| p12_password: ${{ secrets.CERTIFICATE_PASSWORD }} | |
| sign_args: | | |
| --for-notarization | |
| rcodesign_version: '0.29.0' | |
| if: matrix.platform.host == 'macos-latest' | |
| - name: Compress Mac app & Notarize | |
| run: | | |
| zip -r Doom\ Status.zip Doom\ Status.app | |
| echo 000000000000 > private_keys/cert.p12 | |
| rm -rf private_keys/ | |
| xcrun notarytool submit Doom\ Status.zip --apple-id ${{ secrets.APPLE_ID }} --password ${{ secrets.API_PASSWORD }} --team-id ${{ secrets.APPLE_TEAM_ID }} --wait | |
| xcrun stapler staple Doom\ Status.app | |
| rm Doom\ Status.zip | |
| zip -r Doom\ Status.zip Doom\ Status.app | |
| mv Doom\ Status.zip Doom\ Status\ macOS.zip | |
| if: matrix.platform.host == 'macos-latest' | |
| - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 | |
| with: | |
| subject-path: target/release/${{ matrix.platform.file_name }} | |
| if: startsWith(github.ref, 'refs/tags/') && github.event_name == 'push' | |
| - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 | |
| with: | |
| subject-path: target/aarch64-pc-windows-msvc/release/doom-status-arm64.exe | |
| if: matrix.platform.host == 'windows-latest' && startsWith(github.ref, 'refs/tags/') && github.event_name == 'push' | |
| - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 | |
| with: | |
| subject-path: Doom\ Status.app/Contents/MacOS/doom-status | |
| if: matrix.platform.host == 'macos-latest' && startsWith(github.ref, 'refs/tags/') && github.event_name == 'push' | |
| - run: mv target/release/${{ matrix.platform.file_name }} target/release/${{ matrix.platform.file_name }}_${{ matrix.platform.os_name }} | |
| if: matrix.platform.host != 'windows-latest' | |
| - name: Upload ${{ matrix.platform.os_name }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: doom-status_${{ matrix.platform.os_name }} | |
| path: target/release/${{ matrix.platform.file_name }}_${{ matrix.platform.os_name }} | |
| if-no-files-found: error | |
| retention-days: 5 | |
| if: matrix.platform.host != 'windows-latest' | |
| - name: Upload ${{ matrix.platform.os_name }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: doom-status.exe | |
| path: target/release/${{ matrix.platform.file_name }} | |
| if-no-files-found: error | |
| retention-days: 5 | |
| if: matrix.platform.host == 'windows-latest' | |
| - name: Upload Windows Arm64 | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: doom-status-arm64.exe | |
| path: target/aarch64-pc-windows-msvc/release/doom-status-arm64.exe | |
| if-no-files-found: error | |
| retention-days: 5 | |
| if: matrix.platform.host == 'windows-latest' | |
| - name: Upload Mac OS binary | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: 'Doom Status macOS.zip' | |
| path: 'Doom Status macOS.zip' | |
| compression-level: 0 | |
| if-no-files-found: error | |
| retention-days: 5 | |
| if: matrix.platform.host == 'macos-latest' | |
| release: | |
| if: startsWith(github.ref, 'refs/tags/') && github.event_name == 'push' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| needs: [ build ] | |
| steps: | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: 'Doom Status macOS.zip' | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: doom-status_linux | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: doom-status.exe | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: doom-status-arm64.exe | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: doom-status_darwin | |
| - run: mv doom-status_linux doom-status_linux_x86_64 | |
| - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 | |
| with: | |
| draft: true | |
| prerelease: true | |
| generate_release_notes: true | |
| files: | | |
| Doom\ Status\ macOS.zip | |
| doom-status_linux_x86_64 | |
| doom-status_darwin | |
| doom-status.exe | |
| doom-status-arm64.exe |