This repository was archived by the owner on Aug 5, 2026. It is now read-only.
ci: remove completed Artifact Signing probe #1106
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build launcher and bump version number | |
| on: | |
| push: | |
| branches: ["main"] | |
| workflow_dispatch: | |
| jobs: | |
| bump-version-number: | |
| outputs: | |
| version_number: ${{ steps.get_new_version.outputs.version_no }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@v7 | |
| - name: check commit type | |
| shell: bash | |
| run: | | |
| if [[ "${{ github.event.head_commit.message }}" == *"release:"* ]]; then | |
| echo "Continuing to build as release" | |
| else | |
| echo "Not a release commit, exiting (note: this may take 5-10 seconds)" | |
| gh run cancel ${{ github.run_id }} | |
| gh run watch ${{ github.run_id }} | |
| fi | |
| env: | |
| GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}} | |
| - name: setup git | |
| run: | | |
| git config --global user.name "Github Actions" | |
| git config --global user.email "actions@github.com" | |
| - name: update file version | |
| id: get_new_version | |
| run: | | |
| #parsed string | |
| export old_version=$(cat "src/AssemblyVersion.cs" |sed -n 's/.*\([0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+\).*/\1/p') | |
| export new_version=$(cat "src/AssemblyVersion.cs" | tail -n 1 | sed -n 's/.*\([0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+\).*/\1/p' | awk -F. -v OFS=. 'NF==1{print ++$NF}; NF>1{if(length($NF+1)>length($NF))$(NF-1)++; $NF=sprintf("%0*d", length($NF), ($NF+1)%(10^length($NF))); print}') | |
| echo $old_version | |
| echo $new_version | |
| echo "version=$new_version" >> $GITHUB_ENV | |
| echo "version_no=$new_version" >> "$GITHUB_OUTPUT" | |
| sed -i "s/$old_version/$new_version/g" "src/AssemblyVersion.cs" | |
| - name: push to origin | |
| run: | | |
| git add "src/AssemblyVersion.cs" | |
| git commit -m "Update file version" | |
| git push origin main | |
| deploy: | |
| needs: bump-version-number | |
| runs-on: windows-2022 | |
| permissions: | |
| packages: write | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ github.ref }} | |
| - name: Output commit type | |
| run: echo " ${{env.OUTPUT1}} $OUTPUT1" | |
| env: | |
| OUTPUT1: ${{ needs.bump-version-number.outputs.version_number}} | |
| - name: Create GitHub App Token | |
| uses: actions/create-github-app-token@v3 | |
| id: app-token | |
| with: | |
| app-id: ${{ secrets.APP_CLIENT_ID }} | |
| private-key: ${{ secrets.APP_PRIVATE_KEY }} | |
| owner: flarialmc | |
| repositories: newcdn | |
| - name: Checkout cdn repository | |
| uses: actions/checkout@v7 | |
| with: | |
| repository: 'flarialmc/newcdn' | |
| ref: 'main' | |
| path: 'cdn' | |
| token: ${{ steps.app-token.outputs.token }} | |
| - name: Setup dotnet | |
| uses: actions/setup-dotnet@v6 | |
| - name: Build | |
| run: | | |
| dotnet publish "src/Flarial.Launcher/Flarial.Launcher.csproj" | |
| - name: Sign in to Azure with GitHub OIDC | |
| uses: azure/login@v3 | |
| with: | |
| client-id: ${{ secrets.AZURE_CLIENT_ID }} | |
| tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
| subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | |
| - name: Sign Flarial.Launcher.exe with Artifact Signing | |
| uses: azure/artifact-signing-action@v2 | |
| with: | |
| endpoint: https://eus.codesigning.azure.net/ | |
| signing-account-name: flarial | |
| certificate-profile-name: flarial-public-trust | |
| files: ${{ github.workspace }}\src\Flarial.Launcher\bin\Release\win-x64\publish\Flarial.Launcher.exe | |
| file-digest: SHA256 | |
| timestamp-rfc3161: http://timestamp.acs.microsoft.com | |
| timestamp-digest: SHA256 | |
| description: Flarial Launcher | |
| description-url: https://github.com/flarialmc/launcher | |
| - name: Verify Authenticode signature | |
| shell: pwsh | |
| env: | |
| REVOKED_SIGNER_THUMBPRINT: 828DC715D160F59887564233C9F53BB4D410D21D | |
| run: | | |
| $launcher = "src/Flarial.Launcher/bin/Release/win-x64/publish/Flarial.Launcher.exe" | |
| $signature = Get-AuthenticodeSignature $launcher | |
| $signature | Format-List Status, StatusMessage, SignerCertificate, TimeStamperCertificate | |
| if ($signature.Status -ne 'Valid') { | |
| throw "Flarial.Launcher.exe signature is not valid: $($signature.Status)" | |
| } | |
| if (-not $signature.SignerCertificate) { | |
| throw "Flarial.Launcher.exe has no signer certificate" | |
| } | |
| if ($signature.SignerCertificate.Thumbprint -eq $env:REVOKED_SIGNER_THUMBPRINT) { | |
| throw "Artifact Signing reused revoked certificate $env:REVOKED_SIGNER_THUMBPRINT" | |
| } | |
| - name: update new version | |
| if: success() | |
| run: | | |
| cd cdn | |
| git config --global user.name "GitHub Actions Bot" | |
| git config --global user.email "actions@example.com" | |
| export new_version="${{ env.OUTPUT1 }}" | |
| contents="$(jq '.version = "'$new_version'"' launcher/launcherVersion.txt)" && \ | |
| echo -E "${contents}" > launcher/launcherVersion.txt | |
| cat launcher/launcherVersion.txt | |
| git add launcher/launcherVersion.txt | |
| git commit -m "Bump launcher version" | |
| git push origin main | |
| cp D:/a/launcher/launcher/src/Flarial.Launcher/bin/Release/win-x64/publish/Flarial.Launcher.exe ./launcher/Flarial.Launcher.exe | |
| git add launcher/Flarial.Launcher.exe | |
| git commit -a -m "Update launcher" | |
| git push origin main | |
| # cp D:/a/launcher/launcher/extras/Flarial.Version.Changer/src/bin/Release/publish/Flarial.Version.Changer.exe ./launcher/Flarial.Version.Changer.exe | |
| # git add launcher/Flarial.Version.Changer.exe | |
| # git commit -a -m "Update version changer" | |
| # git push origin main | |
| env: | |
| OUTPUT1: ${{ needs.bump-version-number.outputs.version_number}} | |
| shell: bash |