dx: github workflow "release-assets"
Massimo Melina committed
Jan 11, 2026 at 19:02 UTC
5d764c43efc4e7da5f924a7dde936d36ac5b5896
2 files changed
+333
.github/workflows/release-assets.yml
new
+245
@@ -0,0 +1,245 @@
1
+name: release-assets
2
+
3
+on:
4
+ workflow_dispatch:
5
+ inputs:
6
+ tag:
7
+ description: 'Release tag (e.g., v3.0.2)'
8
+ required: true
9
+ type: string
10
+ signing_policy:
11
+ description: 'SignPath signing policy slug'
12
+ required: true
13
+ default: release-signing
14
+ type: string
15
+ commitish:
16
+ description: 'Target branch or commit (optional)'
17
+ required: false
18
+ type: string
19
+
20
+env:
21
+ NODE_VERSION: '20'
22
+
23
+jobs:
24
+ windows:
25
+ runs-on: windows-latest
26
+ permissions:
27
+ actions: write
28
+ contents: read
29
+ steps:
30
+ - name: Checkout
31
+ uses: actions/checkout@v4
32
+
33
+ - name: Setup Node
34
+ uses: actions/setup-node@v4
35
+ with:
36
+ node-version: ${{ env.NODE_VERSION }}
37
+ cache: npm
38
+
39
+ - name: Install dependencies
40
+ run: npm ci
41
+
42
+ - name: Build server and UIs
43
+ run: |
44
+ npm run build-server
45
+ npm run build-frontend
46
+ npm run build-admin
47
+
48
+ - name: Prepare dist dependencies
49
+ run: npm run dist-modules
50
+
51
+ - name: Build Windows binary
52
+ run: |
53
+ cd dist
54
+ npx pkg . --public -C gzip -t node${{ env.NODE_VERSION }}-win-x64
55
+ npx resedit-cli --in hfs.exe --icon 1,../hfs.ico --out hfs.exe
56
+
57
+ - name: Prepare unsigned artifact folder
58
+ shell: pwsh
59
+ run: |
60
+ New-Item -ItemType Directory -Force -Path dist/signpath | Out-Null
61
+ Copy-Item dist/hfs.exe dist/signpath/hfs.exe -Force
62
+ Copy-Item dist/plugins dist/signpath/plugins -Recurse -Force
63
+
64
+ - name: Upload unsigned artifact
65
+ id: upload_unsigned
66
+ uses: actions/upload-artifact@v4
67
+ with:
68
+ name: hfs-windows-unsigned
69
+ path: dist/signpath/**
70
+
71
+ - name: Sign with SignPath
72
+ uses: SignPath/github-action-submit-signing-request@v1
73
+ with:
74
+ api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
75
+ organization-id: ${{ secrets.SIGNPATH_ORGANIZATION_ID }}
76
+ project-slug: hfs
77
+ artifact-configuration-slug: hfs_win_zip
78
+ signing-policy-slug: ${{ inputs.signing_policy }}
79
+ github-artifact-id: ${{ steps.upload_unsigned.outputs.artifact-id }}
80
+ github-token: ${{ github.token }}
81
+ output-artifact-directory: dist/signpath-output
82
+
83
+ - name: Package signed artifact
84
+ shell: pwsh
85
+ run: |
86
+ $version = node -p "require('./package.json').version"
87
+ $target = "dist/hfs-windows-x64-$version.zip"
88
+ $outputDir = 'dist/signpath-output'
89
+ $zip = Get-ChildItem -Path $outputDir -Filter *.zip -Recurse | Sort-Object LastWriteTime -Descending | Select-Object -First 1
90
+ if ($zip) {
91
+ if ((Resolve-Path $target).Path -ne $zip.FullName) {
92
+ Copy-Item $zip.FullName $target -Force
93
+ }
94
+ exit 0
95
+ }
96
+ $items = Get-ChildItem -Path $outputDir
97
+ if (-not $items) {
98
+ Write-Host 'No signed artifact files found. Listing dist contents for troubleshooting:'
99
+ Get-ChildItem -Path dist -Recurse | Select-Object FullName
100
+ throw 'No signed artifact files found after signing.'
101
+ }
102
+ Compress-Archive -Path "$outputDir/*" -DestinationPath $target -Force
103
+
104
+ - name: Upload signed package
105
+ uses: actions/upload-artifact@v4
106
+ with:
107
+ name: release-assets-windows
108
+ path: dist/hfs-windows-x64-*.zip
109
+
110
+ linux:
111
+ runs-on: ubuntu-latest
112
+ needs: windows
113
+ permissions:
114
+ actions: write
115
+ contents: read
116
+ steps:
117
+ - name: Checkout
118
+ uses: actions/checkout@v4
119
+
120
+ - name: Setup Node
121
+ uses: actions/setup-node@v4
122
+ with:
123
+ node-version: ${{ env.NODE_VERSION }}
124
+ cache: npm
125
+
126
+ - name: Install dependencies
127
+ run: npm ci
128
+
129
+ - name: Build server and UIs
130
+ run: |
131
+ npm run build-server
132
+ npm run build-frontend
133
+ npm run build-admin
134
+
135
+ - name: Prepare dist dependencies
136
+ run: npm run dist-modules
137
+
138
+ - name: Build Linux binary
139
+ run: npm run dist-bin-linux
140
+
141
+ - name: Upload Linux package
142
+ uses: actions/upload-artifact@v4
143
+ with:
144
+ name: release-assets-linux
145
+ path: dist/hfs-linux-x64-*.zip
146
+
147
+ mac_x64:
148
+ runs-on: macos-15-intel
149
+ needs: windows
150
+ permissions:
151
+ actions: write
152
+ contents: read
153
+ steps:
154
+ - name: Checkout
155
+ uses: actions/checkout@v4
156
+
157
+ - name: Setup Node
158
+ uses: actions/setup-node@v4
159
+ with:
160
+ node-version: ${{ env.NODE_VERSION }}
161
+ cache: npm
162
+
163
+ - name: Install dependencies
164
+ run: npm ci
165
+
166
+ - name: Build server and UIs
167
+ run: |
168
+ npm run build-server
169
+ npm run build-frontend
170
+ npm run build-admin
171
+
172
+ - name: Prepare dist dependencies
173
+ run: npm run dist-modules
174
+
175
+ - name: Build macOS x64 binary
176
+ run: npm run dist-bin-mac
177
+
178
+ - name: Upload macOS x64 package
179
+ uses: actions/upload-artifact@v4
180
+ with:
181
+ name: release-assets-mac-x64
182
+ path: dist/hfs-mac-x64-*.zip
183
+
184
+ mac_arm:
185
+ runs-on: macos-14
186
+ needs: windows
187
+ permissions:
188
+ actions: write
189
+ contents: read
190
+ steps:
191
+ - name: Checkout
192
+ uses: actions/checkout@v4
193
+
194
+ - name: Setup Node
195
+ uses: actions/setup-node@v4
196
+ with:
197
+ node-version: ${{ env.NODE_VERSION }}
198
+ cache: npm
199
+
200
+ - name: Install dependencies
201
+ run: npm ci
202
+
203
+ - name: Build server and UIs
204
+ run: |
205
+ npm run build-server
206
+ npm run build-frontend
207
+ npm run build-admin
208
+
209
+ - name: Prepare dist dependencies
210
+ run: npm run dist-modules
211
+
212
+ - name: Build macOS arm64 binary
213
+ run: npm run dist-bin-mac-arm
214
+
215
+ - name: Upload macOS arm64 package
216
+ uses: actions/upload-artifact@v4
217
+ with:
218
+ name: release-assets-mac-arm
219
+ path: dist/hfs-mac-arm64-*.zip
220
+
221
+ release:
222
+ runs-on: ubuntu-latest
223
+ needs:
224
+ - windows
225
+ - linux
226
+ - mac_x64
227
+ - mac_arm
228
+ permissions:
229
+ contents: write
230
+ steps:
231
+ - name: Download assets
232
+ uses: actions/download-artifact@v4
233
+ with:
234
+ pattern: release-assets-*
235
+ merge-multiple: true
236
+ path: release-assets
237
+
238
+ - name: Create draft release
239
+ uses: softprops/action-gh-release@v2
240
+ with:
241
+ tag_name: ${{ inputs.tag }}
242
+ name: ${{ inputs.tag }}
243
+ target_commitish: ${{ inputs.commitish || github.event.repository.default_branch }}
244
+ draft: true
245
+ files: release-assets/*.zip
.github/workflows/signpath-windows.yml
new
+88
@@ -0,0 +1,88 @@
1
+name: signpath-windows
2
+
3
+on:
4
+ workflow_dispatch:
5
+
6
+jobs:
7
+ build-sign:
8
+ runs-on: windows-latest
9
+ permissions:
10
+ contents: read
11
+ env:
12
+ NODE_VERSION: '20'
13
+ steps:
14
+ - name: Checkout
15
+ uses: actions/checkout@v4
16
+
17
+ - name: Setup Node
18
+ uses: actions/setup-node@v4
19
+ with:
20
+ node-version: ${{ env.NODE_VERSION }}
21
+ cache: npm
22
+
23
+ - name: Install dependencies
24
+ run: npm ci
25
+
26
+ - name: Build server and UIs
27
+ run: |
28
+ npm run build-server
29
+ npm run build-frontend
30
+ npm run build-admin
31
+
32
+ - name: Prepare dist dependencies
33
+ run: npm run dist-modules
34
+
35
+ - name: Build Windows binary
36
+ run: |
37
+ cd dist
38
+ npx pkg . --public -C gzip -t node${{ env.NODE_VERSION }}-win-x64
39
+ npx resedit-cli --in hfs.exe --icon 1,../hfs.ico --out hfs.exe
40
+
41
+ - name: Prepare unsigned artifact folder
42
+ shell: pwsh
43
+ run: |
44
+ New-Item -ItemType Directory -Force -Path dist/signpath | Out-Null
45
+ Copy-Item dist/hfs.exe dist/signpath/hfs.exe -Force
46
+ Copy-Item dist/plugins dist/signpath/plugins -Recurse -Force
47
+
48
+ - name: Upload unsigned artifact
49
+ id: upload_unsigned
50
+ uses: actions/upload-artifact@v4
51
+ with:
52
+ name: hfs-windows-unsigned
53
+ path: dist/signpath/**
54
+
55
+ - name: Sign with SignPath
56
+ uses: SignPath/github-action-submit-signing-request@v1
57
+ with:
58
+ api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
59
+ organization-id: ${{ secrets.SIGNPATH_ORGANIZATION_ID }}
60
+ project-slug: hfs
61
+ artifact-configuration-slug: hfs_win_zip
62
+ signing-policy-slug: release-signing
63
+ github-artifact-id: ${{ steps.upload_unsigned.outputs.artifact-id }}
64
+ github-token: ${{ secrets.GITHUB_TOKEN }}
65
+ output-artifact-directory: dist/signpath-output
66
+
67
+ - name: Package signed artifact
68
+ shell: pwsh
69
+ run: |
70
+ $outputDir = 'dist/signpath-output'
71
+ $zip = Get-ChildItem -Path $outputDir -Filter *.zip -Recurse | Sort-Object LastWriteTime -Descending | Select-Object -First 1
72
+ if ($zip) {
73
+ Copy-Item $zip.FullName 'dist/hfs-windows-x64-signed.zip' -Force
74
+ exit 0
75
+ }
76
+ $items = Get-ChildItem -Path $outputDir
77
+ if (-not $items) {
78
+ Write-Host 'No signed artifact files found. Listing dist contents for troubleshooting:'
79
+ Get-ChildItem -Path dist -Recurse | Select-Object FullName
80
+ throw 'No signed artifact files found after signing.'
81
+ }
82
+ Compress-Archive -Path "$outputDir/*" -DestinationPath 'dist/hfs-windows-x64-signed.zip' -Force
83
+
84
+ - name: Upload signed package
85
+ uses: actions/upload-artifact@v4
86
+ with:
87
+ name: hfs-windows-signed
88
+ path: dist/hfs-windows-x64-signed.zip