Repository navigation
chore(ci): exercise publication admission with hosted controls #90
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: desktop-publication-gate-proof | ||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| fail_smoke: | ||
| type: boolean | ||
| default: false | ||
| publish: | ||
| type: boolean | ||
| default: true | ||
| permissions: | ||
| contents: read | ||
| jobs: | ||
| source: | ||
| runs-on: ubuntu-24.04 | ||
| outputs: | ||
| smoke_shards: ${{ steps.source.outputs.shards }} | ||
| steps: | ||
| - id: source | ||
| run: | | ||
| echo 'shards=[1,2,3,4]' >> "$GITHUB_OUTPUT" | ||
| echo 'Candidate workflow e63f9286856ca7b55d6295f85a6c433aa8ede8a3' >> "$GITHUB_STEP_SUMMARY" | ||
| build: | ||
| needs: source | ||
| runs-on: ubuntu-24.04 | ||
| outputs: | ||
| artifact_id: ${{ steps.artifacts.outputs.artifact-id }} | ||
| steps: | ||
| - run: | | ||
| mkdir -p release | ||
| printf 'publication admission fixture\n' > release/fixture.txt | ||
| - id: artifacts | ||
| uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 | ||
| with: | ||
| name: publication-gate-fixture | ||
| path: release/ | ||
| retention-days: 3 | ||
| smoke: | ||
| name: smoke (${{ matrix.shard }}/${{ strategy.job-total }}) | ||
| needs: source | ||
| runs-on: ubuntu-24.04 | ||
| timeout-minutes: 30 | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| shard: ${{ fromJSON(needs.source.outputs.smoke_shards) }} | ||
| steps: | ||
| - name: Acceptance boundary control | ||
| env: | ||
| FAIL_SMOKE: ${{ inputs.fail_smoke }} | ||
| SHARD: ${{ matrix.shard }} | ||
| run: | | ||
| if [ "$FAIL_SMOKE" = true ] && [ "$SHARD" = 2 ]; then | ||
| echo 'Intentional negative-control acceptance failure.' | ||
| exit 1 | ||
| fi | ||
| publish: | ||
| description: Upload artifacts to the GitHub release | ||
| required: false | ||
| type: boolean | ||
| default: true | ||
| sign: | ||
| description: Sign and notarize with the Apple Developer identity. Unsigned | ||
| builds are workflow artifacts only and cannot be published. | ||
| required: false | ||
| type: boolean | ||
| default: true | ||
| secrets: | ||
| DESKTOP_RELEASE_TOKEN: | ||
| required: false | ||
| CSC_LINK: | ||
| required: false | ||
| CSC_KEY_PASSWORD: | ||
| required: false | ||
| APPLE_API_KEY_P8: | ||
| required: false | ||
| APPLE_API_KEY_ID: | ||
| required: false | ||
| APPLE_API_ISSUER: | ||
| required: false | ||
| APPLE_TEAM_ID: | ||
| required: false | ||
| workflow_dispatch: | ||
| inputs: | ||
| version: | ||
| description: Release tag (vX.Y.Z) to attach desktop artifacts to | ||
| required: true | ||
| type: string | ||
| publish: | ||
| description: Upload artifacts to the GitHub release | ||
| required: false | ||
| type: boolean | ||
| default: false | ||
| sign: | ||
| description: Sign and notarize with the Apple Developer identity | ||
| required: false | ||
| type: boolean | ||
| default: true | ||
| permissions: | ||
| contents: read | ||
| jobs: | ||
| source: | ||
| name: source | ||
| runs-on: ubuntu-24.04 | ||
| timeout-minutes: 5 | ||
| outputs: | ||
| commit: ${{ steps.source.outputs.commit }} | ||
| name: ${{ steps.channel.outputs.name }} | ||
| app_id: ${{ steps.channel.outputs.app_id }} | ||
| origin: ${{ steps.channel.outputs.origin }} | ||
| release_repository: ${{ steps.channel.outputs.release_repository }} | ||
| token_kind: ${{ steps.channel.outputs.token_kind }} | ||
| smoke_shards: ${{ steps.smoke.outputs.shards }} | ||
| steps: | ||
| - name: Download verified desktop artifacts | ||
| uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 | ||
| with: | ||
| artifact-ids: ${{ needs.build.outputs.artifact_id }} | ||
| path: apps/desktop/release | ||
| - name: Harmless publication sentinel | ||
| run: | | ||
| grep -Fx 'publication admission fixture' apps/desktop/release/fixture.txt | ||
| echo 'Publication gate admitted this run.' >> "$GITHUB_STEP_SUMMARY" | ||
