7eb1b71a5b
## Summary Audit of CI/CD workflows (`.github/workflows/**`, `azure-pipelines.yml`) for outdated actions, focused on the Node 20 → Node 24 runner deprecation. Most actions were already migrated; this PR cleans up the remaining stragglers and closes the gap that let them drift. ## Changes | Action | File(s) | From | To | Reason | |---|---|---|---|---| | `softprops/action-gh-release` | `create-release.yml`, `build-tool-release.yml` | `v2` | `v3` | v2 still runs Node 20; v3 is a pure Node 24 runtime move, inputs unchanged (drop-in) | | `dotnet/nbgv` | `create-release.yml` | `v0.5.1` | `v0.5.2` | Node 24 runtime bump | | `SethCohen/github-releases-to-discord` | `post-release-discord.yml` | `v1.19.0` | `v1.20.0` | Latest; adds manual-dispatch test support | | Dependabot | `dependabot.yml` | nuget only | + `github-actions` (weekly) | Auto-PR future action bumps instead of manual audits | ## Already current (no change) `actions/checkout@v6`, `actions/setup-dotnet@v5`, `actions/upload-artifact@v7`, `actions/download-artifact@v8`, and `signpath/...@v2` are all on current majors running the Node 24 runtime. The Azure tasks (`UseDotNet@2`, `NuGetAuthenticate@1`) are current as well. ## Notes - All target versions verified against GitHub's release API. - `action-gh-release@v3` release notes confirm it's a runtime-only change with no input/behavior changes — safe drop-in for both usages.
163 lines
4.6 KiB
YAML
163 lines
4.6 KiB
YAML
name: Build Tool Release
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'Projects/BuildTool/**'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ${{ matrix.os }}
|
|
name: Build (${{ matrix.rid }})
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- os: windows-latest
|
|
rid: win-x64
|
|
artifact: build-tool-win-x64.exe
|
|
- os: windows-latest
|
|
rid: win-arm64
|
|
artifact: build-tool-win-arm64.exe
|
|
- os: macos-15
|
|
rid: osx-arm64
|
|
artifact: build-tool-osx-arm64
|
|
- os: ubuntu-latest
|
|
rid: linux-x64
|
|
artifact: build-tool-linux-x64
|
|
- os: ubuntu-24.04-arm
|
|
rid: linux-arm64
|
|
artifact: build-tool-linux-arm64
|
|
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 0 # Full clone required for Nerdbank.GitVersioning
|
|
|
|
- name: Install .NET
|
|
uses: actions/setup-dotnet@v5
|
|
with:
|
|
global-json-file: global.json
|
|
|
|
- name: Publish NativeAOT
|
|
run: dotnet publish Projects/BuildTool/BuildTool.csproj -c Release -r ${{ matrix.rid }} -o publish/
|
|
|
|
- name: Rename artifact (Unix)
|
|
if: runner.os != 'Windows'
|
|
run: mv publish/build-tool publish/${{ matrix.artifact }}
|
|
|
|
- name: Rename artifact (Windows)
|
|
if: runner.os == 'Windows'
|
|
run: mv publish/build-tool.exe publish/${{ matrix.artifact }}
|
|
shell: bash
|
|
|
|
- name: Upload artifact
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: ${{ matrix.artifact }}
|
|
path: publish/${{ matrix.artifact }}
|
|
|
|
sign:
|
|
needs: build
|
|
if: github.ref == 'refs/heads/main'
|
|
runs-on: ubuntu-latest
|
|
name: Sign (${{ matrix.artifact }})
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
id-token: write
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- artifact: build-tool-win-x64.exe
|
|
- artifact: build-tool-win-arm64.exe
|
|
|
|
steps:
|
|
- name: Download unsigned artifact
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
name: ${{ matrix.artifact }}
|
|
path: unsigned/
|
|
|
|
- name: Upload for signing
|
|
id: upload-for-signing
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: ${{ matrix.artifact }}-unsigned
|
|
path: unsigned/${{ matrix.artifact }}
|
|
|
|
- name: Submit signing request
|
|
id: submit
|
|
uses: signpath/github-action-submit-signing-request@v2
|
|
with:
|
|
api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
|
|
organization-id: '${{ secrets.SIGNPATH_ORGANIZATION_ID }}'
|
|
project-slug: 'modernuo'
|
|
signing-policy-slug: 'release-signing'
|
|
artifact-configuration-slug: 'build-tool'
|
|
github-artifact-id: '${{ steps.upload-for-signing.outputs.artifact-id }}'
|
|
wait-for-completion: true
|
|
output-artifact-directory: signed/
|
|
|
|
- name: Upload signed artifact
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: ${{ matrix.artifact }}-signed
|
|
path: signed/${{ matrix.artifact }}
|
|
|
|
release:
|
|
needs: [build, sign]
|
|
runs-on: ubuntu-latest
|
|
if: github.ref == 'refs/heads/main'
|
|
permissions:
|
|
contents: write
|
|
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Move tag to current commit
|
|
run: |
|
|
git tag -f build-tool-latest
|
|
git push origin build-tool-latest --force
|
|
|
|
- name: Download signed Windows artifacts
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
pattern: '*-signed'
|
|
path: artifacts/
|
|
merge-multiple: true
|
|
|
|
- name: Download macOS artifacts
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
pattern: 'build-tool-osx-*'
|
|
path: artifacts/
|
|
merge-multiple: true
|
|
|
|
- name: Download Linux artifacts
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
pattern: 'build-tool-linux-*'
|
|
path: artifacts/
|
|
merge-multiple: true
|
|
|
|
- name: Generate checksums
|
|
run: |
|
|
cd artifacts
|
|
sha256sum build-tool-* > checksums-sha256.txt
|
|
|
|
- name: Create or update release
|
|
uses: softprops/action-gh-release@v3
|
|
with:
|
|
tag_name: build-tool-latest
|
|
name: Build Tool (Latest)
|
|
body: |
|
|
Latest NativeAOT-compiled build tool binaries.
|
|
These are automatically downloaded by `publish.cmd` / `publish.sh`.
|
|
prerelease: true
|
|
files: |
|
|
artifacts/build-tool-*
|
|
artifacts/checksums-sha256.txt
|
|
make_latest: false
|