doom-status/.github/workflows/build.yml at 9eb1a784ae2a7d9604254adff62fb253756bee41 · rjzak/doom-status · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
name: Build
on:
  push:
    tags:
      - "v*"
    branches:
      - main
  pull_request:
    branches:
      - '*'

permissions:
  attestations: write
  contents: read
  id-token: write

jobs:
  build:
    strategy:
      matrix:
        platform:
          - host: macos-latest
            os_name: darwin
            file_name: doom-status

          - host: ubuntu-latest
            os_name: linux
            file_name: doom-status

          - host: windows-latest
            os_name: windows
            file_name: doom-status.exe
    runs-on: ${{ matrix.platform.host }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            archive.ubuntu.com:80
            azure.archive.ubuntu.com:80
            api.github.com:443
            crates.io:443
            esm.ubuntu.com:443
            fulcio.sigstore.dev:443
            github.com:443
            index.crates.io:443
            motd.ubuntu.com:443
            ppa.launchpadcontent.net:443
            rekor.sigstore.dev:443
            security.ubuntu.com:80
            static.crates.io:443
            static.rust-lang.org:443

      - name: Install Dependencies (Linux)
        run: sudo apt-get install -y libgtk-3-dev libglib2.0-dev build-essential
        if: matrix.platform.host == 'ubuntu-latest'

      - name: Install extra tools (Windows)
        uses: ChristopheLav/windows-sdk-install@88d72875fb873886ea398ed04041446da6f26f86 # v1.0.3
        with:
          version-sdk: 22621
          features: 'OptionId.DesktopCPPx64,OptionId.DesktopCPParm64'
        if: matrix.platform.host == 'windows-latest'

      - run: rustup target install aarch64-pc-windows-msvc
        if: matrix.platform.host == 'windows-latest'

      - run: rustup target install x86_64-apple-darwin
        if: matrix.platform.host == 'macos-latest'

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Setup Rust toolchain
        run: rustup show && rustup update

      - name: Build
        run: cargo build --release

      - name: Build Windows arm64
        run: |
          cargo build --release --target=aarch64-pc-windows-msvc
          mv target/aarch64-pc-windows-msvc/release/doom-status.exe target/aarch64-pc-windows-msvc/release/doom-status-arm64.exe
        if: matrix.platform.host == 'windows-latest'

      - name: Build Mac x86_64
        run: |
          cargo build --release --target=x86_64-apple-darwin
          lipo -create -output doom-status-universal target/release/doom-status target/x86_64-apple-darwin/release/doom-status
          cp doom-status-universal target/release/${{ matrix.platform.file_name }}
          mkdir Doom\ Status.app
          mkdir Doom\ Status.app/Contents
          mkdir Doom\ Status.app/Contents/MacOS
          mkdir Doom\ Status.app/Contents/Resources
          mv doom-status-universal Doom\ Status.app/Contents/MacOS/doom-status
          cp macos/AppIcon.icns Doom\ Status.app/Contents/Resources/
          cp macos/Info.plist Doom\ Status.app/Contents/
          cp macos/PkgInfo Doom\ Status.app/Contents/
          mkdir -p private_keys/
          echo -n "${{ secrets.CERTIFICATE_P12 }}" | base64 --decode -o private_keys/cert.p12
        if: matrix.platform.host == 'macos-latest'

      - name: Sign Mac binary
        uses: indygreg/apple-code-sign-action@44d0985b7f4363198e80b6fea63ac3e9dd3e9957 # v1.1
        with:
          input_path: 'Doom Status.app'
          p12_file: private_keys/cert.p12
          p12_password: ${{ secrets.CERTIFICATE_PASSWORD }}
          sign_args: |
            --for-notarization
          rcodesign_version: '0.29.0'
        if: matrix.platform.host == 'macos-latest'

      - name: Compress Mac app & Notarize
        run: |
          zip -r Doom\ Status.zip Doom\ Status.app
          echo 000000000000 > private_keys/cert.p12
          rm -rf private_keys/
          xcrun notarytool submit Doom\ Status.zip --apple-id ${{ secrets.APPLE_ID }} --password ${{ secrets.API_PASSWORD }} --team-id ${{ secrets.APPLE_TEAM_ID }} --wait
          xcrun stapler staple Doom\ Status.app
          rm Doom\ Status.zip
          zip -r Doom\ Status.zip Doom\ Status.app
          mv Doom\ Status.zip Doom\ Status\ macOS.zip
        if: matrix.platform.host == 'macos-latest'

      - uses: actions/attest-build-provenance@db473fddc028af60658334401dc6fa3ffd8669fd # v2.3.0
        with:
          subject-path: target/release/${{ matrix.platform.file_name }}
        if: startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'

      - uses: actions/attest-build-provenance@db473fddc028af60658334401dc6fa3ffd8669fd # v2.3.0
        with:
          subject-path: target/aarch64-pc-windows-msvc/release/doom-status-arm64.exe
        if: matrix.platform.host == 'windows-latest' && startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'

      - uses: actions/attest-build-provenance@db473fddc028af60658334401dc6fa3ffd8669fd # v2.3.0
        with:
          subject-path: Doom\ Status.app/Contents/MacOS/doom-status
        if: matrix.platform.host == 'macos-latest' && startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'

      - run: mv target/release/${{ matrix.platform.file_name }} target/release/${{ matrix.platform.file_name }}_${{ matrix.platform.os_name }}
        if: matrix.platform.host != 'windows-latest'

      - name: Upload ${{ matrix.platform.os_name }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: doom-status_${{ matrix.platform.os_name }}
          path: target/release/${{ matrix.platform.file_name }}_${{ matrix.platform.os_name }}
          if-no-files-found: error
          retention-days: 5
        if: matrix.platform.host != 'windows-latest'

      - name: Upload ${{ matrix.platform.os_name }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: doom-status.exe
          path: target/release/${{ matrix.platform.file_name }}
          if-no-files-found: error
          retention-days: 5
        if: matrix.platform.host == 'windows-latest'

      - name: Upload Windows Arm64
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: doom-status-arm64.exe
          path: target/aarch64-pc-windows-msvc/release/doom-status-arm64.exe
          if-no-files-found: error
          retention-days: 5
        if: matrix.platform.host == 'windows-latest'

      - name: Upload Mac OS binary
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: 'Doom Status macOS.zip'
          path: 'Doom Status macOS.zip'
          compression-level: 0
          if-no-files-found: error
          retention-days: 5
        if: matrix.platform.host == 'macos-latest'

  release:
    if: startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    needs: [ build ]
    steps:
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: 'Doom Status macOS.zip'

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: doom-status_linux

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: doom-status.exe

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: doom-status-arm64.exe

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: doom-status_darwin

      - run: mv doom-status_linux doom-status_linux_x86_64

      - uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2.2.2
        with:
          draft: true
          prerelease: true
          generate_release_notes: true
          files: |
            Doom\ Status\ macOS.zip
            doom-status_linux_x86_64
            doom-status_darwin
            doom-status.exe
            doom-status-arm64.exe