From 3b156818bb93cf8f43807dbf2830bd2845fdb1d0 Mon Sep 17 00:00:00 2001 From: Jason Ross Date: Thu, 16 Oct 2025 13:58:35 -0500 Subject: [PATCH] updated credentials for job steps --- .github/workflows/release.yml | 126 ++++++++++++++++++++++++++++ .github/workflows/status-checks.yml | 18 ++++ 2 files changed, 144 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d9629ba..ba82405 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -434,13 +434,42 @@ jobs: # Use the Windows spec file so packaging is consistent and reproducible poetry run pyinstaller scripts/spec_scripts/android-file-handler-windows.spec + - name: Import GPG key + shell: pwsh + run: | + $env:GPG_TTY = "not a tty" + echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --batch --import + gpg --list-secret-keys + + - name: Sign and hash Windows executable + shell: pwsh + run: | + $exePath = Get-ChildItem -Path dist -Filter "android-file-handler.exe" -Recurse | Select-Object -First 1 -ExpandProperty FullName + if (-not $exePath) { + Write-Error "Executable not found" + exit 1 + } + Write-Output "Found executable: $exePath" + + # Sign with GPG + echo "${{ secrets.GPG_PASSPHRASE }}" | gpg --batch --yes --passphrase-fd 0 --detach-sign --armor "$exePath" + + # Generate SHA-256 hash + $hash = (Get-FileHash -Path "$exePath" -Algorithm SHA256).Hash.ToLower() + $hashFile = "dist/android-file-handler-windows.sha256" + "$hash $(Split-Path -Leaf $exePath)" | Out-File -FilePath $hashFile -Encoding ASCII -NoNewline + Write-Output "SHA-256: $hash" + - name: Upload Windows artifact uses: actions/upload-artifact@v4 with: name: windows-binary path: | dist/**/android-file-handler*.exe + dist/**/android-file-handler*.exe.asc dist/android-file-handler.exe + dist/android-file-handler.exe.asc + dist/android-file-handler-windows.sha256 build-debian: needs: [verify-main-status-checks] @@ -450,6 +479,9 @@ jobs: runs-on: ubuntu-latest container: image: ghcr.io/jmr-dev/android-file-handler-debian-builder + credentials: + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} steps: - name: Checkout code uses: actions/checkout@v4 @@ -485,12 +517,39 @@ jobs: --after-install scripts/debian_postinst.sh \ -p "dist/android-file-handler_${VERSION}_amd64.deb" -C "$PKG_DIR" "${PKG_ITEMS[@]}" + - name: Import GPG key + shell: bash + run: | + export GPG_TTY=$(tty) || true + echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --batch --import + gpg --list-secret-keys + + - name: Sign and hash Debian package + shell: bash + run: | + set -euo pipefail + DEB_FILE=$(find dist -name "android-file-handler_*.deb" -type f | head -n 1) + if [ -z "$DEB_FILE" ]; then + echo "Error: .deb file not found" + exit 1 + fi + echo "Found package: $DEB_FILE" + + # Sign with GPG + echo "${{ secrets.GPG_PASSPHRASE }}" | gpg --batch --yes --passphrase-fd 0 --detach-sign --armor "$DEB_FILE" + + # Generate SHA-256 hash + sha256sum "$DEB_FILE" | awk '{print $1 " " $2}' > dist/android-file-handler-debian.sha256 + echo "SHA-256: $(cat dist/android-file-handler-debian.sha256)" + - name: Upload Debian .deb uses: actions/upload-artifact@v4 with: name: debian-package path: | dist/android-file-handler_*.deb + dist/android-file-handler_*.deb.asc + dist/android-file-handler-debian.sha256 pkg_dist_debian/** build-arch: @@ -501,6 +560,9 @@ jobs: runs-on: ubuntu-latest container: image: ghcr.io/jmr-dev/android-file-handler-arch-builder + credentials: + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} steps: - name: Checkout code uses: actions/checkout@v4 @@ -535,12 +597,38 @@ jobs: --architecture x86_64 \ -p "dist/android-file-handler-${VERSION}-1-x86_64.pkg.tar.zst" -C "$PKG_DIR" "${PKG_ITEMS[@]}" + - name: Import GPG key + shell: bash + run: | + export GPG_TTY=$(tty) || true + echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --batch --import + gpg --list-secret-keys + + - name: Sign and hash Arch package + shell: bash + run: | + set -euo pipefail + PKG_FILE=$(find dist -name "android-file-handler-*.pkg.tar.zst" -type f | head -n 1) + if [ -z "$PKG_FILE" ]; then + echo "Error: .pkg.tar.zst file not found" + exit 1 + fi + echo "Found package: $PKG_FILE" + + # Sign with GPG + echo "${{ secrets.GPG_PASSPHRASE }}" | gpg --batch --yes --passphrase-fd 0 --detach-sign --armor "$PKG_FILE" + + # Generate SHA-256 hash + sha256sum "$PKG_FILE" | awk '{print $1 " " $2}' > dist/android-file-handler-arch.sha256 + echo "SHA-256: $(cat dist/android-file-handler-arch.sha256)" + - name: Upload Arch package uses: actions/upload-artifact@v4 with: name: arch-package path: | dist/*.pkg.tar.* + dist/android-file-handler-arch.sha256 pkg_dist_arch/** @@ -555,6 +643,9 @@ jobs: runs-on: ubuntu-latest container: image: ghcr.io/jmr-dev/android-file-handler-rhel-builder:fedora42 + credentials: + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} steps: - name: Checkout code uses: actions/checkout@v4 @@ -588,12 +679,39 @@ jobs: fpm -s dir -t rpm -n android-file-handler -v "$VERSION" --architecture x86_64 --prefix /usr/bin --after-install scripts/rhel_postinst.sh -p "dist/android-file-handler-${VERSION}.x86_64.rpm" -C "$PKG_DIR" "${PKG_ITEMS[@]}" + - name: Import GPG key + shell: bash + run: | + export GPG_TTY=$(tty) || true + echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --batch --import + gpg --list-secret-keys + + - name: Sign and hash RHEL package + shell: bash + run: | + set -euo pipefail + RPM_FILE=$(find dist -name "android-file-handler-*.rpm" -type f | head -n 1) + if [ -z "$RPM_FILE" ]; then + echo "Error: .rpm file not found" + exit 1 + fi + echo "Found package: $RPM_FILE" + + # Sign with GPG + echo "${{ secrets.GPG_PASSPHRASE }}" | gpg --batch --yes --passphrase-fd 0 --detach-sign --armor "$RPM_FILE" + + # Generate SHA-256 hash + sha256sum "$RPM_FILE" | awk '{print $1 " " $2}' > dist/android-file-handler-rhel.sha256 + echo "SHA-256: $(cat dist/android-file-handler-rhel.sha256)" + - name: Upload RHEL artifacts uses: actions/upload-artifact@v4 with: name: rhel-package path: | dist/*.rpm + dist/*.rpm.asc + dist/android-file-handler-rhel.sha256 pkg_dist_rhel/** @@ -624,10 +742,18 @@ jobs: - name: Prepare release files run: | mkdir -p ./release-files + # Copy binary packages find ./binaries -name "*.exe" -exec cp {} ./release-files/ \; || true find ./binaries -name "*.deb" -exec cp {} ./release-files/ \; || true find ./binaries -name "*.rpm" -exec cp {} ./release-files/ \; || true find ./binaries -name "*.pkg.tar.*" -exec cp {} ./release-files/ \; || true + # Copy GPG signatures + find ./binaries -name "*.asc" -exec cp {} ./release-files/ \; || true + # Copy SHA-256 hashes + find ./binaries -name "*.sha256" -exec cp {} ./release-files/ \; || true + + echo "Release files prepared:" + ls -lh ./release-files/ - name: Create Release uses: softprops/action-gh-release@v1 diff --git a/.github/workflows/status-checks.yml b/.github/workflows/status-checks.yml index 6b759a3..deb09a9 100644 --- a/.github/workflows/status-checks.yml +++ b/.github/workflows/status-checks.yml @@ -20,6 +20,9 @@ jobs: runs-on: ubuntu-latest container: image: ghcr.io/jmr-dev/android-file-handler-debian-builder + credentials: + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} steps: - uses: actions/checkout@v4 @@ -35,6 +38,9 @@ jobs: runs-on: ubuntu-latest container: image: ghcr.io/jmr-dev/android-file-handler-arch-builder + credentials: + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} steps: - uses: actions/checkout@v4 @@ -53,6 +59,9 @@ jobs: packages: read container: image: ghcr.io/jmr-dev/android-file-handler-rhel-builder:fedora42 + credentials: + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} steps: - uses: actions/checkout@v4 @@ -146,6 +155,9 @@ jobs: runs-on: ubuntu-latest container: image: ghcr.io/jmr-dev/android-file-handler-debian-builder + credentials: + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} steps: - name: Checkout code uses: actions/checkout@v4 @@ -194,6 +206,9 @@ jobs: runs-on: ubuntu-latest container: image: ghcr.io/jmr-dev/android-file-handler-arch-builder + credentials: + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} steps: - name: Checkout code uses: actions/checkout@v4 @@ -244,6 +259,9 @@ jobs: runs-on: ubuntu-latest container: image: ghcr.io/jmr-dev/android-file-handler-rhel-builder:fedora42 + credentials: + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} steps: - name: Checkout code uses: actions/checkout@v4