new-FrontEnd/.github/workflows/build.yml at main · OpenSysKit/new-FrontEnd · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
name: Build

on:
  workflow_dispatch:
  push:
    branches: [ main, master ]
  pull_request:
    branches: [ main, master ]

jobs:
  build:
    name: Build Avalonia win-x64
    runs-on: windows-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: "8.0.x"

      - name: Publish win-x64
        shell: pwsh
        run: |
          dotnet publish OpenSysKit.UI.csproj `
            -c Release `
            -r win-x64 `
            --self-contained true `
            -p:PublishSingleFile=true `
            -p:EnableCompressionInSingleFile=false `
            -p:IncludeNativeLibrariesForSelfExtract=true `
            -p:DebugSymbols=false `
            -p:DebugType=None `
            -o publish

      - name: Sign frontend executable
        if: github.event_name != 'pull_request'
        shell: pwsh
        env:
          CODESIGN_PFX: ${{ secrets.CODESIGN_PFX }}
          CODESIGN_PASSWORD: ${{ secrets.CODESIGN_PASSWORD }}
        run: |
          if (-not $env:CODESIGN_PFX) { throw "CODESIGN_PFX 未设置，拒绝生成未签名前端产物" }
          if (-not $env:CODESIGN_PASSWORD) { throw "CODESIGN_PASSWORD 未设置" }
          $certPath = Join-Path $env:RUNNER_TEMP "codesign.pfx"
          $b64 = $env:CODESIGN_PFX -replace '\s', ''
          [IO.File]::WriteAllBytes($certPath, [Convert]::FromBase64String($b64))
          $signtool = Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin" `
            -Recurse -Filter "signtool.exe" -ErrorAction SilentlyContinue |
            Where-Object { $_.FullName -match "x64" } |
            Sort-Object FullName -Descending |
            Select-Object -First 1
          if (-not $signtool) { throw "signtool.exe not found" }
          & $signtool.FullName sign `
            /fd SHA256 `
            /f $certPath `
            /p $env:CODESIGN_PASSWORD `
            /tr http://timestamp.digicert.com `
            /td SHA256 `
            "publish\OpenSysKit.UI.exe"
          if ($LASTEXITCODE -ne 0) { throw "前端签名失败" }
          $sig = Get-AuthenticodeSignature "publish\OpenSysKit.UI.exe"
          if (-not $sig.SignerCertificate) { throw "前端签名校验失败" }
          Remove-Item $certPath -Force

      - name: Archive output
        shell: pwsh
        run: |
          $artifactsDir = "artifacts"
          New-Item -ItemType Directory -Path $artifactsDir -Force | Out-Null
          $items = Get-ChildItem publish -Force |
            Where-Object { $_.Extension -ne '.pdb' } |
            Select-Object -ExpandProperty FullName
          Compress-Archive -Path $items -DestinationPath (Join-Path $artifactsDir "OpenSysKit.UI-win-x64.zip") -CompressionLevel Optimal

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: OpenSysKit-UI-win-x64
          path: artifacts/OpenSysKit.UI-win-x64.zip
          if-no-files-found: error