name: Build
on:
push:
tags:
- "v*"
branches:
- main
pull_request:
branches:
- '*'
permissions:
attestations: write
contents: read
id-token: write
jobs:
build:
strategy:
matrix:
platform:
- host: macos-latest
os_name: darwin
file_name: doom-status
- host: ubuntu-latest
os_name: linux
file_name: doom-status
- host: windows-latest
os_name: windows
file_name: doom-status.exe
runs-on: ${{ matrix.platform.host }}
steps:
- name: Harden Runner
uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 with:
egress-policy: block
allowed-endpoints: >
api.github.com:443
archive.ubuntu.com:80
azure.archive.ubuntu.com:80
api.github.com:443
crates.io:443
esm.ubuntu.com:443
fulcio.sigstore.dev:443
github.com:443
index.crates.io:443
motd.ubuntu.com:443
ppa.launchpadcontent.net:443
rekor.sigstore.dev:443
security.ubuntu.com:80
static.crates.io:443
static.rust-lang.org:443
- name: Install Dependencies (Linux)
run: sudo apt-get install -y libgtk-3-dev libglib2.0-dev build-essential
if: matrix.platform.host == 'ubuntu-latest'
- name: Install extra tools (Windows)
uses: ChristopheLav/windows-sdk-install@88d72875fb873886ea398ed04041446da6f26f86 with:
version-sdk: 22621
features: 'OptionId.DesktopCPPx64,OptionId.DesktopCPParm64'
if: matrix.platform.host == 'windows-latest'
- run: rustup target install aarch64-pc-windows-msvc
if: matrix.platform.host == 'windows-latest'
- run: rustup target install x86_64-apple-darwin
if: matrix.platform.host == 'macos-latest'
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
- name: Setup Rust toolchain
run: rustup show && rustup update
- name: Build
run: cargo build --release
- name: Build Windows arm64
run: |
cargo build --release --target=aarch64-pc-windows-msvc
mv target/aarch64-pc-windows-msvc/release/doom-status.exe target/aarch64-pc-windows-msvc/release/doom-status-arm64.exe
if: matrix.platform.host == 'windows-latest'
- name: Build Mac x86_64
run: |
cargo build --release --target=x86_64-apple-darwin
lipo -create -output doom-status-universal target/release/doom-status target/x86_64-apple-darwin/release/doom-status
cp doom-status-universal target/release/${{ matrix.platform.file_name }}
mkdir Doom\ Status.app
mkdir Doom\ Status.app/Contents
mkdir Doom\ Status.app/Contents/MacOS
mkdir Doom\ Status.app/Contents/Resources
mv doom-status-universal Doom\ Status.app/Contents/MacOS/doom-status
cp macos/AppIcon.icns Doom\ Status.app/Contents/Resources/
cp macos/Info.plist Doom\ Status.app/Contents/
cp macos/PkgInfo Doom\ Status.app/Contents/
mkdir -p private_keys/
echo -n "${{ secrets.CERTIFICATE_P12 }}" | base64 --decode -o private_keys/cert.p12
if: matrix.platform.host == 'macos-latest'
- name: Sign Mac binary
uses: indygreg/apple-code-sign-action@44d0985b7f4363198e80b6fea63ac3e9dd3e9957 with:
input_path: 'Doom Status.app'
p12_file: private_keys/cert.p12
p12_password: ${{ secrets.CERTIFICATE_PASSWORD }}
sign_args: |
--for-notarization
rcodesign_version: '0.29.0'
if: matrix.platform.host == 'macos-latest'
- name: Compress Mac app & Notarize
run: |
zip -r Doom\ Status.zip Doom\ Status.app
echo 000000000000 > private_keys/cert.p12
rm -rf private_keys/
xcrun notarytool submit Doom\ Status.zip --apple-id ${{ secrets.APPLE_ID }} --password ${{ secrets.API_PASSWORD }} --team-id ${{ secrets.APPLE_TEAM_ID }} --wait
xcrun stapler staple Doom\ Status.app
rm Doom\ Status.zip
zip -r Doom\ Status.zip Doom\ Status.app
mv Doom\ Status.zip Doom\ Status\ macOS.zip
if: matrix.platform.host == 'macos-latest'
- uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb with:
subject-path: target/release/${{ matrix.platform.file_name }}
if: startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'
- uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb with:
subject-path: target/aarch64-pc-windows-msvc/release/doom-status-arm64.exe
if: matrix.platform.host == 'windows-latest' && startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'
- uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb with:
subject-path: Doom\ Status.app/Contents/MacOS/doom-status
if: matrix.platform.host == 'macos-latest' && startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'
- run: mv target/release/${{ matrix.platform.file_name }} target/release/${{ matrix.platform.file_name }}_${{ matrix.platform.os_name }}
if: matrix.platform.host != 'windows-latest'
- name: Upload ${{ matrix.platform.os_name }}
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 with:
name: doom-status_${{ matrix.platform.os_name }}
path: target/release/${{ matrix.platform.file_name }}_${{ matrix.platform.os_name }}
if-no-files-found: error
retention-days: 5
if: matrix.platform.host != 'windows-latest'
- name: Upload ${{ matrix.platform.os_name }}
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 with:
name: doom-status.exe
path: target/release/${{ matrix.platform.file_name }}
if-no-files-found: error
retention-days: 5
if: matrix.platform.host == 'windows-latest'
- name: Upload Windows Arm64
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 with:
name: doom-status-arm64.exe
path: target/aarch64-pc-windows-msvc/release/doom-status-arm64.exe
if-no-files-found: error
retention-days: 5
if: matrix.platform.host == 'windows-latest'
- name: Upload Mac OS binary
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 with:
name: 'Doom Status macOS.zip'
path: 'Doom Status macOS.zip'
compression-level: 0
if-no-files-found: error
retention-days: 5
if: matrix.platform.host == 'macos-latest'
release:
if: startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'
runs-on: ubuntu-latest
permissions:
contents: write
needs: [ build ]
steps:
- uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 with:
name: 'Doom Status macOS.zip'
- uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 with:
name: doom-status_linux
- uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 with:
name: doom-status.exe
- uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 with:
name: doom-status-arm64.exe
- uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 with:
name: doom-status_darwin
- run: mv doom-status_linux doom-status_linux_x86_64
- uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda with:
draft: true
prerelease: true
generate_release_notes: true
files: |
Doom\ Status\ macOS.zip
doom-status_linux_x86_64
doom-status_darwin
doom-status.exe
doom-status-arm64.exe