pyRevit/.github/workflows/wip.yml at develop · Swichllc/pyRevit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
name: pyRevit WIP

on:
  workflow_call:
    inputs:
      head_sha:
        required: true
        type: string
      ci_run_id:
        required: true
        type: string
      install_version:
        required: true
        type: string
    outputs:
      workflow_run_id:
        description: Actions run id for this WIP workflow (signed installers and notify link)
        value: ${{ jobs.sign-wip.outputs.workflow_run_id }}

concurrency:
  group: pyrevit-wip-${{ inputs.head_sha }}
  cancel-in-progress: true

jobs:
  sign-wip:
    runs-on: windows-2025
    permissions:
      contents: read
      actions: write
    environment: production
    outputs:
      workflow_run_id: ${{ steps.runmeta.outputs.run_id }}

    steps:
      - name: Record workflow run id
        id: runmeta
        shell: bash
        run: echo "run_id=${{ github.run_id }}" >> "$GITHUB_OUTPUT"

      - name: Checkout Repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          ref: ${{ inputs.head_sha }}

      - name: Download unsigned bin artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: unsigned-bin-${{ inputs.head_sha }}
          run-id: ${{ inputs.ci_run_id }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          path: bin/

      - name: Download stamped release metadata
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: stamped-release-metadata-${{ inputs.head_sha }}
          run-id: ${{ inputs.ci_run_id }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          path: .

      - name: Cache NuGet packages
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj', '**/Directory.Build.props', 'build/Build.csproj') }}
          restore-keys: |
            ${{ runner.os }}-nuget-

      - name: Run WIP pack and sign pipeline
        working-directory: build
        env:
          DOTNET_ENVIRONMENT: Production
          Build__Channel: wip
          Signing__TenantId: ${{ secrets.AZURE_TENANT_ID }}
          Signing__ClientId: ${{ secrets.AZURE_CLIENT_ID }}
          Signing__ClientSecret: ${{ secrets.AZURE_CLIENT_SECRET }}
          Signing__Endpoint: ${{ secrets.AZURE_ENDPOINT }}
          Signing__SigningAccountName: ${{ secrets.AZURE_CODE_SIGNING_NAME }}
          Signing__CertificateProfileName: ${{ secrets.AZURE_CERT_PROFILE_NAME }}
        run: dotnet run -c Release -- pack sign

      - name: Upload signed WIP artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: pyrevit-wip-installers-${{ inputs.install_version }}
          path: |
            dist/**
            !dist/**/*.wixpdb

      - name: Delete temporary CI artifacts
        shell: pwsh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          $ErrorActionPreference = 'Stop'
          $headers = @{
            Authorization = "Bearer $env:GITHUB_TOKEN"
            Accept = "application/vnd.github+json"
            "X-GitHub-Api-Version" = "2022-11-28"
          }
          $artifactNames = @(
            "unsigned-bin-${{ inputs.head_sha }}",
            "stamped-release-metadata-${{ inputs.head_sha }}"
          )
          $listUrl = "https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ inputs.ci_run_id }}/artifacts?per_page=100"
          $artifacts = (Invoke-RestMethod -Method Get -Uri $listUrl -Headers $headers).artifacts
          foreach ($artifactName in $artifactNames) {
            $artifact = $artifacts | Where-Object { $_.name -eq $artifactName } | Select-Object -First 1
            if (-not $artifact) {
              Write-Host "No artifact named '$artifactName' found on run ${{ inputs.ci_run_id }}."
              continue
            }
            $deleteUrl = "https://api.github.com/repos/${{ github.repository }}/actions/artifacts/$($artifact.id)"
            Invoke-RestMethod -Method Delete -Uri $deleteUrl -Headers $headers | Out-Null
            Write-Host "Deleted artifact '$artifactName' (id=$($artifact.id))."
          }