build-and-sign-win-installer #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: build-and-sign-win-installer | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| portable_run_id: | |
| description: 'Run ID of the build-and-sign-win-portable run to pull artifacts from (only needed when triggering manually)' | |
| required: false | |
| workflow_run: | |
| workflows: ["build-and-sign-win-portable"] | |
| types: [completed] | |
| jobs: | |
| build-installer: | |
| runs-on: windows-latest | |
| if: github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' | |
| steps: | |
| # ------------------------------------------------------------------ | |
| # 1. Checkout source (need installers/Photoflare.aip) | |
| # ------------------------------------------------------------------ | |
| - name: Checkout photoflare | |
| uses: actions/checkout@v4 | |
| # ------------------------------------------------------------------ | |
| # 2. Get the already-signed portable package | |
| # (produced by the build-and-sign-win-portable workflow) | |
| # ------------------------------------------------------------------ | |
| - name: Download signed portable package | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: photoflare-portable-signed | |
| path: installers\PhotoFlare_Win_AIP | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| repository: ${{ github.repository }} | |
| run-id: ${{ github.event.workflow_run.id || inputs.portable_run_id }} | |
| # ------------------------------------------------------------------ | |
| # 3. Read version from stable.json | |
| # ------------------------------------------------------------------ | |
| - name: Read version from stable.json | |
| id: version | |
| shell: pwsh | |
| run: | | |
| $raw = Get-Content versions\stable.json -Raw | |
| $version = $raw.Trim() | |
| $fullVersion = "$version.0" | |
| Write-Host "Read version: $version -> using $fullVersion" | |
| echo "version=$fullVersion" >> $env:GITHUB_OUTPUT | |
| # ------------------------------------------------------------------ | |
| # 4. Build the installer with Advanced Installer | |
| # ------------------------------------------------------------------ | |
| - name: Build installer with Advanced Installer | |
| uses: caphyon/advinst-github-action@main | |
| with: | |
| advinst-version: '23.9' | |
| advinst-license: '${{ secrets.ADVINST_LICENSE_KEY }}' | |
| advinst-enable-automation: 'true' | |
| aip-path: '${{ github.workspace }}\installers\Photoflare.aip' | |
| aip-build-name: DefaultBuild | |
| aip-output-dir: '${{ github.workspace }}\installer-output' | |
| aip-commands: | | |
| SetVersion ${{ steps.version.outputs.version }} | |
| # ------------------------------------------------------------------ | |
| # 5. Upload the unsigned installer output | |
| # ------------------------------------------------------------------ | |
| - name: Upload unsigned installer | |
| id: upload-unsigned-installer | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: photoflare-installer-unsigned | |
| path: installer-output\*.msi | |
| # ------------------------------------------------------------------ | |
| # 6. Submit to SignPath and wait for the signed result | |
| # ------------------------------------------------------------------ | |
| - name: Submit installer for signing | |
| uses: signpath/github-action-submit-signing-request@v2 | |
| with: | |
| api-token: '${{ secrets.SIGNPATH_API_TOKEN }}' | |
| organization-id: 'a0d93669-036e-4935-85d0-ad3813a95399' | |
| project-slug: 'photoflare' | |
| signing-policy-slug: 'test-signing' | |
| artifact-configuration-slug: 'github-installer' | |
| github-artifact-id: '${{ steps.upload-unsigned-installer.outputs.artifact-id }}' | |
| wait-for-completion: true | |
| output-artifact-directory: 'installer-signed' | |
| # ------------------------------------------------------------------ | |
| # 7. Upload the final signed installer | |
| # ------------------------------------------------------------------ | |
| - name: Upload signed installer | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: photoflare-installer-signed | |
| path: installer-signed\ |