Bump actions/attest from 4.2.0 to 4.2.2 #660
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build binaries | |
| on: | |
| workflow_dispatch: | |
| # also test this workflow and build scripts in CI when changed | |
| push: | |
| paths: | |
| - '.github/workflows/binaries.yaml' | |
| - 'macosx/*.sh' | |
| - 'win32/*.sh' | |
| pull_request: | |
| paths: | |
| - '.github/workflows/binaries.yaml' | |
| - 'macosx/*.sh' | |
| - 'win32/*.sh' | |
| concurrency: | |
| # Cancels pending runs when a PR gets updated. (For push we'd use ref.) | |
| group: "${{ github.workflow }}-${{ github.head_ref || github.run_id }}-${{ github.actor }}" | |
| cancel-in-progress: true | |
| permissions: | |
| id-token: 'write' # '${{ github.event_name == 'workflow_dispatch' && 'write' || 'none' }} | |
| attestations: 'write' # '${{ github.event_name == 'workflow_dispatch' && 'write' || 'none' }} | |
| env: | |
| APPIMAGE_BUILDER_URL: 'https://github.com/AppImageCrafters/appimage-builder/releases/download/v1.1.0/appimage-builder-1.1.0-x86_64.AppImage' | |
| APPIMAGE_BUILDER_HASH: '4b4f99cae9291d78ba12dbdabca7c0a67c72aa61eb2e5d424089171a9485e96f' | |
| APPIMAGETOOL_URL: 'https://github.com/PopTracker/appimagetool/releases/download/r-2025-11-18/appimagetool-x86_64.AppImage' | |
| APPIMAGETOOL_HASH: '4577a452b30af2337123fbb383aea154b618e51ad5448c3b62085cbbbfbfd9a2' | |
| APPIMAGE_RUNTIME_URL: 'https://github.com/PopTracker/type2-runtime/releases/download/r-2025-11-07/runtime-x86_64' | |
| APPIMAGE_RUNTIME_HASH: '27ddd3f78e483fc5f7856e413d7c17092917f8c35bfe3318a0d378aa9435ad17' | |
| APPIMAGE_RUNTIME_NAME: 'runtime-x86_64' | |
| APPRUN_URL: 'https://github.com/AppImageCrafters/AppRun/releases/download/v2.0.0/AppRun-Debug-x86_64' | |
| APPRUN_HASH: 'b19b10ffe0f0e1af7344a6d733d95a1097c00ee5730cb17c97bdfd6c409d80a5' | |
| APPRUN_NAME: 'AppRun-Release-x86_64' | |
| APPRUN_HOOKS_URL: 'https://github.com/AppImageCrafters/AppRun/releases/download/v2.0.0/libapprun_hooks-Release-x86_64.so' | |
| APPRUN_HOOKS_HASH: '1f64dd2161be3242f106c891b2daf27bbdd2103c20b28f57f61a56cdccb1eb6a' | |
| APPRUN_HOOKS_NAME: 'libapprun_hooks-Release-x86_64.so' | |
| jobs: | |
| build-ubuntu: | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| matrix: | |
| os: | |
| - ubuntu-22.04 | |
| - ubuntu-22.04-arm | |
| steps: | |
| - name: Set env | |
| shell: bash | |
| run: | | |
| OS=`uname -s | tr A-Z a-z` | |
| ARCH=`uname -m` | |
| echo "OS=$OS" >> $GITHUB_ENV | |
| echo "ARCH=$ARCH" >> $GITHUB_ENV | |
| echo "UNAME=$OS-$ARCH" >> $GITHUB_ENV | |
| - name: Install dependencies | |
| run: | | |
| sudo apt-get update -y -qq | |
| sudo apt-get install coreutils build-essential libsdl2-dev libsdl2-image-dev libsdl2-ttf-dev p7zip libgtest-dev libgmock-dev | |
| - uses: actions/checkout@v7.0.1 | |
| with: | |
| submodules: recursive | |
| - name: Build RELEASE | |
| run: make native CONF=RELEASE -j4 | |
| - name: Run tests | |
| run: make test CONF=RELEASE | |
| - name: Get version | |
| run: | | |
| POP_VERSION=`./build/${{ env.UNAME }}/poptracker --version` | |
| POP_NAME=poptracker_`./build/${{ env.UNAME }}/poptracker --version | tr '.' '-'` | |
| echo "POP_VERSION=$POP_VERSION" >> $GITHUB_ENV | |
| echo "POP_NAME=$POP_NAME" >> $GITHUB_ENV | |
| - name: Build DIST # this builds a release ZIP, maybe .deb in the future | |
| run: make CONF=DIST | |
| - name: Attest Build and Archive | |
| if: ${{ github.event_name == 'workflow_dispatch' }} | |
| uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 | |
| with: | |
| subject-path: | | |
| build/${{ env.UNAME }}/poptracker | |
| dist/* | |
| - name: Store DIST | |
| uses: actions/upload-artifact@v7.0.1 | |
| with: | |
| path: dist/* | |
| archive: false | |
| if-no-files-found: error | |
| build-appimage: | |
| runs-on: ubuntu-22.04 # TODO: add arm64 AppImage | |
| steps: | |
| - name: Set env | |
| shell: bash | |
| run: | | |
| OS=`uname -s | tr A-Z a-z` | |
| ARCH=`uname -m` | |
| echo "OS=$OS" >> $GITHUB_ENV | |
| echo "ARCH=$ARCH" >> $GITHUB_ENV | |
| echo "UNAME=$OS-$ARCH" >> $GITHUB_ENV | |
| - name: Install dependencies | |
| run: | | |
| sudo apt-get update -y -qq | |
| sudo apt-get install coreutils build-essential libsdl2-dev libsdl2-image-dev libsdl2-ttf-dev p7zip wget libgtest-dev libgmock-dev | |
| - uses: actions/checkout@v7.0.1 | |
| with: | |
| submodules: recursive | |
| - name: Get appimage-builder, appimagetool, runtime, AppRun and hooks | |
| run: | | |
| # download appimage-builder | |
| wget -q -O appimage-builder "$APPIMAGE_BUILDER_URL" | |
| echo "$APPIMAGE_BUILDER_HASH appimage-builder" | sha256sum -c | |
| chmod +x appimage-builder | |
| # download appimagetool | |
| wget -q -O appimagetool "$APPIMAGETOOL_URL" | |
| echo "$APPIMAGETOOL_HASH appimagetool" | sha256sum -c | |
| chmod +x appimagetool | |
| # download specific runtime | |
| mkdir -p appimage-build/prime | |
| wget -q -O "appimage-build/prime/$APPIMAGE_RUNTIME_NAME" "$APPIMAGE_RUNTIME_URL" | |
| echo "$APPIMAGE_RUNTIME_HASH appimage-build/prime/$APPIMAGE_RUNTIME_NAME" | sha256sum -c | |
| # download specific AppRun | |
| mkdir -p appimage-build/AppRun/v2.0.0 | |
| wget -q -O "appimage-build/AppRun/v2.0.0/$APPRUN_NAME" "$APPRUN_URL" | |
| echo "$APPRUN_HASH appimage-build/AppRun/v2.0.0/$APPRUN_NAME" | sha256sum -c | |
| wget -q -O "appimage-build/AppRun/v2.0.0/$APPRUN_HOOKS_NAME" "$APPRUN_HOOKS_URL" | |
| echo "$APPRUN_HOOKS_HASH appimage-build/AppRun/v2.0.0/$APPRUN_HOOKS_NAME" | sha256sum -c | |
| - name: Build AppDir | |
| run: | | |
| # build AppDir | |
| ./appimage-builder --appimage-extract-and-run --skip-appimage --recipe linux/AppImageBuilder.yml | |
| # verify we have not accidentally downloaded another runtime | |
| echo "$APPIMAGE_RUNTIME_HASH appimage-build/prime/$APPIMAGE_RUNTIME_NAME" | sha256sum -c | |
| [ "$(ls -1q appimage-build/prime/ | wc -l)" == "1" ] || exit 1 | |
| # verify we have not accidentally downloaded another AppRun | |
| echo "$APPRUN_HASH appimage-build/AppRun/v2.0.0/$APPRUN_NAME" | sha256sum -c | |
| echo "$APPRUN_HOOKS_HASH appimage-build/AppRun/v2.0.0/$APPRUN_HOOKS_NAME" | sha256sum -c | |
| [ "$(ls -1q appimage-build/AppRun/ | wc -l)" == "1" ] || exit 1 | |
| [ "$(ls -1q appimage-build/AppRun/v2.0.0/ | wc -l)" == "2" ] || exit 1 | |
| - name: Build AppImage | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # currently required to automatically get update info | |
| run: | | |
| # extract recipe version for appimagetool | |
| export VERSION=$(cat linux/AppImageBuilder.yml \ | |
| | sed -n '/AppDir:/,$p' \ | |
| | sed -nr 's/\s*version:\s*(.*)/\1/p' \ | |
| | head -n 1) | |
| # package AppDir into AppImage with appimagetool | |
| ./appimagetool --appimage-extract-and-run \ | |
| -g --runtime-file "appimage-build/prime/$APPIMAGE_RUNTIME_NAME" \ | |
| AppDir | |
| - name: Attest Build, AppImage and zsync | |
| if: ${{ github.event_name == 'workflow_dispatch' }} | |
| uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 | |
| with: | |
| subject-path: | | |
| appimage-build/${{ env.UNAME }}/poptracker | |
| *.AppImage* | |
| - name: Store AppImage | |
| uses: actions/upload-artifact@v7.0.1 | |
| with: | |
| name: AppImage-${{ env.ARCH }} | |
| path: "*.AppImage*" | |
| if-no-files-found: error | |
| build-macos: | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: | |
| - macos-15-intel # x86_64 | |
| - macos-15 # arm64 (Apple Silicon) | |
| steps: | |
| - name: Set env | |
| shell: bash | |
| run: | | |
| OS=darwin | |
| ARCH=`uname -m` | |
| echo "OS=$OS" >> $GITHUB_ENV | |
| echo "ARCH=$ARCH" >> $GITHUB_ENV | |
| echo "UNAME=$OS-$ARCH" >> $GITHUB_ENV | |
| - name: Install dependencies | |
| run: | | |
| brew install coreutils SDL2 sdl2_ttf sdl2_image openssl@3.0 automake googletest || true | |
| # required, but pre-installed: libtool autoconf | |
| - uses: actions/checkout@v7.0.1 | |
| with: | |
| submodules: recursive | |
| - name: Cache/restore macosx-libs | |
| if: ${{ github.event_name != 'workflow_dispatch' }} | |
| uses: actions/cache@v6.1.0 | |
| with: | |
| key: libs-${{ runner.os }}-${{ runner.arch }}-${{ env.cache-name }}-${{ hashFiles('macosx/*.sh') }} | |
| path: | | |
| macosx/build | |
| macosx/libs | |
| - name: Build RELEASE | |
| run: make native CONF=RELEASE -j4 | |
| - name: Run tests | |
| run: make test CONF=RELEASE | |
| - name: Get version | |
| run: | | |
| POP_VERSION=`./build/${{ env.UNAME }}/poptracker --version` | |
| POP_NAME=poptracker_`./build/${{ env.UNAME }}/poptracker --version | tr '.' '-'` | |
| echo "POP_VERSION=$POP_VERSION" >> $GITHUB_ENV | |
| echo "POP_NAME=$POP_NAME" >> $GITHUB_ENV | |
| - name: Build DIST # this builds the app bundle, zips it and maybe .dmg in the future | |
| run: make CONF=DIST | |
| - name: Check DIST | |
| run: | | |
| du -sh ./build/${{ env.UNAME }}/poptracker.app | |
| cd ./build/${{ env.UNAME }}/poptracker.app/Contents/MacOS | |
| otool -L ./poptracker | |
| ./poptracker --version | |
| ./poptracker --list-packs | |
| - name: Attest Build and AppBundle | |
| if: ${{ github.event_name == 'workflow_dispatch' }} | |
| uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 | |
| with: | |
| subject-path: | | |
| build/${{ env.UNAME }}/poptracker.app/Contents/MacOS/poptracker | |
| dist/* | |
| - name: Package app bundle for universal merge | |
| run: | | |
| # tar (rather than uploading the .app directly) preserves the bundle's | |
| # symlinks and permissions across the artifact round-trip. | |
| tar -czf "poptracker-${{ env.ARCH }}.tar.gz" -C "build/${{ env.UNAME }}" poptracker.app | |
| - name: Upload per-arch app bundle | |
| uses: actions/upload-artifact@v7.0.1 | |
| with: | |
| name: macos-app-${{ env.ARCH }} | |
| path: poptracker-${{ env.ARCH }}.tar.gz | |
| if-no-files-found: error | |
| build-macos-universal: | |
| needs: build-macos | |
| runs-on: macos-15 | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - name: Download per-arch app bundles | |
| uses: actions/download-artifact@v8.0.1 | |
| with: | |
| pattern: macos-app-* | |
| path: dl | |
| merge-multiple: true | |
| - name: Merge into a universal2 bundle | |
| run: | | |
| mkdir -p arm64 x86_64 | |
| tar -xzf dl/poptracker-arm64.tar.gz -C arm64 | |
| tar -xzf dl/poptracker-x86_64.tar.gz -C x86_64 | |
| bash macosx/make_universal.sh arm64/poptracker.app x86_64/poptracker.app poptracker.app | |
| # lipo invalidates code signatures; re-sign ad-hoc and verify | |
| codesign --force --deep --sign - poptracker.app | |
| codesign --verify --deep --strict poptracker.app | |
| lipo -info poptracker.app/Contents/MacOS/poptracker | |
| - name: Package universal ZIP | |
| run: | | |
| VS=`./poptracker.app/Contents/MacOS/poptracker --version | tr '.' '-'` | |
| mkdir -p dist | |
| # ditto preserves the signature's extended attributes (a plain zip strips them) | |
| ditto -c -k --keepParent --sequesterRsrc --zlibCompressionLevel 9 poptracker.app "dist/poptracker_${VS}_macos_universal.zip" | |
| ls -l dist | |
| - name: Attest Build and AppBundle | |
| if: ${{ github.event_name == 'workflow_dispatch' }} | |
| uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 | |
| with: | |
| subject-path: | | |
| poptracker.app/Contents/MacOS/poptracker | |
| dist/* | |
| - name: Store universal ZIP | |
| uses: actions/upload-artifact@v7.0.1 | |
| with: | |
| path: dist/* | |
| archive: false | |
| if-no-files-found: error | |
| build-msys: | |
| runs-on: windows-latest | |
| steps: | |
| - name: Set env | |
| shell: bash | |
| run: | | |
| echo "UNAME=win64" >> $GITHUB_ENV | |
| - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0 | |
| with: | |
| update: true | |
| cache: ${{ github.event_name != 'workflow_dispatch' }} | |
| install: >- | |
| base-devel | |
| coreutils | |
| make | |
| mingw-w64-x86_64-toolchain | |
| autoconf-wrapper | |
| mingw-w64-x86_64-autotools | |
| mingw64/mingw-w64-x86_64-SDL2 | |
| mingw64/mingw-w64-x86_64-SDL2_image | |
| mingw64/mingw-w64-x86_64-SDL2_ttf | |
| mingw64/mingw-w64-x86_64-freetype | |
| mingw64/mingw-w64-x86_64-openssl | |
| mingw64/mingw-w64-x86_64-gtest | |
| p7zip | |
| wget | |
| mingw-w64-x86_64-advancecomp | |
| - uses: actions/checkout@v7.0.1 | |
| with: | |
| submodules: recursive | |
| - name: Cache/restore win32-libs | |
| if: ${{ github.event_name != 'workflow_dispatch' }} | |
| uses: actions/cache@v6.1.0 | |
| with: | |
| key: libs-${{ runner.os }}-${{ env.cache-name }}-${{ hashFiles('win32/*.sh') }} | |
| path: | | |
| win32-lib | |
| win32-lib-src | |
| - name: Build libs | |
| shell: msys2 {0} | |
| run: | | |
| mkdir -p win32-lib-src | |
| cd win32-lib-src | |
| ../win32/native-compile-libs-win32.sh | |
| - name: Uninstall system libs | |
| shell: msys2 {0} | |
| run: | | |
| pacman -R --noconfirm mingw-w64-x86_64-SDL2 mingw-w64-x86_64-SDL2_image mingw-w64-x86_64-SDL2_ttf | |
| - name: Build RELEASE | |
| shell: msys2 {0} | |
| run: make native CONF=RELEASE -j4 | |
| - name: Run tests | |
| shell: msys2 {0} | |
| run: make test CONF=RELEASE | |
| - name: Get version | |
| shell: msys2 {0} | |
| run: | | |
| POP_VERSION=`./build/${{ env.UNAME }}/poptracker --version` | |
| POP_NAME=poptracker_`./build/${{ env.UNAME }}/poptracker --version | tr '.' '-'` | |
| echo "POP_VERSION=$POP_VERSION" >> $GITHUB_ENV | |
| echo "POP_NAME=$POP_NAME" >> $GITHUB_ENV | |
| - name: Download Updater | |
| shell: msys2 {0} | |
| env: | |
| UPDATER_VERSION: 'v0.2.0' | |
| UPDATER_OS: ${{ runner.os }} | |
| UPDATER_ARCH: ${{ runner.arch }} | |
| UPDATER_ZIP_HASH: 'b67945e229c05e15eee4665b145921cfa20d4a9605bc41f936ad38143bb57285' | |
| run: | | |
| wget -O updater.zip \ | |
| "https://github.com/black-sliver/PopUpdater/releases/download/${UPDATER_VERSION}/PopUpdater_${UPDATER_VERSION}_${UPDATER_OS}-${UPDATER_ARCH}.zip" | |
| echo "${UPDATER_ZIP_HASH} updater.zip" | sha256sum -c | |
| 7z e -obuild/win64 updater.zip | |
| - name: Build DIST # this builds a release ZIP | |
| shell: msys2 {0} | |
| run: make CONF=DIST | |
| - name: Attest Build and Archive | |
| if: ${{ github.event_name == 'workflow_dispatch' }} | |
| uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 | |
| with: | |
| subject-path: | | |
| build/${{ env.UNAME }}/poptracker.exe | |
| dist/* | |
| - name: Store DIST | |
| uses: actions/upload-artifact@v7.0.1 | |
| with: | |
| path: dist/* | |
| archive: false | |
| if-no-files-found: error | |
| - name: Build DEBUG | |
| shell: msys2 {0} | |
| run: | | |
| make clean | |
| make native CONF=DEBUG -j4 | |
| 7z a -mx=9 dist/poptracker-${{ env.UNAME }}-debug.zip build/${{ env.UNAME }}/poptracker.exe | |
| - name: Attest Debug Build and Archive | |
| if: ${{ github.event_name == 'workflow_dispatch' }} | |
| uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 | |
| with: | |
| subject-path: | | |
| build/${{ env.UNAME }}/poptracker.exe | |
| dist/poptracker-${{ env.UNAME }}-debug.zip | |
| - name: Store DEBUG | |
| uses: actions/upload-artifact@v7.0.1 | |
| with: | |
| path: dist/poptracker-win64-debug.zip | |
| archive: false | |
| if-no-files-found: error |