Repository navigation
116 lines (99 loc) · 4.15 KB
/
Copy pathrelease.yml
File metadata and controls
116 lines (99 loc) · 4.15 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
name: Release
on:
push:
tags: ["v*"]
permissions:
contents: write # create the release and upload assets
id-token: write # for build-provenance attestation
attestations: write # for build-provenance attestation
jobs:
release:
runs-on: ubuntu-latest
steps:
- name: Check out
uses: actions/checkout@v4
- name: Set up Go
uses: actions/setup-go@v5
with:
go-version-file: go.mod
check-latest: true
- name: Run tests before releasing
run: go test ./... -count=1
- name: Cross-build all targets
run: |
mkdir -p dist
VERSION="${GITHUB_REF_NAME}"
for t in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64 windows/arm64; do
os="${t%/*}"; arch="${t#*/}"; ext=""
[ "$os" = "windows" ] && ext=".exe"
out="dist/httpsdiag-${os}-${arch}${ext}"
echo "building $out"
CGO_ENABLED=0 GOOS="$os" GOARCH="$arch" \
go build -trimpath -ldflags "-s -w -X main.build=${VERSION}" -o "$out" ./cmd/httpsdiag
done
( cd dist && sha256sum * > SHA256SUMS )
cat dist/SHA256SUMS
- name: Attest build provenance
uses: actions/attest-build-provenance@v2
with:
subject-path: "dist/httpsdiag-*"
- name: Publish GitHub release
env:
GH_TOKEN: ${{ github.token }}
run: |
# A tag with a pre-release suffix (e.g. v0.1.0-rc1) is marked
# pre-release; a clean tag (v0.1.0) is an official release.
FLAGS=""
case "${GITHUB_REF_NAME}" in
*-*) FLAGS="--prerelease" ;;
esac
gh release create "${GITHUB_REF_NAME}" dist/* \
--title "${GITHUB_REF_NAME}" \
$FLAGS \
--notes "$(cat <<'NOTES'
HTTPS Diagnostic Workbench.
Early 0.x release: interfaces and behavior may still change.
Unsigned binaries — not code-signed for macOS Gatekeeper or Windows
SmartScreen, so your OS warns on first run. Verify what you downloaded:
- checksums: SHA256SUMS (`shasum -a 256 -c SHA256SUMS`)
- build provenance: `gh attestation verify <file> --repo ${{ github.repository }}`
macOS: download httpsdiag-macos-universal-app.zip, unzip, then
right-click the app -> Open (first time only). For the CLI binary:
`xattr -d com.apple.quarantine httpsdiag-darwin-*`.
Run it and open the printed http://127.0.0.1:<port>/ URL. Tests run on
Linux, macOS, and Windows in CI. Still pending: an independent security
review of the local API, and manual multi-OS click-testing.
NOTES
)"
package-macos:
needs: release
runs-on: macos-latest
permissions:
contents: write
id-token: write
attestations: write
steps:
- name: Check out
uses: actions/checkout@v4
- name: Set up Go
uses: actions/setup-go@v5
with:
go-version-file: go.mod
check-latest: true
- name: Build universal binary and package .app
run: |
VERSION="${GITHUB_REF_NAME}"
mkdir -p build dist
CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -trimpath -ldflags "-s -w -X main.build=${VERSION}" -o build/httpsdiag-amd64 ./cmd/httpsdiag
CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build -trimpath -ldflags "-s -w -X main.build=${VERSION}" -o build/httpsdiag-arm64 ./cmd/httpsdiag
lipo -create -output build/httpsdiag-universal build/httpsdiag-amd64 build/httpsdiag-arm64
sh scripts/package-macos.sh build/httpsdiag-universal "${VERSION}" dist
( cd dist && ditto -c -k --keepParent "HTTPS Diagnostic Workbench.app" "httpsdiag-macos-universal-app.zip" )
- name: Attest build provenance
uses: actions/attest-build-provenance@v2
with:
subject-path: "dist/httpsdiag-macos-universal-app.zip"
- name: Upload .app to the release
env:
GH_TOKEN: ${{ github.token }}
run: gh release upload "${GITHUB_REF_NAME}" "dist/httpsdiag-macos-universal-app.zip" --clobber