Backups/claude-code-haha
1
0
Fork 0
mirror of https://github.com/NanmiCoder/claude-code-haha.git synced 2026-10-10 03:43:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(release): separate SignPath test and release policies

Browse Source
This commit is contained in:
Relakkes Yang
2026-08-23 18:55:10 +08:00
parent af4454f38a
commit c7a90f2cd1
2 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release-desktop.yml
+6 -4
View File
@@ -43,7 +43,7 @@ jobs:
SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }}
SIGNPATH_ORGANIZATION_ID: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
SIGNPATH_PROJECT_SLUG: ${{ vars.SIGNPATH_PROJECT_SLUG }}
SIGNPATH_SIGNING_POLICY_SLUG: ${{ vars.SIGNPATH_SIGNING_POLICY_SLUG }}
SIGNPATH_SIGNING_POLICY_SLUG: ${{ github.event_name == 'workflow_dispatch' && inputs.draft == true && vars.SIGNPATH_TEST_SIGNING_POLICY_SLUG || vars.SIGNPATH_RELEASE_SIGNING_POLICY_SLUG }}
SIGNPATH_APPLICATION_ARTIFACT_CONFIGURATION_SLUG: ${{ vars.SIGNPATH_APPLICATION_ARTIFACT_CONFIGURATION_SLUG }}
SIGNPATH_INSTALLER_ARTIFACT_CONFIGURATION_SLUG: ${{ vars.SIGNPATH_INSTALLER_ARTIFACT_CONFIGURATION_SLUG }}
RELEASE_DRAFT: ${{ github.event_name == 'workflow_dispatch' && inputs.draft == true }}
@@ -73,7 +73,7 @@ jobs:
[ -n "$SIGNPATH_API_TOKEN" ] || win_missing+=("SIGNPATH_API_TOKEN secret")
[ -n "$SIGNPATH_ORGANIZATION_ID" ] || win_missing+=("SIGNPATH_ORGANIZATION_ID variable")
[ -n "$SIGNPATH_PROJECT_SLUG" ] || win_missing+=("SIGNPATH_PROJECT_SLUG variable")
[ -n "$SIGNPATH_SIGNING_POLICY_SLUG" ] || win_missing+=("SIGNPATH_SIGNING_POLICY_SLUG variable")
[ -n "$SIGNPATH_SIGNING_POLICY_SLUG" ] || win_missing+=("selected SignPath signing policy variable")
[ -n "$SIGNPATH_APPLICATION_ARTIFACT_CONFIGURATION_SLUG" ] || win_missing+=("SIGNPATH_APPLICATION_ARTIFACT_CONFIGURATION_SLUG variable")
[ -n "$SIGNPATH_INSTALLER_ARTIFACT_CONFIGURATION_SLUG" ] || win_missing+=("SIGNPATH_INSTALLER_ARTIFACT_CONFIGURATION_SLUG variable")
if [ "${#win_missing[@]}" -gt 0 ]; then
@@ -139,6 +139,8 @@ jobs:
runs-on: ${{ matrix.platform }}
name: Build (${{ matrix.label }})
env:
SIGNPATH_SIGNING_POLICY_SLUG: ${{ github.event_name == 'workflow_dispatch' && inputs.draft == true && vars.SIGNPATH_TEST_SIGNING_POLICY_SLUG || vars.SIGNPATH_RELEASE_SIGNING_POLICY_SLUG }}
steps:
- name: Checkout
@@ -455,7 +457,7 @@ jobs:
api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
project-slug: ${{ vars.SIGNPATH_PROJECT_SLUG }}
signing-policy-slug: ${{ vars.SIGNPATH_SIGNING_POLICY_SLUG }}
signing-policy-slug: ${{ env.SIGNPATH_SIGNING_POLICY_SLUG }}
artifact-configuration-slug: ${{ vars.SIGNPATH_APPLICATION_ARTIFACT_CONFIGURATION_SLUG }}
github-artifact-id: ${{ steps.upload-unsigned-signpath-application.outputs.artifact-id }}
wait-for-completion: true
@@ -531,7 +533,7 @@ jobs:
api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
project-slug: ${{ vars.SIGNPATH_PROJECT_SLUG }}
signing-policy-slug: ${{ vars.SIGNPATH_SIGNING_POLICY_SLUG }}
signing-policy-slug: ${{ env.SIGNPATH_SIGNING_POLICY_SLUG }}
artifact-configuration-slug: ${{ vars.SIGNPATH_INSTALLER_ARTIFACT_CONFIGURATION_SLUG }}
github-artifact-id: ${{ steps.upload-unsigned-signpath-installer.outputs.artifact-id }}
wait-for-completion: true
scripts/pr/release-workflow.test.ts
+5 -1
View File
@@ -281,7 +281,8 @@ describe('release desktop workflow', () => {
'SIGNPATH_API_TOKEN',
'SIGNPATH_ORGANIZATION_ID',
'SIGNPATH_PROJECT_SLUG',
'SIGNPATH_SIGNING_POLICY_SLUG',
'SIGNPATH_TEST_SIGNING_POLICY_SLUG',
'SIGNPATH_RELEASE_SIGNING_POLICY_SLUG',
'SIGNPATH_APPLICATION_ARTIFACT_CONFIGURATION_SLUG',
'SIGNPATH_INSTALLER_ARTIFACT_CONFIGURATION_SLUG',
]) {
@@ -298,6 +299,7 @@ describe('release desktop workflow', () => {
expect(signingJob).toContain('windows_signed=false')
expect(signingJob).toContain('windows_signed=true')
expect(signingJob).toContain('Refusing to publish a non-draft desktop release without SignPath Windows signing.')
expect(signingJob).toContain("inputs.draft == true && vars.SIGNPATH_TEST_SIGNING_POLICY_SLUG || vars.SIGNPATH_RELEASE_SIGNING_POLICY_SLUG")
const macRequiredBlock = signingJob?.match(
/missing=\(\)[\s\S]*?# Drafts may remain unsigned/,
@@ -337,12 +339,14 @@ describe('release desktop workflow', () => {
expect(stageApplicationStep).not.toContain('node-pty')
expect(signApplicationStep).toContain('signpath/github-action-submit-signing-request@v2')
expect(signApplicationStep).toContain('SIGNPATH_APPLICATION_ARTIFACT_CONFIGURATION_SLUG')
expect(signApplicationStep).toContain('signing-policy-slug: ${{ env.SIGNPATH_SIGNING_POLICY_SLUG }}')
expect(signApplicationStep).toContain('github-artifact-id: ${{ steps.upload-unsigned-signpath-application.outputs.artifact-id }}')
expect(restoreApplicationStep).toContain('Get-AuthenticodeSignature')
expect(restoreApplicationStep).toContain('REQUIRE_TRUSTED_WINDOWS_SIGNATURE')
expect(packageInstallerStep).toContain('--prepackaged "build-artifacts/electron/${{ matrix.unpacked_dir }}"')
expect(signInstallerStep).toContain('signpath/github-action-submit-signing-request@v2')
expect(signInstallerStep).toContain('SIGNPATH_INSTALLER_ARTIFACT_CONFIGURATION_SLUG')
expect(signInstallerStep).toContain('signing-policy-slug: ${{ env.SIGNPATH_SIGNING_POLICY_SLUG }}')
expect(restoreInstallerStep).toContain('Get-AuthenticodeSignature')
expect(restoreInstallerStep).toContain('A trusted production signature is required')
expect(refreshMetadataStep).toContain('scripts/refresh-windows-update-metadata.ts')