Merge branch 'signpath'

lichess-org · Jul 11, 2024 · 01a6f12 · 01a6f12
2 parents 4e196e6 + 3a5b5de
commit 01a6f12
Show file tree

Hide file tree

Showing 2 changed files with 98 additions and 84 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -36,13 +36,13 @@ jobs:
           load: true
       - uses: docker/login-action@v3
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
         if: github.event_name == 'push'
       - uses: docker/metadata-action@v5
         id: meta
         with:
-          images: ${{ secrets.DOCKERHUB_USERNAME }}/fishnet
+          images: ${{ vars.DOCKERHUB_USERNAME }}/fishnet
           tags: |
             type=ref,event=branch
             type=semver,pattern={{major}}
@@ -95,13 +95,27 @@ jobs:
       - run: tar xf intel-sde/sde-external-9.0.0-2021-11-07-win.tar.xz && echo SDE_PATH=$(cygpath -u $GITHUB_WORKSPACE)/sde-external-9.0.0-2021-11-07-win/sde.exe | tee $GITHUB_ENV
         if: steps.sde.outcome == 'success'
       - run: cargo build --release --target x86_64-pc-windows-gnu -vv
-      - run: mv target/x86_64-pc-windows-gnu/release/fishnet.exe fishnet-x86_64-pc-windows-gnu.exe
+      - run: mv target/x86_64-pc-windows-gnu/release/fishnet.exe fishnet-x86_64-pc-windows-gnu-unsigned.exe
+      - uses: actions/upload-artifact@v4
+        id: upload-unsigned-artifact
+        with:
+          name: fishnet-x86_64-pc-windows-gnu-unsigned
+          path: fishnet-x86_64-pc-windows-gnu-unsigned.exe
+      - uses: signpath/github-action-submit-signing-request@v0.4
+        with:
+          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
+          organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
+          project-slug: 'fishnet'
+          signing-policy-slug: ${{ startsWith(github.ref, 'refs/tags/v') && 'release-signing' || 'test-signing' }}
+          github-artifact-id: ${{ steps.upload-unsigned-artifact.outputs.artifact-id }}
+          wait-for-completion: true
+          output-artifact-directory: signed
       - uses: actions/upload-artifact@v4
         with:
           name: fishnet-x86_64-pc-windows-gnu
-          path: fishnet-x86_64-pc-windows-gnu.exe
+          path: signed
   macos-x86-64:
-    runs-on: macos-11
+    runs-on: macos-13
     steps:
       - uses: actions/checkout@v4
         with:
@@ -115,7 +129,7 @@ jobs:
           name: fishnet-x86_64-apple-darwin
           path: fishnet-x86_64-apple-darwin
   macos-aarch64:
-    runs-on: macos-11.0
+    runs-on: macos-12
     env:
       CXXFLAGS: -target arm64-apple-macos11
     steps: