ci: setup windows with signing and gcs publish

2026-04-15 10:04:29 -07:00
parent 07f02ecfeb
commit dd8e7da911
3 changed files with 275 additions and 255 deletions
@@ -1,53 +1,78 @@
-# Phase 1: build unsigned Windows installers on demand, upload as run artifacts.
-#
-# To graduate to Phase 2 (signed + published to GCS):
-#   1. Add GCP auth step (`google-github-actions/auth@v2` via WIF) + `setup-gcloud`.
-#      Swap `yarn make:win` for a new `yarn release:win` script that runs
-#      `electron-forge publish` per arch and a gsutil cache-control step.
-#   2. Add an Azure Trusted Signing setup step that downloads the
-#      Microsoft.Trusted.Signing.Client dlib and writes a metadata JSON file,
-#      then exports AZURE_DLIB_PATH + AZURE_METADATA_JSON_PATH. Set
-#      AZURE_TENANT_ID / AZURE_CLIENT_ID / AZURE_CLIENT_SECRET from secrets.
-#      The dormant `windowsSign` branch in js/forge.config.ts activates
-#      automatically once AZURE_METADATA_JSON_PATH is set.
-
-name: Build Windows
-
-on:
-  workflow_dispatch:
-
-jobs:
-  build:
-    runs-on: windows-latest
-    defaults:
-      run:
-        working-directory: js
-    env:
-      APP_ENV: prod
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Enable corepack
-        run: corepack enable
-        shell: pwsh
-        working-directory: .
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: yarn
-          cache-dependency-path: js/yarn.lock
-
-      - name: Install dependencies
-        run: yarn install --frozen-lockfile --network-timeout 600000
-
-      - name: Build Windows installers (x64 + arm64, unsigned)
-        run: yarn make:win
-
-      - name: Upload installers
-        uses: actions/upload-artifact@v4
-        with:
-          name: flowy-llink-windows-unsigned
-          path: js/out/make/**/*
-          if-no-files-found: error
+name: Build Windows
+
+on:
+  workflow_dispatch:
+
+permissions:
+  # Azure Trusted Signing uses OIDC federated credentials from GitHub.
+  id-token: write
+  contents: read
+
+jobs:
+  build:
+    runs-on: windows-latest
+    defaults:
+      run:
+        working-directory: js
+    env:
+      APP_ENV: prod
+      AZURE_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
+      AZURE_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Enable corepack
+        run: corepack enable
+        shell: pwsh
+        working-directory: .
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: yarn
+          cache-dependency-path: js/yarn.lock
+
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile --network-timeout 600000
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v2
+        with:
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          allow-no-subscriptions: true
+
+      - name: Install Trusted Signing client dlib
+        shell: pwsh
+        working-directory: .
+        run: |
+          nuget install Microsoft.Trusted.Signing.Client -Version 1.0.60 -OutputDirectory $env:RUNNER_TEMP\trusted-signing -ExcludeVersion
+          $dlib = Join-Path $env:RUNNER_TEMP "trusted-signing\Microsoft.Trusted.Signing.Client\bin\x64\Azure.CodeSigning.Dlib.dll"
+          if (-not (Test-Path $dlib)) { throw "Dlib not found at $dlib" }
+          "AZURE_DLIB_PATH=$dlib" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+          "AZURE_METADATA_JSON_PATH=$env:GITHUB_WORKSPACE\js\build\signing-metadata.json" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v2
+        with:
+          credentials_json: ${{ secrets.PROD_GKE_SERVICE_ACCOUNT_KEY }}
+
+      - name: Set up gcloud
+        uses: google-github-actions/setup-gcloud@v2
+
+      - name: Publish signed installer (x64)
+        run: yarn publish:win
+
+      - name: Invalidate RELEASES cache
+        shell: pwsh
+        working-directory: .
+        run: gsutil setmeta -h "Cache-Control:no-cache, no-store, must-revalidate" gs://flowy-releases/llink/win32/x64/RELEASES.json
+
+      - name: Upload installers (debug artifact)
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: flowy-llink-windows-signed
+          path: js/out/make/**/*
+          if-no-files-found: warn