Bump azure/trusted-signing-action from 0.3.20 to 0.4.0 #32
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pamplejuce | |
| on: | |
| workflow_dispatch: # lets you run a build from the UI | |
| push: | |
| pull_request: | |
| # When pushing new commits, cancel any running builds on that branch | |
| concurrency: | |
| group: ${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| BUILD_TYPE: Release | |
| BUILD_DIR: Builds | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| DISPLAY: :0 # linux pluginval needs this | |
| CMAKE_BUILD_PARALLEL_LEVEL: 3 # Use up to 3 cpus to build juceaide, etc | |
| HOMEBREW_NO_INSTALL_CLEANUP: 1 | |
| IPP_DIR: C:\Program Files (x86)\Intel\oneAPI\ipp\latest\lib\cmake\ipp | |
| # jobs are run in paralell on different machines | |
| # all steps run in series | |
| jobs: | |
| build_and_test: | |
| name: ${{ matrix.name }} | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false # show all errors for each platform (vs. cancel jobs on error) | |
| matrix: | |
| include: | |
| - name: Linux | |
| os: ubuntu-22.04 | |
| pluginval-binary: ./pluginval | |
| - name: macOS | |
| os: macos-14 | |
| pluginval-binary: pluginval.app/Contents/MacOS/pluginval | |
| - name: Windows | |
| os: windows-latest | |
| pluginval-binary: ./pluginval.exe | |
| steps: | |
| # This is just easier than debugging different compilers on different platforms | |
| - name: Set up Clang | |
| if: ${{ matrix.name != 'macOS' }} | |
| uses: egor-tensin/setup-clang@v1 | |
| # This also starts up our "fake" display Xvfb, needed for pluginval | |
| - name: Install JUCE's Linux Deps | |
| if: runner.os == 'Linux' | |
| # Thanks to McMartin & co https://forum.juce.com/t/list-of-juce-dependencies-under-linux/15121/44 | |
| run: | | |
| sudo apt-get update && sudo apt install libasound2-dev libx11-dev libxinerama-dev libxext-dev libfreetype6-dev libwebkit2gtk-4.0-dev libglu1-mesa-dev xvfb ninja-build | |
| # downgrade gcc to workaround 22.04 and C++20 issue | |
| # see: https://github.com/actions/runner-images/issues/8659 | |
| sudo rm -f /etc/apt/sources.list.d/ubuntu-toolchain-r-ubuntu-test-jammy.list | |
| sudo apt-get update | |
| sudo apt-get install -y --allow-downgrades libc6=2.35-0ubuntu3.7 libc6-dev=2.35-0ubuntu3.7 libstdc++6=12.3.0-1ubuntu1~22.04 libgcc-s1=12.3.0-1ubuntu1~22.04 | |
| sudo /usr/bin/Xvfb $DISPLAY & | |
| - name: Cache IPP (Windows) | |
| if: runner.os == 'Windows' | |
| id: cache-ipp | |
| uses: actions/cache@v4 | |
| with: | |
| key: ipp-v4 | |
| path: C:\Program Files (x86)\Intel | |
| - name: Install IPP (Windows) | |
| if: (runner.os == 'Windows') && (steps.cache-ipp.outputs.cache-hit != 'true') | |
| shell: bash | |
| run: | | |
| curl --output oneapi.exe https://registrationcenter-download.intel.com/akdlm/IRC_NAS/8d158661-ca8f-4e66-b5ea-3e0b3d00836a/w_ipp_oneapi_p_2021.10.1.15_offline.exe | |
| ./oneapi.exe -s -x -f oneapi | |
| ./oneapi/bootstrapper.exe -s -c --action install --components=intel.oneapi.win.ipp.devel --eula=accept -p=NEED_VS2022_INTEGRATION=1 --log-dir=. | |
| - name: Save IPP cache (even on CI fail) | |
| if: runner.os == 'Windows' && (steps.cache-ipp.outputs.cache-hit != 'true') | |
| uses: actions/cache/save@v4 | |
| with: | |
| path: C:\Program Files (x86)\Intel | |
| key: ipp-v4 | |
| - name: Install Ninja (Windows) | |
| if: runner.os == 'Windows' | |
| shell: bash | |
| run: choco install ninja | |
| - name: Install macOS Deps | |
| if: ${{ matrix.name == 'macOS' }} | |
| run: brew install ninja osxutils | |
| # This block can be removed once 15.1 is default (JUCE requires it when building on macOS 14) | |
| - name: Use latest Xcode on system (macOS) | |
| if: ${{ matrix.name == 'macOS' }} | |
| uses: maxim-lobanov/setup-xcode@v1 | |
| with: | |
| xcode-version: latest-stable | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| submodules: true # Get JUCE populated | |
| - name: Cache the build | |
| uses: mozilla-actions/[email protected] | |
| - name: Import Certificates (macOS) | |
| uses: apple-actions/import-codesign-certs@v3 # only exists as a tag right now | |
| if: ${{ matrix.name == 'macOS' }} | |
| with: | |
| p12-file-base64: ${{ secrets.DEV_ID_APP_CERT }} | |
| p12-password: ${{ secrets.DEV_ID_APP_PASSWORD }} | |
| - name: Configure | |
| shell: bash | |
| run: cmake -B ${{ env.BUILD_DIR }} -G Ninja -DCMAKE_BUILD_TYPE=${{ env.BUILD_TYPE}} -DCMAKE_C_COMPILER_LAUNCHER=${{ matrix.ccache }} -DCMAKE_CXX_COMPILER_LAUNCHER=${{ matrix.ccache }} -DCMAKE_OSX_ARCHITECTURES="arm64;x86_64" . | |
| - name: Build | |
| shell: bash | |
| run: cmake --build ${{ env.BUILD_DIR }} --config ${{ env.BUILD_TYPE }} --parallel 4 | |
| - name: Test | |
| working-directory: ${{ env.BUILD_DIR }} | |
| run: ctest --output-on-failure -j4 -VV | |
| - name: Read in .env from CMake # see GitHubENV.cmake | |
| shell: bash | |
| run: | | |
| cat .env # show us the config | |
| cat .env >> $GITHUB_ENV # pull in our PRODUCT_NAME, etc | |
| - name: Set additional env vars for next steps | |
| shell: bash | |
| run: | | |
| ARTIFACTS_PATH=${{ env.BUILD_DIR }}/${{ env.PROJECT_NAME }}_artefacts/${{ env.BUILD_TYPE }} | |
| echo "ARTIFACTS_PATH=$ARTIFACTS_PATH" >> $GITHUB_ENV | |
| echo "VST3_PATH=$ARTIFACTS_PATH/VST3/${{ env.PRODUCT_NAME }}.vst3" >> $GITHUB_ENV | |
| echo "AU_PATH=$ARTIFACTS_PATH/AU/${{ env.PRODUCT_NAME }}.component" >> $GITHUB_ENV | |
| echo "AUV3_PATH=$ARTIFACTS_PATH/AUv3/${{ env.PRODUCT_NAME }}.appex" >> $GITHUB_ENV | |
| echo "STANDALONE_PATH=$ARTIFACTS_PATH/Standalone/${{ env.PRODUCT_NAME }}.app" >> $GITHUB_ENV | |
| echo "ARTIFACT_NAME=${{ env.PRODUCT_NAME }}-${{ env.VERSION }}-${{ matrix.name }}" >> $GITHUB_ENV | |
| - name: Pluginval | |
| shell: bash | |
| run: | | |
| curl -LO "https://github.com/Tracktion/pluginval/releases/download/v1.0.3/pluginval_${{ matrix.name }}.zip" | |
| 7z x pluginval_${{ matrix.name }}.zip | |
| ${{ matrix.pluginval-binary }} --strictness-level 10 --verbose --validate "${{ env.VST3_PATH }}" | |
| - name: Codesign (macOS) | |
| if: ${{ matrix.name == 'macOS' }} | |
| run: | | |
| # Each plugin must be code signed | |
| codesign --force -s "${{ secrets.DEVELOPER_ID_APPLICATION}}" -v "${{ env.VST3_PATH }}" --deep --strict --options=runtime --timestamp | |
| codesign --force -s "${{ secrets.DEVELOPER_ID_APPLICATION}}" -v "${{ env.AU_PATH }}" --deep --strict --options=runtime --timestamp | |
| codesign --force -s "${{ secrets.DEVELOPER_ID_APPLICATION}}" -v "${{ env.STANDALONE_PATH }}" --deep --strict --options=runtime --timestamp | |
| - name: Add Custom Icons (macOS) | |
| if: ${{ matrix.name == 'macOS' }} | |
| run: | | |
| # add the icns as its own icon resource (meta!) | |
| sips -i packaging/pamplejuce.icns | |
| # Grab the resource, put in tempfile | |
| DeRez -only icns packaging/pamplejuce.icns > /tmp/icons | |
| # Stuff the resource into the strange Icon? file's resource fork | |
| Rez -a /tmp/icons -o "${{ env.VST3_PATH }}/Icon"$'\r' | |
| Rez -a /tmp/icons -o "${{ env.AU_PATH }}/Icon"$'\r' | |
| # Set custom icon attribute | |
| SetFile -a C "${{ env.VST3_PATH }}" | |
| SetFile -a C "${{ env.AU_PATH }}" | |
| - name: Create DMG, Notarize and Staple (macOS) | |
| if: ${{ matrix.name == 'macOS' }} | |
| run: | | |
| # workaround for https://github.com/LinusU/node-appdmg/issues/234 | |
| python3 -m pip install setuptools --break-system-packages | |
| npm install -g appdmg | |
| mkdir -p packaging/dmg | |
| # Create directories for the dmg symlinks | |
| sudo mkdir -m 755 -p /Library/Audio/Plug-Ins/Components && sudo mkdir -m 755 -p /Library/Audio/Plug-Ins/VST3 | |
| ln -s /Library/Audio/Plug-Ins/Components "packaging/dmg/Your Mac's Component folder" | |
| ln -s /Library/Audio/Plug-Ins/VST3 "packaging/dmg/Your Mac's VST3 folder" | |
| mv "${{ env.VST3_PATH }}" packaging/dmg | |
| mv "${{ env.AU_PATH }}" packaging/dmg | |
| mv "${{ env.STANDALONE_PATH }}" packaging/dmg | |
| # Run appdmg to create the .dmg | |
| cd packaging && appdmg dmg.json "${{ env.ARTIFACT_NAME}}.dmg" | |
| codesign -s "${{ secrets.DEVELOPER_ID_APPLICATION}}" --timestamp -i ${{ env.BUNDLE_ID }} --force "${{ env.ARTIFACT_NAME }}.dmg" | |
| xcrun notarytool submit "${{ env.ARTIFACT_NAME }}.dmg" --apple-id ${{ secrets.NOTARIZATION_USERNAME }} --password ${{ secrets.NOTARIZATION_PASSWORD }} --team-id ${{ secrets.TEAM_ID }} --wait | |
| xcrun stapler staple "${{ env.ARTIFACT_NAME }}.dmg" | |
| - name: Zip | |
| if: ${{ matrix.name == 'Linux' }} | |
| working-directory: ${{ env.ARTIFACTS_PATH }} | |
| run: 7z a -tzip "${{ env.ARTIFACT_NAME }}.zip" "-xr!lib${{ env.PRODUCT_NAME }}_SharedCode.a" . | |
| - name: Generate Installer | |
| if: ${{ matrix.name == 'Windows' }} | |
| shell: bash | |
| run: | | |
| iscc "packaging\installer.iss" | |
| mv "packaging/Output/${{ env.ARTIFACT_NAME }}.exe" "${{ env.ARTIFACTS_PATH }}/" | |
| - name: Codesign with Azure Trusted Signing | |
| if: ${{ matrix.name == 'Windows' }} | |
| uses: azure/[email protected] | |
| with: | |
| # The Azure Active Directory tenant (directory) ID. | |
| azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
| # The client (application) ID of an App Registration in the tenant. | |
| azure-client-id: ${{ secrets.AZURE_CLIENT_ID }} | |
| # A client secret that was generated for the App Registration. | |
| azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }} | |
| # The Code Signing Account endpoint. The URI value must have a URI that aligns to the region your Code Signing Account and Certificate Profile you are specifying were created in during the setup of these resources. | |
| endpoint: ${{ secrets.AZURE_ENDPOINT }} | |
| # The Code Signing Account name. | |
| code-signing-account-name: ${{ secrets.AZURE_CODE_SIGNING_NAME }} | |
| # The Certificate Profile name. | |
| certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_NAME }} | |
| # This signs all exes inside the folder | |
| files-folder: ${{ env.ARTIFACTS_PATH }} | |
| files-folder-filter: exe | |
| file-digest: SHA256 | |
| - name: Upload Exe (Windows) | |
| if: ${{ matrix.name == 'Windows' }} | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ${{ env.ARTIFACT_NAME }}.exe | |
| path: "${{ env.ARTIFACTS_PATH }}/${{ env.ARTIFACT_NAME }}.exe" | |
| - name: Upload Zip (Linux) | |
| if: ${{ matrix.name == 'Linux' }} | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ${{ env.ARTIFACT_NAME }}.zip | |
| path: "${{ env.ARTIFACTS_PATH }}/${{ env.ARTIFACT_NAME }}.zip" | |
| - name: Upload DMG (macOS) | |
| if: ${{ matrix.name == 'macOS' }} | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ${{ env.ARTIFACT_NAME }}.dmg | |
| path: packaging/${{ env.ARTIFACT_NAME }}.dmg | |
| release: | |
| if: contains(github.ref, 'tags/v') | |
| runs-on: ubuntu-latest | |
| needs: build_and_test | |
| steps: | |
| - name: Get Artifacts | |
| uses: actions/download-artifact@v4 | |
| - name: Create Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| prerelease: true | |
| # download-artifact puts these files in their own dirs... | |
| # Using globs sidesteps having to pass the version around | |
| files: | | |
| */*.exe | |
| */*.zip | |
| */*.dmg |