MyNoSQL/.github/workflows/release-artifacts.yml at main · nitheeshmk41/MyNoSQL · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
name: Release Artifacts

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

on:
  release:
    types: [published]
  workflow_dispatch:

permissions:
  contents: write

jobs:
  build-windows-zip:
    runs-on: windows-latest
    env:
      WINDOWS_CERT_BASE64: ${{ secrets['WINDOWS_CERT_BASE64'] }}
      WINDOWS_CERT_PASSWORD: ${{ secrets['WINDOWS_CERT_PASSWORD'] }}
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Read app version
        id: app_version
        shell: powershell
        run: |
          [xml]$pom = Get-Content pom.xml
          "version=$($pom.project.version)" >> $env:GITHUB_OUTPUT

      - name: Set up Java 17
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: "17"

      - name: Verify packaging tools
        shell: powershell
        run: |
          where.exe jpackage

      - name: Build shaded jar
        shell: cmd
        run: mvnw.cmd -B clean package

      - name: Create Windows app-image
        shell: powershell
        run: |
          $jar = Get-ChildItem target -Filter 'mynosql-*.jar' |
            Where-Object { $_.Name -notlike 'original-*' } |
            Select-Object -First 1

          if (-not $jar) {
            throw "Could not find packaged JAR in target/."
          }

          New-Item -Path dist-app -ItemType Directory -Force | Out-Null

          jpackage `
            --type app-image `
            --name MyNoSQL `
            --input target `
            --main-jar $jar.Name `
            --main-class com.mynosql.Main `
            --dest dist-app `
            --win-console

      - name: Sign MyNoSQL.exe (optional)
        if: env.WINDOWS_CERT_BASE64 != '' && env.WINDOWS_CERT_PASSWORD != ''
        shell: powershell
        run: |
          $certPath = Join-Path $env:RUNNER_TEMP "codesign.pfx"
          [System.IO.File]::WriteAllBytes($certPath, [Convert]::FromBase64String($env:WINDOWS_CERT_BASE64))

          $signtool = Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin" -Recurse -Filter signtool.exe |
            Sort-Object FullName -Descending |
            Select-Object -First 1

          if (-not $signtool) {
            throw "signtool.exe was not found on the runner."
          }

          & $signtool.FullName sign `
            /fd SHA256 `
            /f $certPath `
            /p "$env:WINDOWS_CERT_PASSWORD" `
            /tr http://timestamp.digicert.com `
            /td SHA256 `
            "dist-app\MyNoSQL\MyNoSQL.exe"

          if ($LASTEXITCODE -ne 0) {
            throw "Code signing failed."
          }

      - name: Skip signing (no cert configured)
        if: env.WINDOWS_CERT_BASE64 == '' || env.WINDOWS_CERT_PASSWORD == ''
        shell: powershell
        run: |
          Write-Host "Signing skipped. Configure WINDOWS_CERT_BASE64 and WINDOWS_CERT_PASSWORD secrets to enable signing."

      - name: Verify signature
        if: env.WINDOWS_CERT_BASE64 != '' && env.WINDOWS_CERT_PASSWORD != ''
        shell: powershell
        run: |
          Get-AuthenticodeSignature "dist-app\MyNoSQL\MyNoSQL.exe" | Format-List *

      - name: Zip Windows app-image
        shell: powershell
        run: |
          New-Item -Path dist -ItemType Directory -Force | Out-Null
          Compress-Archive `
            -Path dist-app/MyNoSQL `
            -DestinationPath dist/MyNoSQL-${{ steps.app_version.outputs.version }}-windows-app.zip `
            -Force

      - name: Upload Windows ZIP artifact
        uses: actions/upload-artifact@v4
        with:
          name: mynosql-windows-zip
          path: dist/*.zip

      - name: Attach Windows ZIP to GitHub release
        if: github.event_name == 'release'
        uses: softprops/action-gh-release@v2
        with:
          files: dist/*.zip