build-tools.yml

name: Build Tools
on:
  workflow_dispatch:

jobs:
  build:
    name: build ${{ matrix.tool }} [${{ matrix.platform }} ${{ matrix.arch }}]
    runs-on: ${{ matrix.runner }}
    strategy:
      matrix:
        arch: [x86_64, aarch64]
        platform: [pc-windows-msvc, unknown-linux-gnu, apple-darwin]
        tool: [tokengen]
        include:
          - platform: pc-windows-msvc
            runner: windows-2022
          - platform: unknown-linux-gnu
            runner: ubuntu-22.04
          - platform: apple-darwin
            runner: macos-14
        exclude:
          - platform: pc-windows-msvc
            arch: aarch64
          - platform: unknown-linux-gnu
            arch: aarch64

    steps:
      - name: Checkout ${{ github.repository }}
        uses: actions/checkout@v6

      - name: Configure runner
        run: rustup target add ${{ matrix.arch }}-${{ matrix.platform }}

      - name: Build ${{ matrix.tool }}
        run: cargo build --target ${{ matrix.arch }}-${{ matrix.platform }} --release
        shell: pwsh
        working-directory: tools/${{ matrix.tool }}

      - name: Get output path
        id: get-binary-path
        run: |
          $Path = 'tools/${{ matrix.tool }}/target/${{ matrix.arch }}-${{ matrix.platform }}/release/${{ matrix.tool }}'
          if ('${{ matrix.platform}}' -Eq 'pc-windows-msvc') {
            $Path += ".exe"
          }
          echo "binary-path=$Path" >> $Env:GITHUB_OUTPUT
        shell: pwsh

      - name: Upload binaries
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.tool }}-${{ matrix.arch }}-${{ matrix.platform }}
          path: ${{ steps.get-binary-path.outputs.binary-path }}

  lipo:
    name: build universal ${{ matrix.tool }}
    needs: [build]
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        tool: [tokengen]

    steps:
      - name: Download binaries
        uses: actions/download-artifact@v8

      - name: Setup CCTools
        uses: Devolutions/actions-public/setup-cctools@v1

      - name: Lipo
        run: |
          $OutputPath = '${{ matrix.tool }}-universal-apple-darwin'
          New-Item -ItemType Directory -Path $OutputPath | Out-Null
          $Binaries = Get-ChildItem -Recurse -Path "*-apple-darwin" -Filter '${{ matrix.tool }}' | Foreach-Object { $_.FullName } | Select -Unique
          $LipoCmd = $(@('lipo', '-create', '-output', (Join-Path -Path $OutputPath -ChildPath '${{ matrix.tool }}')) + $Binaries) -Join ' '
          Write-Host $LipoCmd
          Invoke-Expression $LipoCmd
        shell: pwsh

      - name: Upload binaries
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.tool }}-universal-apple-darwin
          path: ${{ matrix.tool }}-universal-apple-darwin/${{ matrix.tool }}

  sign:
    name: sign ${{ matrix.tool }} [${{ matrix.platform }} ${{ matrix.arch }}]
    environment: publish-prod
    needs: [build, lipo]
    runs-on: ${{ matrix.runner }}
    strategy:
      matrix:
        arch: [x86_64, aarch64, universal]
        platform: [pc-windows-msvc, apple-darwin]
        tool: [tokengen]
        include:
          - platform: pc-windows-msvc
            runner: windows-2022
          - platform: apple-darwin
            runner: macos-14
        exclude:
          - platform: pc-windows-msvc
            arch: aarch64
          - platform: pc-windows-msvc
            arch: universal

    steps:
      - name: Download binaries
        uses: actions/download-artifact@v8

      - name: Get binary path
        id: get-binary-path
        run: |
          $Path = '${{ matrix.tool }}-${{ matrix.arch }}-${{ matrix.platform }}/${{ matrix.tool }}'
          if ('${{ matrix.platform}}' -Eq 'pc-windows-msvc') {
            $Path += ".exe"
          }
          echo "binary-path=$Path" >> $Env:GITHUB_OUTPUT
        shell: pwsh

      - name: Install AzureSignTool
        if: ${{ matrix.platform == 'pc-windows-msvc' }}
        run: |
          dotnet tool install --global AzureSignTool

      - name: Configure certificates
        if: ${{ matrix.platform == 'apple-darwin' }}
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          KEYCHAIN_PASSWORD=Price2011

          DEVELOPER_ID_CERTIFICATE_PATH=$RUNNER_TEMP/dev_id_cert.p12
          echo -n "$DEVELOPER_ID_CERTIFICATE" | base64 --decode --output $DEVELOPER_ID_CERTIFICATE_PATH

          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          security import $DEVELOPER_ID_CERTIFICATE_PATH -P "$DEVELOPER_ID_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security list-keychain -d user -s $KEYCHAIN_PATH
        env:
          DEVELOPER_ID_CERTIFICATE: ${{ secrets.APPLE_APP_DEV_ID_APP_CERTIFICATE }}
          DEVELOPER_ID_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_APP_DEV_ID_APP_CERTIFICATE_PASSWORD }}

      - name: Configure runner
        if: ${{ matrix.platform == 'pc-windows-msvc' }}
        run: echo "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x64" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

      - name: Sign executables
        run: |
          if ('${{ matrix.platform }}' -Eq 'pc-windows-msvc') {
            $Params = @('sign',
              '-kvt', '${{ secrets.AZURE_TENANT_ID }}',
              '-kvu', '${{ secrets.CODE_SIGNING_KEYVAULT_URL }}',
              '-kvi', '${{ secrets.CODE_SIGNING_CLIENT_ID }}',
              '-kvs', '${{ secrets.CODE_SIGNING_CLIENT_SECRET }}',
              '-kvc', '${{ secrets.CODE_SIGNING_CERTIFICATE_NAME }}',
              '-tr', '${{ vars.CODE_SIGNING_TIMESTAMP_SERVER }}',
              '-v')
            AzureSignTool @Params '${{ steps.get-binary-path.outputs.binary-path }}'
          } elseif ('${{ matrix.platform }}' -Eq 'apple-darwin') {
            $SignCmd = $(@(
              'codesign',
              '--timestamp',
              '--force',
              '--options=runtime',
              '-s', '"Developer ID Application: Devolutions inc. (N592S9ASDB)"',
              '-v',
              '${{ steps.get-binary-path.outputs.binary-path }}'
            )) -Join ' '
            Write-Host $SignCmd
            Invoke-Expression $SignCmd
          }
        shell: pwsh

      - name: Verification
        run: |
          if ('${{ matrix.platform }}' -Eq 'pc-windows-msvc') {
            signtool verify /pa '${{ steps.get-binary-path.outputs.binary-path }}'
          } elseif ('${{ matrix.platform }}' -Eq 'apple-darwin') {
            codesign -dvvv '${{ steps.get-binary-path.outputs.binary-path }}'
          }

          if ($LastExitCode -Ne 0) {
            echo "::error::failed to verify the signature of ${{ steps.get-binary-path.outputs.binary-path }}"
            exit 1
          }
        shell: pwsh

      - name: Upload binaries
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.tool }}-${{ matrix.arch }}-${{ matrix.platform }}
          path: ${{ steps.get-binary-path.outputs.binary-path }}
          overwrite: true

      - name: Create universal package
        if: ${{ matrix.platform == 'apple-darwin' && matrix.arch == 'universal' }}
        run: |
          chmod +x '${{ steps.get-binary-path.outputs.binary-path }}'
          hdiutil create -size 100m -fs HFS+ -volname ${{ matrix.tool }} -srcfolder ${{ matrix.tool }}-${{ matrix.arch }}-${{ matrix.platform }} ${{ matrix.tool }}.dmg
          codesign -s "Developer ID Application: Devolutions inc. (N592S9ASDB)" ${{ matrix.tool }}.dmg
          xcrun notarytool store-credentials "notarytool-profile" --apple-id "$APPLE_BOT_ID" --team-id "$APPLE_BOT_TEAM_ID" --password "$APPLE_BOT_PASSWORD"
          xcrun notarytool submit "${{ matrix.tool }}.dmg" --keychain-profile "notarytool-profile" --wait
          xcrun stapler staple ${{ matrix.tool }}.dmg
          xcrun stapler validate -v ${{ matrix.tool }}.dmg
          spctl -a -t open --context context:primary-signature -v ${{ matrix.tool }}.dmg
        env:
          APPLE_BOT_PASSWORD: ${{ secrets.APPLE_BOT_PASSWORD }}
          APPLE_BOT_ID: bot@devolutions.net
          APPLE_BOT_TEAM_ID: N592S9ASDB

      - name: Upload package
        if: ${{ matrix.platform == 'apple-darwin' && matrix.arch == 'universal' }}
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.tool }}-${{ matrix.arch }}-${{ matrix.platform }}
          path: ${{ matrix.tool }}.dmg