Skip to content

Commit 847be11

Browse files
jakub-tldrjakub-tldr
authored
Chocolatey update workflow (#873)
1 parent a10f64d commit 847be11

6 files changed

Lines changed: 184 additions & 1 deletion

File tree

‎.github/workflows/update-chocolatey.yml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
name: Update Chocolatey package
2+
3+
on:
4+
release:
5+
types: [published]
6+
7+
jobs:
8+
update-chocolatey:
9+
if: github.event.release.prerelease == false
10+
runs-on: windows-latest
11+
steps:
12+
- name: Checkout
13+
uses: actions/checkout@v6
14+
15+
- name: Set release version
16+
shell: pwsh
17+
run: |
18+
$version = "${{ github.event.release.tag_name }}".TrimStart('v').Split('-')[0]
19+
"VERSION=$version" | Out-File -FilePath $env:GITHUB_ENV -Append
20+
21+
- name: Set MSI variables
22+
shell: pwsh
23+
run: |
24+
$msiName = "Defguard_${env:VERSION}_x64_en-US.msi"
25+
$msiUrl = "https://github.com/DefGuard/client/releases/download/v${env:VERSION}/Defguard_${env:VERSION}_x64_en-US.msi"
26+
"MSI_NAME=$msiName" | Out-File -FilePath $env:GITHUB_ENV -Append
27+
"MSI_URL=$msiUrl" | Out-File -FilePath $env:GITHUB_ENV -Append
28+
29+
- name: Download MSI asset
30+
shell: pwsh
31+
env:
32+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
33+
run: |
34+
gh release download "${{ github.event.release.tag_name }}" --pattern $env:MSI_NAME --dir "$pwd"
35+
36+
- name: Calculate MSI checksum
37+
shell: pwsh
38+
run: |
39+
$hash = (Get-FileHash -Algorithm SHA256 -Path $env:MSI_NAME).Hash.ToLower()
40+
"MSI_SHA256=$hash" | Out-File -FilePath $env:GITHUB_ENV -Append
41+
42+
- name: Update Chocolatey package files
43+
shell: pwsh
44+
working-directory: chocolatey/defguard
45+
run: |
46+
$nuspecPath = "defguard.nuspec"
47+
$installPath = "tools\chocolateyinstall.ps1"
48+
49+
(Get-Content -Raw $nuspecPath) `
50+
-replace '<version>[^<]+</version>', "<version>$env:VERSION</version>" |
51+
Set-Content -NoNewline -Encoding UTF8 $nuspecPath
52+
53+
$content = Get-Content -Raw $installPath
54+
$content = $content -replace '__MSI_URL__', $env:MSI_URL
55+
$content = $content -replace '__MSI_CHECKSUM__', $env:MSI_SHA256
56+
$content | Set-Content -NoNewline -Encoding UTF8 $installPath
57+
58+
- name: Refresh local nupkg
59+
shell: pwsh
60+
working-directory: chocolatey/defguard
61+
run: |
62+
$old = Get-ChildItem -Filter "defguard.*.nupkg" | Where-Object { $_.Name -ne "defguard.$env:VERSION.nupkg" }
63+
if ($old) { $old | Remove-Item -Force }
64+
65+
- name: Pack Chocolatey package
66+
shell: pwsh
67+
working-directory: chocolatey/defguard
68+
run: choco pack
69+
70+
- name: Push Chocolatey package
71+
shell: pwsh
72+
working-directory: chocolatey/defguard
73+
env:
74+
CHOCO_API_KEY: ${{ secrets.CHOCO_API_KEY }}
75+
run: |
76+
$nupkg = "defguard.$env:VERSION.nupkg"
77+
choco push $nupkg --source "https://push.chocolatey.org/" -k="$env:CHOCO_API_KEY"

‎.trivyignore.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
vulnerabilities:
22
- id: GHSA-wrw7-89jp-8q8g
3-
expired_at: 2026-05-16
3+
expired_at: 2026-08-18
44
statement: 'glib is a transitive dependency of Tauri which we cannot update ourselves. Waiting for tauri to finish migration to gtk4-rs: https://github.com/tauri-apps/tauri/issues/12563'

‎chocolatey/defguard/README.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Defguard Chocolatey package
2+
3+
This directory contains the Chocolatey package source for Defguard.
4+
The GitHub Actions workflow updates version, MSI URL, and checksum after a release is published.
5+
6+
## Workflow behavior
7+
8+
- Trigger: GitHub release `published` (non-prerelease).
9+
- Source MSI: Release asset named `Defguard_<version>_x64_en-US.msi`.
10+
- Updated files:
11+
- `defguard.nuspec` (`<version>`, `<packageSourceUrl>`)
12+
- `tools/chocolateyinstall.ps1` (`$url`, `checksum`)
13+
- Package build: `choco pack`.
14+
- Package push: `choco push` to `https://push.chocolatey.org/`.
15+
16+
## Required secret
17+
18+
- `CHOCO_API_KEY` in GitHub repo secrets.
19+
20+
## Local testing (Windows)
21+
22+
From this directory:
23+
24+
```
25+
choco pack
26+
choco install defguard --source .
27+
```

‎chocolatey/defguard/defguard.nuspec‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
3+
<metadata>
4+
<id>defguard</id>
5+
<version>1.6.8</version>
6+
<title>Defguard</title>
7+
<authors>Defguard</authors>
8+
<projectUrl>https://defguard.net</projectUrl>
9+
<iconUrl>http://rawcdn.githack.com/defguard/client/main/src/shared/images/png/logo_256-256.png</iconUrl>
10+
<copyright>Copyright 2026 Defguard Sp. z o.o.</copyright>
11+
<licenseUrl>https://github.com/DefGuard/client/blob/main/LICENSE.md</licenseUrl>
12+
<requireLicenseAcceptance>true</requireLicenseAcceptance>
13+
<projectSourceUrl>https://github.com/DefGuard/client</projectSourceUrl>
14+
<docsUrl>https://docs.defguard.net/</docsUrl>
15+
<bugTrackerUrl>https://github.com/DefGuard/client/issues</bugTrackerUrl>
16+
<tags>defguard vpn wireguard sso mfa</tags>
17+
<summary>Desktop client for Defguard - Wireguard VPN with MFA</summary>
18+
<description>Desktop client provides an easy way to access VPN locations of multiple Defguard instances via user-friendly UI.</description>
19+
<releaseNotes>https://github.com/DefGuard/client/releases</releaseNotes>
20+
</metadata>
21+
<files>
22+
<file src="tools\**" target="tools" />
23+
</files>
24+
</package>

‎chocolatey/defguard/tools/chocolateyinstall.ps1‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
$ErrorActionPreference = 'Stop'
2+
$toolsDir = "$(Split-Path -parent $MyInvocation.MyCommand.Definition)"
3+
$url = '__MSI_URL__'
4+
$checksum = '__MSI_CHECKSUM__'
5+
6+
$packageArgs = @{
7+
packageName = $env:ChocolateyPackageName
8+
unzipLocation = $toolsDir
9+
fileType = 'msi'
10+
url = $url
11+
12+
softwareName = 'defguard*'
13+
14+
checksum = $checksum
15+
checksumType = 'sha256'
16+
17+
silentArgs = "/qn /norestart /l*v `"$($env:TEMP)\$($packageName).$($env:chocolateyPackageVersion).MsiInstall.log`""
18+
validExitCodes= @(0, 3010, 1641)
19+
}
20+
21+
Install-ChocolateyPackage @packageArgs
22+
Write-Warning "IMPORTANT: Reboot or Re-login Required: On initial install the user is added to the defguard group.A reboot or logging out and back in is required for group membership changes to take effect. This is not required on subsequent updates."
23+

‎chocolatey/defguard/tools/chocolateyuninstall.ps1‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
$ErrorActionPreference = 'Stop'
2+
$packageArgs = @{
3+
packageName = $env:ChocolateyPackageName
4+
softwareName = 'defguard*'
5+
fileType = 'msi'
6+
silentArgs = "/qn /norestart"
7+
validExitCodes= @(0, 3010, 1605, 1614, 1641)
8+
}
9+
10+
[array]$key = Get-UninstallRegistryKey -SoftwareName $packageArgs['softwareName']
11+
12+
if ($key.Count -eq 1) {
13+
$key | % {
14+
$packageArgs['file'] = "$($_.UninstallString)"
15+
16+
if ($packageArgs['fileType'] -eq 'MSI') {
17+
$packageArgs['silentArgs'] = "$($_.PSChildName) $($packageArgs['silentArgs'])"
18+
19+
$packageArgs['file'] = ''
20+
} else {
21+
}
22+
23+
Uninstall-ChocolateyPackage @packageArgs
24+
}
25+
} elseif ($key.Count -eq 0) {
26+
Write-Warning "$packageName has already been uninstalled by other means."
27+
} elseif ($key.Count -gt 1) {
28+
Write-Warning "$($key.Count) matches found!"
29+
Write-Warning "To prevent accidental data loss, no programs will be uninstalled."
30+
Write-Warning "Please alert package maintainer the following keys were matched:"
31+
$key | % {Write-Warning "- $($_.DisplayName)"}
32+
}

0 commit comments

Comments
 (0)