mirror of
https://github.com/ivuorinen/hiha-arvio.git
synced 2026-01-26 03:14:00 +00:00
- Add least-privilege permissions to all GitHub Actions jobs - Fixes 8 CodeQL security findings (actions/missing-workflow-permissions) - Build jobs: contents:read, actions:write - Release job: contents:write, actions:read - Test job: contents:read, checks:write, actions:write - Status jobs: no permissions needed Follows principle of least privilege and GitHub Actions security best practices.
236 lines
8.3 KiB
YAML
236 lines
8.3 KiB
YAML
name: Publish
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*.*.*'
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: 'Version to publish (e.g., 1.0.0)'
|
|
required: true
|
|
type: string
|
|
|
|
env:
|
|
DOTNET_VERSION: '8.0.x'
|
|
|
|
jobs:
|
|
build-ios:
|
|
name: Build iOS
|
|
runs-on: macos-latest
|
|
permissions:
|
|
contents: read
|
|
actions: write
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
|
|
|
|
- name: Get version
|
|
id: get_version
|
|
run: |
|
|
if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
|
|
echo "version=${{ github.event.inputs.version }}" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- name: Setup .NET
|
|
uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
|
|
with:
|
|
dotnet-version: ${{ env.DOTNET_VERSION }}
|
|
|
|
- name: Restore workloads
|
|
run: dotnet workload restore src/HihaArvio/HihaArvio.csproj
|
|
|
|
- name: Build iOS Release
|
|
run: |
|
|
dotnet publish src/HihaArvio/HihaArvio.csproj \
|
|
-f net8.0-ios \
|
|
-c Release \
|
|
/p:ApplicationDisplayVersion=${{ steps.get_version.outputs.version }} \
|
|
/p:ApplicationVersion=${{ github.run_number }} \
|
|
/p:ArchiveOnBuild=false \
|
|
/p:EnableCodeSigning=false
|
|
|
|
- name: Create iOS artifact archive
|
|
run: |
|
|
cd src/HihaArvio/bin/Release/net8.0-ios
|
|
# Find the .app bundle (it's in a subdirectory like iossimulator-arm64 or ios-arm64)
|
|
APP_PATH=$(find . -name "*.app" -type d | head -n 1)
|
|
if [ -z "$APP_PATH" ]; then
|
|
echo "Error: No .app bundle found"
|
|
exit 1
|
|
fi
|
|
zip -r HihaArvio-iOS-${{ steps.get_version.outputs.version }}.zip "$APP_PATH"
|
|
mv HihaArvio-iOS-${{ steps.get_version.outputs.version }}.zip ${{ github.workspace }}/
|
|
|
|
- name: Upload iOS artifact
|
|
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
|
|
with:
|
|
name: ios-release
|
|
path: HihaArvio-iOS-${{ steps.get_version.outputs.version }}.zip
|
|
retention-days: 7
|
|
|
|
build-maccatalyst:
|
|
name: Build macOS
|
|
runs-on: macos-latest
|
|
permissions:
|
|
contents: read
|
|
actions: write
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
|
|
|
|
- name: Get version
|
|
id: get_version
|
|
run: |
|
|
if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
|
|
echo "version=${{ github.event.inputs.version }}" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- name: Setup .NET
|
|
uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
|
|
with:
|
|
dotnet-version: ${{ env.DOTNET_VERSION }}
|
|
|
|
- name: Restore workloads
|
|
run: dotnet workload restore src/HihaArvio/HihaArvio.csproj
|
|
|
|
- name: Build macOS Catalyst Release
|
|
run: |
|
|
dotnet publish src/HihaArvio/HihaArvio.csproj \
|
|
-f net8.0-maccatalyst \
|
|
-c Release \
|
|
/p:ApplicationDisplayVersion=${{ steps.get_version.outputs.version }} \
|
|
/p:ApplicationVersion=${{ github.run_number }} \
|
|
/p:ArchiveOnBuild=false \
|
|
/p:EnableCodeSigning=false
|
|
|
|
- name: Create macOS artifact archive
|
|
run: |
|
|
cd src/HihaArvio/bin/Release/net8.0-maccatalyst
|
|
# Find the .app bundle (it's in a subdirectory like maccatalyst-x64 or maccatalyst-arm64)
|
|
APP_PATH=$(find . -name "*.app" -type d | head -n 1)
|
|
if [ -z "$APP_PATH" ]; then
|
|
echo "Error: No .app bundle found"
|
|
exit 1
|
|
fi
|
|
zip -r HihaArvio-macOS-${{ steps.get_version.outputs.version }}.zip "$APP_PATH"
|
|
mv HihaArvio-macOS-${{ steps.get_version.outputs.version }}.zip ${{ github.workspace }}/
|
|
|
|
- name: Upload macOS artifact
|
|
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
|
|
with:
|
|
name: maccatalyst-release
|
|
path: HihaArvio-macOS-${{ steps.get_version.outputs.version }}.zip
|
|
retention-days: 7
|
|
|
|
create-release:
|
|
name: Create Release
|
|
runs-on: ubuntu-latest
|
|
needs: [build-ios, build-maccatalyst]
|
|
if: always() && needs.build-ios.result == 'success' && needs.build-maccatalyst.result == 'success'
|
|
permissions:
|
|
contents: write
|
|
actions: read
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Get version
|
|
id: get_version
|
|
run: |
|
|
if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
|
|
echo "version=${{ github.event.inputs.version }}" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- name: Generate changelog
|
|
id: changelog
|
|
run: |
|
|
if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
|
|
echo "changelog=Manual release of version ${{ steps.get_version.outputs.version }}" >> $GITHUB_OUTPUT
|
|
else
|
|
# Get commits since last tag
|
|
PREVIOUS_TAG=$(git describe --abbrev=0 --tags $(git rev-list --tags --skip=1 --max-count=1) 2>/dev/null || echo "")
|
|
if [[ -z "$PREVIOUS_TAG" ]]; then
|
|
CHANGELOG=$(git log --pretty=format:"- %s (%h)" --no-merges)
|
|
else
|
|
CHANGELOG=$(git log ${PREVIOUS_TAG}..HEAD --pretty=format:"- %s (%h)" --no-merges)
|
|
fi
|
|
echo "changelog<<EOF" >> $GITHUB_OUTPUT
|
|
echo "$CHANGELOG" >> $GITHUB_OUTPUT
|
|
echo "EOF" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- name: Download iOS artifact
|
|
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
|
with:
|
|
name: ios-release
|
|
|
|
- name: Download macOS artifact
|
|
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
|
|
with:
|
|
name: maccatalyst-release
|
|
|
|
- name: Create Release
|
|
uses: softprops/action-gh-release@5be0e66d93ac7ed76da52eca8bb058f665c3a5fe # v2.4.2
|
|
with:
|
|
tag_name: ${{ github.event_name == 'workflow_dispatch' && format('v{0}', github.event.inputs.version) || github.ref_name }}
|
|
name: Release ${{ steps.get_version.outputs.version }}
|
|
body: |
|
|
## HihaArvio v${{ steps.get_version.outputs.version }}
|
|
|
|
Sleeve Estimate - A playful Finnish take on agile estimation through shake gestures.
|
|
|
|
### Changes
|
|
${{ steps.changelog.outputs.changelog }}
|
|
|
|
### Supported Platforms
|
|
- iOS 15.0+
|
|
- macOS 12.0+ (via Mac Catalyst)
|
|
|
|
### Installation
|
|
- **iOS**: Download the `.zip` file, extract, and install via Xcode or TestFlight
|
|
- **macOS**: Download the `.zip` file, extract, and move to Applications folder
|
|
draft: false
|
|
prerelease: ${{ contains(steps.get_version.outputs.version, 'alpha') || contains(steps.get_version.outputs.version, 'beta') || contains(steps.get_version.outputs.version, 'rc') }}
|
|
files: |
|
|
HihaArvio-iOS-${{ steps.get_version.outputs.version }}.zip
|
|
HihaArvio-macOS-${{ steps.get_version.outputs.version }}.zip
|
|
|
|
publish-status:
|
|
name: Publish Status
|
|
runs-on: ubuntu-latest
|
|
needs: [build-ios, build-maccatalyst, create-release]
|
|
if: always()
|
|
permissions: {}
|
|
|
|
steps:
|
|
- name: Check publish status
|
|
run: |
|
|
echo "## Release Summary" >> $GITHUB_STEP_SUMMARY
|
|
echo "" >> $GITHUB_STEP_SUMMARY
|
|
echo "### Build Status" >> $GITHUB_STEP_SUMMARY
|
|
echo "- iOS: ${{ needs.build-ios.result }}" >> $GITHUB_STEP_SUMMARY
|
|
echo "- macOS Catalyst: ${{ needs.build-maccatalyst.result }}" >> $GITHUB_STEP_SUMMARY
|
|
echo "- Release: ${{ needs.create-release.result }}" >> $GITHUB_STEP_SUMMARY
|
|
|
|
if [[ "${{ needs.build-ios.result }}" == "success" ]] && [[ "${{ needs.build-maccatalyst.result }}" == "success" ]] && [[ "${{ needs.create-release.result }}" == "success" ]]; then
|
|
echo "" >> $GITHUB_STEP_SUMMARY
|
|
echo "✅ All builds succeeded and artifacts published" >> $GITHUB_STEP_SUMMARY
|
|
exit 0
|
|
else
|
|
echo "" >> $GITHUB_STEP_SUMMARY
|
|
echo "❌ One or more steps failed" >> $GITHUB_STEP_SUMMARY
|
|
exit 1
|
|
fi
|