executable.yml

name: Build Executables
on:
  release:
    types: [published]
  # Backfill SHA256SUMS for an already-published release (no attestation)
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag to publish checksums for (e.g. v1.32.12)'
        required: true
# Never let a backfill hash a release's assets while its build is replacing them
concurrency:
  group: executable-${{ github.event.release.tag_name || inputs.tag }}
  cancel-in-progress: false
permissions:
  contents: read
jobs:
  build:
    name: Build Executables
    if: github.event_name == 'release'
    runs-on: macos-latest
    permissions:
      contents: write # upload release assets via softprops/action-gh-release
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          node-version: 14
          architecture: x64
      - run: ./scripts/executable.sh
        env:
          APPLE_DEV_CERT: ${{secrets.APPLE_DEV_CERT}}
          APPLE_ID_USERNAME: ${{secrets.APPLE_ID_USERNAME}}
          APPLE_ID_KEY: ${{secrets.APPLE_ID_KEY}}
          APPLE_CERT_KEY: ${{secrets.APPLE_CERT_KEY}}
          APPLE_TEAM_ID: ${{secrets.APPLE_TEAM_ID}}
      - name: Verify executable
        run: ./scripts/verify-executable.sh ./percy
      - name: Upload win artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: win-exe
          path: percy.exe
      - name: Upload assets
        uses: softprops/action-gh-release@62c96d0c4e8a889135c1f3a25910db8dbe0e85f7
        with:
          files: |
            percy-osx.zip
            percy-linux.zip
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  notify:
    needs: build
    name: Sign Win Executable
    if: github.event_name == 'release'
    runs-on: windows-2022
    permissions:
      contents: write # upload signed Windows executable to the release
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Download win artifact
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
        with:
          name: win-exe
      - name: Set up Node.js
        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
        with:
          node-version: 14
      - name: Install resedit
        env:
          npm_config_engine_strict: 'false'
        run: npm install resedit
      - name: Update exe metadata
        run: node ./scripts/win-metadata-update.js
      - name: Install Google Cloud KMS CNG Provider
        run: |
          $cngUrl = "https://github.com/GoogleCloudPlatform/kms-integrations/releases/download/cng-v1.3/kmscng-1.3-windows-amd64.zip"
          Invoke-WebRequest -Uri $cngUrl -OutFile kmscng.zip
          Expand-Archive -Path kmscng.zip -DestinationPath kmscng
          $msi = Get-ChildItem -Path kmscng -Filter *.msi -Recurse | Select-Object -First 1
          Write-Host "Found MSI: $($msi.FullName)"
          Start-Process msiexec.exe -ArgumentList '/i', $msi.FullName, '/quiet', '/norestart' -Wait -NoNewWindow
          $output = certutil -csplist 2>&1
          $LASTEXITCODE = 0
          if ($output -match "Google Cloud KMS Provider") {
            Write-Host "CNG Provider installed successfully."
          } else {
            Write-Error "CNG Provider not found"
            exit 1
          }
      - name: Write GCP credentials
        run: |
          [System.IO.File]::WriteAllBytes("$PWD\gcp-sa-key.json", [System.Convert]::FromBase64String($Env:GCP_SA_B64))
        env:
          GCP_SA_B64: ${{ secrets.GCP_WIN_CODESIGN_SA_KEY_B64 }}
      - name: Write certificate chain
        run: |
          [System.IO.File]::WriteAllBytes("$PWD\comodo_signing_cert.crt", [System.Convert]::FromBase64String($Env:CERT_B64))
        env:
          CERT_B64: ${{ secrets.WIN_CODESIGN_CERT_CHAIN_B64 }}
      - name: Sign binary with Google Cloud KMS
        env:
          # Bind the secret to an env var instead of interpolating it into the
          # PowerShell command string, so GitHub's log redaction applies to it
          # in all (incl. error) output (CWE-532).
          GCP_KMS_KEY_PATH: ${{ secrets.GCP_KMS_KEY_PATH }}
        run: |
          $env:GOOGLE_APPLICATION_CREDENTIALS = "$PWD\gcp-sa-key.json"
          $signtool = Get-ChildItem -Path "C:\Program Files (x86)\Windows Kits" -Filter signtool.exe -Recurse | Where-Object { $_.FullName -match "x64" } | Select-Object -First 1
          Write-Host "Using signtool: $($signtool.FullName)"
          & $signtool.FullName sign /fd sha256 /tr http://timestamp.sectigo.com /td sha256 /f comodo_signing_cert.crt /csp "Google Cloud KMS Provider" /kc "$env:GCP_KMS_KEY_PATH" percy.exe
          if ($LASTEXITCODE -ne 0) { Write-Error "Code signing failed!"; exit 1 }
          Write-Host "Code signing succeeded."
          & $signtool.FullName verify /pa /v percy.exe
      - name: Clean up credentials
        if: always()
        run: |
          Remove-Item -Force gcp-sa-key.json -ErrorAction SilentlyContinue
          Remove-Item -Force comodo_signing_cert.crt -ErrorAction SilentlyContinue
      - name: Verify executable
        shell: bash
        run: ./scripts/verify-executable.sh ./percy.exe
      - run: |
          powershell -Command "Compress-Archive -Path 'percy.exe' -DestinationPath 'percy-win.zip'"
      - name: Upload assets
        uses: softprops/action-gh-release@62c96d0c4e8a889135c1f3a25910db8dbe0e85f7
        with:
          files: |
            percy-win.zip
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  checksums:
    # Runs after both upload jobs so the hashes cover the final (signed) zips
    # exactly as published, letting consumers pin a version and its hash.
    needs: [build, notify]
    name: Publish Checksums
    if: >-
      !cancelled() && (github.event_name == 'workflow_dispatch' ||
      (needs.build.result == 'success' && needs.notify.result == 'success'))
    runs-on: ubuntu-latest
    permissions:
      contents: write # upload SHA256SUMS to the release
      id-token: write # sign attestations with Sigstore
      attestations: write # store attestations for `gh attestation verify`
    steps:
      - name: Download release assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ github.event.release.tag_name || inputs.tag }}
        run: gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --pattern 'percy-*.zip'
      - name: Generate SHA256SUMS
        run: |
          sha256sum percy-linux.zip percy-osx.zip percy-win.zip > SHA256SUMS
          cat SHA256SUMS
      - name: Attest release assets
        # only this run's build and signing jobs produced the zips; a backfill
        # did not build them, so it must not claim their provenance
        if: github.event_name == 'release'
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: |
            percy-linux.zip
            percy-osx.zip
            percy-win.zip
            SHA256SUMS
      - name: Upload SHA256SUMS
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ github.event.release.tag_name || inputs.tag }}
        run: gh release upload "$TAG" SHA256SUMS --repo "$GITHUB_REPOSITORY" --clobber