mirror of
https://github.com/stride3d/stride.git
synced 2026-10-12 02:23:23 +00:00
315 lines
14 KiB
YAML
315 lines
14 KiB
YAML
name: Release Launcher
|
|
# The run list shows the options of each run (the version comes from the nuspec: see the run summary)
|
|
run-name: Launcher ${{ inputs.version-suffix || 'release' }}${{ inputs.sign && ' · sign' || '' }}${{ inputs.deploy && ' · deploy' || '' }}${{ inputs.checkpoint && ' · checkpoint' || '' }}
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
sign:
|
|
description: Code sign packages
|
|
default: true
|
|
type: boolean
|
|
deploy:
|
|
description: Deploy to NuGet.org
|
|
default: false
|
|
type: boolean
|
|
version-suffix:
|
|
description: Pre-release suffix, no leading dash (e.g. "beta1" -> 6.1.0-beta1), N from 1 to 9. Only launchers that opted in to pre-releases update to it. Empty = release.
|
|
default: ''
|
|
type: string
|
|
checkpoint:
|
|
description: Every older launcher updates to this version before any newer one (e.g. a version that migrates something the next ones need).
|
|
default: false
|
|
type: boolean
|
|
upload-binlog:
|
|
description: Capture and upload an MSBuild binlog (diagnostics). Ignored on signed builds — a binlog records env vars/task params and would leak signing secrets.
|
|
default: false
|
|
type: boolean
|
|
|
|
concurrency:
|
|
group: release-launcher-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
#
|
|
# Validate inputs and permissions
|
|
#
|
|
Validate:
|
|
name: Validate
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check deploy requires signing
|
|
if: ${{ inputs.deploy && !inputs.sign }}
|
|
run: |
|
|
echo "::error::Cannot deploy unsigned packages. Enable 'sign' to deploy."
|
|
exit 1
|
|
|
|
- name: Check release permissions
|
|
if: ${{ inputs.sign || inputs.deploy }}
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GH_PAT }}
|
|
run: |
|
|
ORG=$(echo "${{ github.repository }}" | cut -d/ -f1)
|
|
TEAM="stride-release-managers"
|
|
USER="${{ github.actor }}"
|
|
# A 404 here means either the actor isn't a member OR GH_PAT can't read the team
|
|
# (dead/under-scoped token); the message covers both since the API can't distinguish them.
|
|
if ! gh api "orgs/$ORG/teams/$TEAM/memberships/$USER" --silent 2>/dev/null; then
|
|
echo "::error::Sign/deploy blocked: '$USER' is not a member of $ORG/$TEAM, or GH_PAT cannot read it (dead token / missing Organization Members: Read). Requires stride-release-managers membership."
|
|
exit 1
|
|
fi
|
|
|
|
#
|
|
# Build, package and optionally deploy the launcher
|
|
#
|
|
Package:
|
|
name: Package Launcher
|
|
needs: Validate
|
|
runs-on: windows-latest
|
|
environment: production
|
|
outputs:
|
|
version: ${{ steps.version.outputs.version }}
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
lfs: true
|
|
fetch-depth: 0
|
|
|
|
- uses: actions/setup-dotnet@v6
|
|
with:
|
|
dotnet-version: 10.0.x
|
|
|
|
- uses: microsoft/setup-msbuild@v3
|
|
|
|
# The version the build will use (the build also rejects one NuGet or MSI can't order). Before a deploy: a release
|
|
# built again (the NuGet push would skip it silently), or a pre-release of an already released X.Y.Z (it would
|
|
# sort below that release) means the nuspec wasn't bumped.
|
|
- name: Version
|
|
id: version
|
|
shell: pwsh
|
|
run: |
|
|
$out = msbuild build\Stride.build /t:_StrideSetupVersion /nologo /v:m /p:VersionSuffix=${{ inputs.version-suffix }}
|
|
if ($LASTEXITCODE -ne 0) { $out; exit 1 }
|
|
if (-not (($out -join "`n") -match 'StrideSetup (\S+):')) {
|
|
echo "::error::Could not determine the launcher version"
|
|
exit 1
|
|
}
|
|
$version = $Matches[1]
|
|
echo "Launcher $version"
|
|
echo "version=$version" >> $env:GITHUB_OUTPUT
|
|
if ('${{ inputs.deploy }}' -ne 'true') { exit 0 }
|
|
|
|
$release = $version -replace '-.*$', ''
|
|
if (git tag --list "launcher/$version") {
|
|
echo "::error::launcher/$version already exists. Bump the version in Stride.Launcher.nuspec."
|
|
exit 1
|
|
}
|
|
if ($version -ne $release -and (git tag --list "launcher/$release")) {
|
|
echo "::error::$release is already released, so $version would sort below it. Bump the version in Stride.Launcher.nuspec."
|
|
exit 1
|
|
}
|
|
|
|
- name: Install Advanced Installer
|
|
shell: pwsh
|
|
run: |
|
|
Invoke-WebRequest -Uri "https://www.advancedinstaller.com/downloads/22.0/advinst.msi" -OutFile advinst.msi
|
|
msiexec /i advinst.msi /qn ADDLOCAL=ALL | Out-Null
|
|
if ("${{ secrets.ADVINST_LICENSE_KEY }}" -ne "") {
|
|
& "${env:ProgramFiles(x86)}\Caphyon\Advanced Installer 22.0\bin\x86\AdvancedInstaller.com" /register "${{ secrets.ADVINST_LICENSE_KEY }}"
|
|
}
|
|
|
|
- name: Build and package launcher
|
|
shell: pwsh
|
|
run: |
|
|
msbuild build\Stride.build `
|
|
/t:FullBuildLauncher `
|
|
${{ inputs.upload-binlog && !inputs.sign && '/bl' || '' }} /m /nr:false `
|
|
/p:StrideSentryDsn=${{ vars.STRIDE_SENTRY_DSN }} `
|
|
/p:StrideSentryEnvironment=${{ vars.STRIDE_SENTRY_DSN != '' && 'release' || '' }} `
|
|
/p:StrideSign=${{ inputs.sign }} `
|
|
/p:VersionSuffix=${{ inputs.version-suffix }} `
|
|
/p:StrideLauncherUpdateCheckpoint=${{ inputs.checkpoint }}
|
|
env:
|
|
StrideSignTenantId: ${{ secrets.STRIDE_SIGN_TENANT_ID }}
|
|
StrideSignClientId: ${{ secrets.STRIDE_SIGN_CLIENT_ID }}
|
|
StrideSignClientSecret: ${{ secrets.STRIDE_SIGN_CLIENT_SECRET }}
|
|
StrideSignKeyVaultCertificate: ${{ secrets.STRIDE_SIGN_KEYVAULT_CERTIFICATE }}
|
|
StrideSignKeyVaultName: ${{ secrets.STRIDE_SIGN_KEYVAULT_NAME }}
|
|
|
|
# What this run built, with the update lines read back from the packages
|
|
- name: Summary
|
|
shell: pwsh
|
|
run: |
|
|
Add-Type -AssemblyName System.IO.Compression.FileSystem
|
|
$yesNo = { param($value) if ($value -eq 'true') { 'yes' } else { 'no' } }
|
|
$summary = @(
|
|
"## Stride Launcher ${{ steps.version.outputs.version }}"
|
|
""
|
|
"- Deploy: $(& $yesNo '${{ inputs.deploy }}') · Signed: $(& $yesNo '${{ inputs.sign }}') · Pre-release: $(& $yesNo '${{ inputs.version-suffix != '' }}')"
|
|
"- Checkpoint: $(& $yesNo '${{ inputs.checkpoint }}')"
|
|
)
|
|
foreach ($nupkg in Get-ChildItem -Path bin/launcher -Filter "*.nupkg") {
|
|
$zip = [System.IO.Compression.ZipFile]::OpenRead($nupkg.FullName)
|
|
try {
|
|
$reader = [System.IO.StreamReader]::new(($zip.Entries | Where-Object Name -eq 'Stride.Launcher.nuspec').Open())
|
|
$description = ([xml]$reader.ReadToEnd()).package.metadata.description
|
|
$reader.Dispose()
|
|
} finally {
|
|
$zip.Dispose()
|
|
}
|
|
$summary += "", "### $($nupkg.Name)", '```'
|
|
$summary += $description -split '\r?\n' | Where-Object { $_ -match '^(update|force-reinstall):' }
|
|
$summary += '```'
|
|
}
|
|
$summary | Out-File -Append -Encoding utf8 $env:GITHUB_STEP_SUMMARY
|
|
$summary
|
|
|
|
- name: Upload launcher artifacts
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: stride-launcher-${{ steps.version.outputs.version }}
|
|
path: |
|
|
bin/launcher/*.nupkg
|
|
bin/launcher/*.exe
|
|
retention-days: 30
|
|
|
|
- name: Upload build log
|
|
uses: actions/upload-artifact@v7
|
|
if: ${{ always() && inputs.upload-binlog && !inputs.sign }}
|
|
with:
|
|
name: build-log
|
|
path: msbuild.binlog
|
|
if-no-files-found: ignore
|
|
|
|
Deploy:
|
|
name: Deploy Launcher
|
|
if: ${{ inputs.deploy && inputs.sign }}
|
|
needs: Package
|
|
runs-on: ubuntu-latest
|
|
environment: production # STRIDE_NUGET_API_KEY lives here; requires manual approval in GitHub settings
|
|
steps:
|
|
- uses: actions/checkout@v7 # full history + tags for the launcher-scoped changelog
|
|
with:
|
|
fetch-depth: 0
|
|
fetch-tags: true
|
|
|
|
- uses: actions/setup-dotnet@v6
|
|
with:
|
|
dotnet-version: 10.0.x
|
|
|
|
- name: Download launcher artifacts
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
name: stride-launcher-${{ needs.Package.outputs.version }}
|
|
path: bin/launcher
|
|
|
|
- name: Build release notes
|
|
if: ${{ needs.Package.outputs.version != '' }}
|
|
run: |
|
|
TAG="launcher/${{ needs.Package.outputs.version }}"
|
|
# The launcher is a separate product from the engine. Build its changelog from the previous
|
|
# launcher/* tag and scope it to the launcher sources, so engine/CLI commits don't leak in
|
|
# (and the products' changelogs don't interleave, as GitHub's auto notes would do). The
|
|
# launcher/<version> tag is created by the release step below, so pick the previous tag from
|
|
# the existing launcher/* tags rather than relative to it.
|
|
# A release starts from the previous release (not its pre-releases), so the notes include what they shipped.
|
|
CANDIDATES=$(git tag --list 'launcher/*' --sort=-creatordate | grep -vxF "$TAG" || true)
|
|
[[ "$TAG" != *-* ]] && CANDIDATES=$(printf '%s\n' "$CANDIDATES" | grep -v -- '-' || true)
|
|
PREV=$(printf '%s\n' "$CANDIDATES" | head -n1)
|
|
RANGE="HEAD"
|
|
[ -n "$PREV" ] && RANGE="$PREV..HEAD"
|
|
NOTES=$(git log --no-merges --pretty='- %s (%h)' "$RANGE" -- sources/launcher/Stride.Launcher)
|
|
[ -z "$NOTES" ] && NOTES="_No launcher-specific changes since the previous release._"
|
|
{
|
|
echo "## What's changed in the Stride Launcher"
|
|
echo ""
|
|
echo "$NOTES"
|
|
if [ -n "$PREV" ]; then
|
|
echo ""
|
|
echo "**Full launcher changelog**: ${{ github.server_url }}/${{ github.repository }}/compare/$PREV...$TAG"
|
|
fi
|
|
} > launcher-notes.md
|
|
|
|
# gh rather than a release action: stride3d/stride only allows selected third-party actions (as release-cli.yml)
|
|
- name: Create GitHub Release
|
|
if: ${{ needs.Package.outputs.version != '' }}
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GH_PAT }}
|
|
run: |
|
|
TAG="launcher/${{ needs.Package.outputs.version }}"
|
|
# Already there when this job runs again ("Re-run failed jobs", e.g. after a NuGet failure): upload the setup
|
|
# again, in case the first run failed during its upload. The same one: the job reuses the build artifacts.
|
|
if gh release view "$TAG" > /dev/null 2>&1; then
|
|
gh release upload "$TAG" bin/launcher/*.exe --clobber
|
|
exit 0
|
|
fi
|
|
# --latest=false: a separate product, never the repo's "Latest" release (that's the engine)
|
|
gh release create "$TAG" \
|
|
--target "$GITHUB_SHA" \
|
|
--title "Stride Launcher ${{ needs.Package.outputs.version }}" \
|
|
--notes-file launcher-notes.md \
|
|
--latest=false \
|
|
${{ inputs.version-suffix != '' && '--prerelease' || '' }} \
|
|
bin/launcher/*.exe
|
|
|
|
# After the GitHub release: the packages point to its setup (launchers that must reinstall download it)
|
|
- name: Push to NuGet
|
|
shell: pwsh
|
|
run: |
|
|
Get-ChildItem -Path bin/launcher -Filter "*.nupkg" | ForEach-Object {
|
|
echo "Pushing $($_.Name)..."
|
|
dotnet nuget push $_.FullName --api-key $env:STRIDE_NUGET_API_KEY --source "https://api.nuget.org/v3/index.json" --skip-duplicate
|
|
if ($LASTEXITCODE -ne 0) { exit 1 }
|
|
}
|
|
env:
|
|
STRIDE_NUGET_API_KEY: ${{ secrets.STRIDE_NUGET_API_KEY }}
|
|
|
|
# Points the stride3d.net download button to this setup: committed to stride-website
|
|
# master, live with the next website release (deployed from its release branch)
|
|
- name: Update the website download
|
|
if: ${{ needs.Package.outputs.version != '' && inputs.version-suffix == '' }}
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GH_PAT }}
|
|
run: |
|
|
VERSION="${{ needs.Package.outputs.version }}"
|
|
gh auth setup-git
|
|
git clone --depth 1 https://github.com/stride3d/stride-website.git website
|
|
cd website
|
|
URL="https://github.com/stride3d/stride/releases/download/launcher/$VERSION/StrideSetup-$VERSION.exe"
|
|
# Setting a key the site doesn't have (renamed) would add one that nothing reads
|
|
if ! jq -e '.links | has("stride-download-url")' _data/site.json > /dev/null; then
|
|
echo "::error::No links.stride-download-url in _data/site.json of stride-website"
|
|
exit 1
|
|
fi
|
|
jq --arg url "$URL" '.links."stride-download-url" = $url' _data/site.json > site.json.tmp
|
|
mv site.json.tmp _data/site.json
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
git commit -am "feat: The download button points to the Stride Launcher $VERSION setup (GitHub release)" \
|
|
-m "https://github.com/stride3d/stride/releases/tag/launcher/$VERSION" \
|
|
-m "Updated by $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
|
|
git push
|
|
|
|
#
|
|
# AI release notes, off the Deploy critical path (see release-notes-apply.yml). Runs after
|
|
# the release exists; replaces the scoped git-log body with the AI bullet list. The separate
|
|
# job fetches the tag gh release create pushed, so no local-tag mirror step is needed.
|
|
#
|
|
ReleaseNotes:
|
|
name: Release notes launcher/${{ needs.Package.outputs.version }}
|
|
needs: [Package, Deploy]
|
|
if: ${{ needs.Package.outputs.version != '' }}
|
|
permissions:
|
|
contents: read # passed down only as the model's read-only token; apply uses the PAT
|
|
pull-requests: read # lets the model trace commits to their PRs
|
|
uses: ./.github/workflows/release-notes-apply.yml
|
|
with:
|
|
tag: launcher/${{ needs.Package.outputs.version }}
|
|
tag-match: 'launcher/*'
|
|
product: the Stride Launcher
|
|
scope: sources/launcher/Stride.Launcher
|
|
apply: true
|
|
secrets:
|
|
gh-token: ${{ secrets.GH_PAT }}
|
|
anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
|