|
| 1 | +name: Build Windows Bundle |
| 2 | + |
| 3 | +on: |
| 4 | + workflow_dispatch: {} |
| 5 | + push: |
| 6 | + branches: |
| 7 | + - master |
| 8 | + |
| 9 | +permissions: |
| 10 | + contents: read |
| 11 | + id-token: write |
| 12 | + |
| 13 | +jobs: |
| 14 | + build: |
| 15 | + runs-on: windows-latest |
| 16 | + |
| 17 | + env: |
| 18 | + WASM_BINDGEN_CLI_VERSION: "0.2.100" |
| 19 | + |
| 20 | + steps: |
| 21 | + - name: Checkout |
| 22 | + uses: actions/checkout@v4 |
| 23 | + |
| 24 | + - name: Setup Rust |
| 25 | + uses: actions-rust-lang/setup-rust-toolchain@v1 |
| 26 | + with: |
| 27 | + toolchain: stable |
| 28 | + override: true |
| 29 | + rustflags: "" |
| 30 | + target: wasm32-unknown-unknown |
| 31 | + |
| 32 | + - name: Cache Cargo |
| 33 | + uses: actions/cache@v4 |
| 34 | + with: |
| 35 | + path: | |
| 36 | + ${{ env.USERPROFILE }}\.cargo\registry |
| 37 | + ${{ env.USERPROFILE }}\.cargo\git |
| 38 | + target |
| 39 | + key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }} |
| 40 | + |
| 41 | + - name: Setup Node |
| 42 | + uses: actions/setup-node@v4 |
| 43 | + with: |
| 44 | + node-version-file: .nvmrc |
| 45 | + cache: npm |
| 46 | + cache-dependency-path: | |
| 47 | + package-lock.json |
| 48 | + frontend/package-lock.json |
| 49 | +
|
| 50 | + - name: Setup Cargo Binstall |
| 51 | + uses: cargo-bins/cargo-binstall@main |
| 52 | + |
| 53 | + - name: Install Native Dependencies |
| 54 | + shell: pwsh |
| 55 | + env: |
| 56 | + GITHUB_TOKEN: ${{ github.token }} |
| 57 | + BINSTALL_DISABLE_TELEMETRY: "true" |
| 58 | + run: | |
| 59 | + winget install --id LLVM.LLVM -e --accept-package-agreements --accept-source-agreements |
| 60 | + winget install --id Kitware.CMake -e --accept-package-agreements --accept-source-agreements |
| 61 | + winget install --id OpenSSL.OpenSSL -e --accept-package-agreements --accept-source-agreements |
| 62 | + winget install --id WebAssembly.Binaryen -e --accept-package-agreements --accept-source-agreements |
| 63 | + winget install --id GnuWin32.PkgConfig -e --accept-package-agreements --accept-source-agreements |
| 64 | +
|
| 65 | + "OPENSSL_DIR=C:\Program Files\OpenSSL-Win64" | Out-File -FilePath $env:GITHUB_ENV -Append |
| 66 | + "PKG_CONFIG_PATH=C:\Program Files\OpenSSL-Win64\lib\pkgconfig" | Out-File -FilePath $env:GITHUB_ENV -Append |
| 67 | +
|
| 68 | + cargo binstall --no-confirm --force wasm-pack |
| 69 | + cargo binstall --no-confirm --force cargo-about |
| 70 | + cargo binstall --no-confirm --force "wasm-bindgen-cli@$env:WASM_BINDGEN_CLI_VERSION" |
| 71 | +
|
| 72 | + - name: Build Windows Bundle |
| 73 | + env: |
| 74 | + CARGO_TERM_COLOR: always |
| 75 | + run: npm run build-desktop |
| 76 | + |
| 77 | + - name: Stage Artifacts |
| 78 | + shell: bash |
| 79 | + run: | |
| 80 | + rm -rf target/artifacts |
| 81 | + mkdir -p target/artifacts |
| 82 | + cp -R target/release/Graphite target/artifacts/Graphite |
| 83 | +
|
| 84 | + - name: Upload Windows Bundle |
| 85 | + uses: actions/upload-artifact@v4 |
| 86 | + with: |
| 87 | + name: graphite-windows-bundle |
| 88 | + path: target/artifacts |
| 89 | + |
| 90 | + - name: Azure login |
| 91 | + if: github.ref == 'refs/heads/master' |
| 92 | + uses: azure/login@v1 |
| 93 | + with: |
| 94 | + client-id: ${{ secrets.AZURE_CLIENT_ID }} |
| 95 | + tenant-id: ${{ secrets.AZURE_TENANT_ID }} |
| 96 | + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} |
| 97 | + enable-AzPSSession: true |
| 98 | + |
| 99 | + - name: Sign |
| 100 | + if: github.ref == 'refs/heads/master' |
| 101 | + uses: azure/artifact-signing-action@v1 |
| 102 | + with: |
| 103 | + endpoint: https://eus.codesigning.azure.net/ |
| 104 | + signing-account-name: Graphite |
| 105 | + certificate-profile-name: Graphite |
| 106 | + files: | |
| 107 | + ${{ github.workspace }}\target\artifacts\Graphite\Graphite.exe |
| 108 | + ${{ github.workspace }}\target\artifacts\Graphite\libcef.dll |
| 109 | + ${{ github.workspace }}\target\artifacts\Graphite\chrome_elf.dll |
| 110 | + ${{ github.workspace }}\target\artifacts\Graphite\vulkan-1.dll |
| 111 | + ${{ github.workspace }}\target\artifacts\Graphite\dxcompiler.dll |
| 112 | + ${{ github.workspace }}\target\artifacts\Graphite\libEGL.dll |
| 113 | + ${{ github.workspace }}\target\artifacts\Graphite\libGLESv2.dll |
| 114 | + ${{ github.workspace }}\target\artifacts\Graphite\vk_swiftshader.dll |
| 115 | + file-digest: SHA256 |
| 116 | + timestamp-rfc3161: http://timestamp.acs.microsoft.com |
| 117 | + timestamp-digest: SHA256 |
| 118 | + correlation-id: ${{ github.sha }} |
| 119 | + |
| 120 | + - name: Verify Signatures |
| 121 | + if: github.ref == 'refs/heads/master' |
| 122 | + shell: pwsh |
| 123 | + run: | |
| 124 | + $ErrorActionPreference = "Stop" |
| 125 | +
|
| 126 | + $TargetDir = "target\artifacts\Graphite" |
| 127 | +
|
| 128 | + if (-not (Test-Path $TargetDir)) { |
| 129 | + throw "TargetDir not found: $TargetDir" |
| 130 | + } |
| 131 | +
|
| 132 | + $UnsignedOrBad = @() |
| 133 | +
|
| 134 | + Get-ChildItem -Path $TargetDir -Recurse -File -Include *.exe,*.dll | ForEach-Object { |
| 135 | + $sig = Get-AuthenticodeSignature -FilePath $_.FullName |
| 136 | +
|
| 137 | + if ($sig.Status -ne 'Valid') { |
| 138 | + $UnsignedOrBad += "$($_.FullName) (Status=$($sig.Status))" |
| 139 | + } |
| 140 | + } |
| 141 | +
|
| 142 | + if ($UnsignedOrBad.Count -gt 0) { |
| 143 | + Write-Host "Unsigned or invalid binaries detected:" |
| 144 | + $UnsignedOrBad | ForEach-Object { |
| 145 | + Write-Host "::error::$_" |
| 146 | + } |
| 147 | +
|
| 148 | + if ($env:GITHUB_STEP_SUMMARY) { |
| 149 | + "### ❌ Unsigned or invalid binaries detected" | |
| 150 | + Out-File $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8 |
| 151 | + "" | Out-File $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8 |
| 152 | + $UnsignedOrBad | ForEach-Object { |
| 153 | + "* `$_" | Out-File $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8 |
| 154 | + } |
| 155 | + } |
| 156 | +
|
| 157 | + exit 1 |
| 158 | + } |
| 159 | +
|
| 160 | + Write-Host "All binaries are signed and valid." |
| 161 | +
|
| 162 | + if ($env:GITHUB_STEP_SUMMARY) { |
| 163 | + "### ✅ All binaries are signed and valid" | |
| 164 | + Out-File $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8 |
| 165 | + } |
| 166 | +
|
| 167 | + - name: Upload Windows Bundle Signed |
| 168 | + if: github.ref == 'refs/heads/master' |
| 169 | + uses: actions/upload-artifact@v4 |
| 170 | + with: |
| 171 | + name: graphite-windows-bundle-signed |
| 172 | + path: target/artifacts |
0 commit comments