Update workflow to sign Win exe

percy · May 17, 2024 · d8c1cf1 · d8c1cf1
1 parent 78ddd74
commit d8c1cf1
Show file tree

Hide file tree

Showing 3 changed files with 47 additions and 11 deletions.
diff --git a/.github/workflows/executable.yml b/.github/workflows/executable.yml
@@ -1,9 +1,10 @@
 name: Build Executables
 on:
-  release:
-    types: [published]
+  push:
+  pull_request:
+  workflow_dispatch:
 jobs:
-  lint:
+  build:
     name: Build Executables
     runs-on: macos-latest
     steps:
@@ -19,12 +20,38 @@ jobs:
           APPLE_ID_KEY: ${{secrets.APPLE_ID_KEY}}
       - name: Verify executable
         run: ./percy --version
-      - name: Upload assets
-        uses: softprops/action-gh-release@d99959edae48b5ffffd7b00da66dcdb0a33a52ee
+      - name: Upload win artifact
+        uses: actions/upload-artifact@v4
         with:
-          files: |
-            percy-osx.zip
-            percy-linux.zip
-            percy-win.zip
+          name: win-exe
+          path: percy.exe
+      # - name: Upload assets
+      #   uses: softprops/action-gh-release@d99959edae48b5ffffd7b00da66dcdb0a33a52ee
+      #   with:
+      #     files: |
+      #       percy-osx.zip
+      #       percy-linux.zip
+      #   env:
+      #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  notify:
+    needs: build
+    name: Sign Win Executable
+    runs-on: windows-latest
+    steps:
+      - name: Download a single artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: win-exe
+      - run: ./scripts/executable_win.bat
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          WINDOWS_CERT: ${{secrets.WINDOWS_CERT}}
+          WINDOWS_CERT_KEY: ${{secrets.WINDOWS_CERT_KEY}}
+      - name: Verify executable
+        run: ./percy.exe --version
+      # - name: Upload assets
+      #   uses: softprops/action-gh-release@d99959edae48b5ffffd7b00da66dcdb0a33a52ee
+      #   with:
+      #     files: |
+      #       percy-win.zip
+      #   env:
+      #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/scripts/executable.sh b/scripts/executable.sh
@@ -69,7 +69,6 @@ codesign  --force --verbose=4 -s "Developer ID Application: BrowserStack Inc (76
 zip percy-linux.zip percy
 mv percy-osx percy
 zip percy-osx.zip percy
-zip percy-win.zip percy.exe
 
 xcrun notarytool submit --apple-id "$APPLE_ID_USERNAME" --password $APPLE_ID_KEY --team-id 763K6K6H44 percy-osx.zip --wait
 

diff --git a/scripts/executable_win.bat b/scripts/executable_win.bat
@@ -0,0 +1,10 @@
+@echo off
+
+REM Decode base64 encoded certificate and save to CodeSigning.p12
+echo %WINDOWS_CERT% | base64.exe -d > CodeSigning.p12
+
+REM Sign percy.exe using signtool
+signtool.exe sign /fd SHA256 /f CodeSigning.p12 /p %WINDOWS_CERT_KEY% percy.exe
+
+REM Create zip file containing percy.exe
+powershell Compress-Archive -Path percy.exe -DestinationPath percy-win.zip