apply stignore synchronization patch
custom release / build-custom-release (push) Successful in 3m12s
custom release / build-custom-release (push) Successful in 3m12s
This commit is contained in:
Syncthing .stignore Fork
@@ -0,0 +1,150 @@
|
||||
name: custom release
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
paths:
|
||||
- ".github/workflows/custom-release.yml"
|
||||
- "patches/**"
|
||||
- "scripts/update-custom-release.sh"
|
||||
- "scripts/sync-upstream.sh"
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
upstream_tag:
|
||||
description: "Optional upstream Syncthing tag, for example v2.1.3"
|
||||
required: false
|
||||
suffix:
|
||||
description: "Optional custom release suffix, for example stignore.7"
|
||||
required: false
|
||||
schedule:
|
||||
- cron: "17 04 * * *"
|
||||
|
||||
jobs:
|
||||
build-custom-release:
|
||||
runs-on: macos-14
|
||||
steps:
|
||||
- name: Check out repository
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version-file: go.mod
|
||||
cache: false
|
||||
|
||||
- name: Configure Git author
|
||||
run: |
|
||||
git config user.name "GitHub Actions"
|
||||
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
||||
|
||||
- name: Mirror upstream and rebuild patched main
|
||||
run: ./scripts/sync-upstream.sh
|
||||
env:
|
||||
SYNC_REMOTE: origin
|
||||
|
||||
- name: Import Developer ID certificate
|
||||
run: |
|
||||
set -euo pipefail
|
||||
keychain_path="$RUNNER_TEMP/syncthing-release-signing.keychain-db"
|
||||
keychain_password="$(openssl rand -hex 24)"
|
||||
certificate_path="$RUNNER_TEMP/developer-id-application.p12"
|
||||
previous_default_keychain="$(security default-keychain -d user 2>/dev/null | sed 's/[ "]//g' || true)"
|
||||
|
||||
echo "::add-mask::$keychain_password"
|
||||
echo "CUSTOM_RELEASE_KEYCHAIN_PATH=$keychain_path" >> "$GITHUB_ENV"
|
||||
echo "CUSTOM_RELEASE_KEYCHAIN_PASSWORD=$keychain_password" >> "$GITHUB_ENV"
|
||||
echo "CUSTOM_RELEASE_CERTIFICATE_PATH=$certificate_path" >> "$GITHUB_ENV"
|
||||
echo "CUSTOM_RELEASE_PREVIOUS_DEFAULT_KEYCHAIN=$previous_default_keychain" >> "$GITHUB_ENV"
|
||||
|
||||
if [ -z "$DEVELOPER_ID_APPLICATION_P12_BASE64" ]; then
|
||||
echo "DEVELOPER_ID_APPLICATION_P12_BASE64 secret is required" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [ -z "$DEVELOPER_ID_APPLICATION_P12_PASSWORD" ]; then
|
||||
echo "DEVELOPER_ID_APPLICATION_P12_PASSWORD secret is required" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
printf '%s' "$DEVELOPER_ID_APPLICATION_P12_BASE64" | base64 -D > "$certificate_path"
|
||||
security create-keychain -p "$keychain_password" "$keychain_path"
|
||||
security set-keychain-settings -lut 21600 "$keychain_path"
|
||||
security unlock-keychain -p "$keychain_password" "$keychain_path"
|
||||
security import "$certificate_path" -k "$keychain_path" -P "$DEVELOPER_ID_APPLICATION_P12_PASSWORD" -A -T /usr/bin/codesign -T /usr/bin/security
|
||||
security list-keychains -d user -s "$keychain_path"
|
||||
security default-keychain -d user -s "$keychain_path"
|
||||
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$keychain_password" "$keychain_path"
|
||||
|
||||
identity_output="$(security find-identity -v -p codesigning "$keychain_path")"
|
||||
printf '%s\n' "$identity_output"
|
||||
codesign_identity="$(printf '%s\n' "$identity_output" | sed -n 's/.*"\(Developer ID Application:[^"]*\)".*/\1/p' | head -n 1)"
|
||||
if [ -z "$codesign_identity" ]; then
|
||||
echo "Developer ID Application signing identity is required in DEVELOPER_ID_APPLICATION_P12_BASE64" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
probe_binary="$RUNNER_TEMP/codesign-probe"
|
||||
cp /usr/bin/true "$probe_binary"
|
||||
codesign --force --dryrun --sign "$codesign_identity" --keychain "$keychain_path" --options runtime --timestamp "$probe_binary"
|
||||
echo "CUSTOM_RELEASE_CODESIGN_IDENTITY=$codesign_identity" >> "$GITHUB_ENV"
|
||||
env:
|
||||
DEVELOPER_ID_APPLICATION_P12_BASE64: ${{ secrets.DEVELOPER_ID_APPLICATION_P12_BASE64 }}
|
||||
DEVELOPER_ID_APPLICATION_P12_PASSWORD: ${{ secrets.DEVELOPER_ID_APPLICATION_P12_PASSWORD }}
|
||||
|
||||
- name: Build patched Syncthing release
|
||||
run: |
|
||||
case "$(uname -m)" in
|
||||
arm64) darwin_arch=arm64 ;;
|
||||
x86_64) darwin_arch=amd64 ;;
|
||||
*) echo "Unsupported macOS runner architecture: $(uname -m)" >&2; exit 1 ;;
|
||||
esac
|
||||
export CUSTOM_RELEASE_BUILDS="darwin/$darwin_arch/zip/1 linux/amd64/tar/0 linux/arm64/tar/0"
|
||||
./scripts/update-custom-release.sh
|
||||
env:
|
||||
CUSTOM_RELEASE_UPSTREAM_TAG: ${{ github.event.inputs.upstream_tag }}
|
||||
CUSTOM_RELEASE_SUFFIX: ${{ github.event.inputs.suffix }}
|
||||
CUSTOM_RELEASE_PUSH: "1"
|
||||
CUSTOM_RELEASE_PUSH_BRANCH: "0"
|
||||
CUSTOM_RELEASE_REMOTE: origin
|
||||
CUSTOM_RELEASE_CODESIGN_TEAM_ID: "NG5W75WE8U"
|
||||
CUSTOM_RELEASE_SIGN_DARWIN: "1"
|
||||
CUSTOM_RELEASE_REQUIRE_GATEKEEPER_ASSESSMENT: "0"
|
||||
CUSTOM_RELEASE_CREATE_GITEA_RELEASE: "0"
|
||||
GH_TOKEN: ${{ github.token }}
|
||||
|
||||
- name: Publish GitHub release
|
||||
run: |
|
||||
tag="${CUSTOM_RELEASE_UPSTREAM_TAG:-$(git ls-remote --refs --tags --sort='version:refname' https://github.com/syncthing/syncthing.git 'v[0-9]*' | awk '{ tag = $2; sub("refs/tags/", "", tag); if (tag ~ /^v[0-9]+\.[0-9]+\.[0-9]+$/) latest = tag } END { print latest }')}-$CUSTOM_RELEASE_SUFFIX"
|
||||
if gh release view "$tag" >/dev/null 2>&1; then
|
||||
echo "GitHub release $tag already exists; nothing to do."
|
||||
exit 0
|
||||
fi
|
||||
assets=()
|
||||
for asset in dist/*; do
|
||||
[ -f "$asset" ] || continue
|
||||
[ "$(basename "$asset")" = release-notes.md ] && continue
|
||||
assets+=("$asset")
|
||||
done
|
||||
gh release create "$tag" "${assets[@]}" --title "$tag" --notes-file dist/release-notes.md --verify-tag
|
||||
env:
|
||||
CUSTOM_RELEASE_UPSTREAM_TAG: ${{ github.event.inputs.upstream_tag }}
|
||||
CUSTOM_RELEASE_SUFFIX: ${{ github.event.inputs.suffix || 'stignore.7' }}
|
||||
GH_TOKEN: ${{ github.token }}
|
||||
|
||||
- name: Delete temporary keychain
|
||||
if: always()
|
||||
run: |
|
||||
if [ -n "${CUSTOM_RELEASE_PREVIOUS_DEFAULT_KEYCHAIN:-}" ] && [ -e "$CUSTOM_RELEASE_PREVIOUS_DEFAULT_KEYCHAIN" ]; then
|
||||
security default-keychain -d user -s "$CUSTOM_RELEASE_PREVIOUS_DEFAULT_KEYCHAIN" || true
|
||||
fi
|
||||
if [ -n "${CUSTOM_RELEASE_KEYCHAIN_PATH:-}" ]; then
|
||||
security delete-keychain "$CUSTOM_RELEASE_KEYCHAIN_PATH" || true
|
||||
fi
|
||||
if [ -n "${CUSTOM_RELEASE_CERTIFICATE_PATH:-}" ]; then
|
||||
rm -f "$CUSTOM_RELEASE_CERTIFICATE_PATH"
|
||||
fi
|
||||
Reference in New Issue
Block a user