diff options
| author | Owen Rudge <owen@owenrudge.net> | 2021-05-24 23:03:04 +0100 |
|---|---|---|
| committer | Owen Rudge <owen@owenrudge.net> | 2021-05-26 13:40:44 +0100 |
| commit | 3ce7e31f64d86b3ca58be61407a33380cda072b4 (patch) | |
| tree | c6e65b2e1f07bdfbc898c3b965ffbb5dbb639bb8 /.github | |
| parent | c96945fa2b0487c7ccd5d7c14399e1b95e60c8c4 (diff) | |
| download | openttd-3ce7e31f64d86b3ca58be61407a33380cda072b4.tar.xz | |
Feature: Sign Windows builds
Diffstat (limited to '.github')
| -rw-r--r-- | .github/workflows/release.yml | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 894e9b9eb..447b165f9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -746,6 +746,21 @@ jobs: with: arch: ${{ matrix.host }} + - name: Import code signing certificate + shell: powershell + # If this is run on a fork, there may not be a certificate set up - continue in this case + continue-on-error: true + run: | + $tempFile = [System.IO.Path]::GetTempFileName() + $bytes = [System.Convert]::FromBase64String($env:WINDOWS_CERTIFICATE_P12) + [IO.File]::WriteAllBytes($tempFile, $bytes) + $pwd = ConvertTo-SecureString $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force + Import-PfxCertificate -FilePath $tempFile -CertStoreLocation Cert:\CurrentUser\My -Password $pwd + Remove-Item $tempFile + env: + WINDOWS_CERTIFICATE_P12: ${{ secrets.WINDOWS_CERTIFICATE_P12 }} + WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }} + - name: Build (with installer) if: needs.source.outputs.is_tag == 'true' shell: bash @@ -761,12 +776,15 @@ jobs: -DOPTION_USE_NSIS=ON \ -DHOST_BINARY_DIR=${GITHUB_WORKSPACE}/build-host \ -DCMAKE_BUILD_TYPE=RelWithDebInfo \ + -DWINDOWS_CERTIFICATE_COMMON_NAME="${WINDOWS_CERTIFICATE_COMMON_NAME}" \ # EOF echo "::endgroup::" echo "::group::Build" cmake --build . echo "::endgroup::" + env: + WINDOWS_CERTIFICATE_COMMON_NAME: ${{ secrets.WINDOWS_CERTIFICATE_COMMON_NAME }} - name: Build (without installer) if: needs.source.outputs.is_tag != 'true' @@ -782,12 +800,15 @@ jobs: -DCMAKE_TOOLCHAIN_FILE="c:\vcpkg\scripts\buildsystems\vcpkg.cmake" \ -DHOST_BINARY_DIR=${GITHUB_WORKSPACE}/build-host \ -DCMAKE_BUILD_TYPE=RelWithDebInfo \ + -DWINDOWS_CERTIFICATE_COMMON_NAME="${WINDOWS_CERTIFICATE_COMMON_NAME}" \ # EOF echo "::endgroup::" echo "::group::Build" cmake --build . echo "::endgroup::" + env: + WINDOWS_CERTIFICATE_COMMON_NAME: ${{ secrets.WINDOWS_CERTIFICATE_COMMON_NAME }} - name: Create bundles shell: bash @@ -809,6 +830,17 @@ jobs: rm -f bundles/*.sha256 echo "::endgroup::" + - name: Sign installer + if: needs.source.outputs.is_tag == 'true' + shell: bash + # If this is run on a fork, there may not be a certificate set up - continue in this case + continue-on-error: true + run: | + cd ${GITHUB_WORKSPACE}/build/bundles + ../../os/windows/sign.bat *.exe "${WINDOWS_CERTIFICATE_COMMON_NAME}" + env: + WINDOWS_CERTIFICATE_COMMON_NAME: ${{ secrets.WINDOWS_CERTIFICATE_COMMON_NAME }} + - name: Store bundles uses: actions/upload-artifact@v2 with: |