harald
1cdb30147b
Sanctum Release / Build & Release (Windows x86_64) (push) Waiting to run
- R-01: Bereinigung verbliebener Restbehauptungen in Doku und Code (LEGAL.md, README.md, QUICKSTART.md, main.rs, crypto/storage/recovery/verify.rs) - R-02: Lückenloser Carrier-Schutz in SanctumFs::copy (Quelle & Ziel) und sync (Pull-Skip & Push-Schutz) - R-03: Shared Dateinamen-Validierung (validate_node_name) in pathutil.rs, durchgesetzt in storage.rs und vfs.rs - R-04: Fail-closed Release-Packaging & obligatorische Minisign-Signatur in CI (.gitea/workflows/release.yaml) und Scripts - R-05: Session-Token Beseitigung im argv: In-Process Win32 WNetAddConnection2W/WNetCancelConnection2W, kein gio argv-Token, Multi-Auth HTTP Middleware (Basic Auth, X-Sanctum-Token, Path-Fallback) mit 401 WWW-Authenticate - R-06: Sofortiges Löschen von SANCTUM_RECOVERY_KEY aus der Prozessumgebung
97 lines
3.3 KiB
YAML
97 lines
3.3 KiB
YAML
name: Sanctum Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
jobs:
|
|
build:
|
|
name: Build & Release (Windows x86_64)
|
|
runs-on: windows-latest
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install Rust toolchain
|
|
uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
targets: x86_64-pc-windows-msvc
|
|
|
|
- name: Run Tests
|
|
run: cargo test --all --verbose
|
|
|
|
- name: Build Release Binary
|
|
run: cargo build --release
|
|
|
|
- name: Package Artifacts
|
|
id: package
|
|
shell: pwsh
|
|
run: |
|
|
$Tag = "${{ gitea.ref_name }}"
|
|
$DistDir = "dist"
|
|
$PackageName = "sanctum-${Tag}-windows-x86_64"
|
|
$StagingDir = "${DistDir}/${PackageName}"
|
|
$ZipFile = "${DistDir}/${PackageName}.zip"
|
|
|
|
New-Item -ItemType Directory -Path $StagingDir -Force | Out-Null
|
|
Copy-Item "target/release/sanctum.exe" "$StagingDir/"
|
|
Copy-Item "README.md" "$StagingDir/"
|
|
Copy-Item "LICENSE" "$StagingDir/"
|
|
Copy-Item "CHANGELOG.md" "$StagingDir/"
|
|
|
|
Compress-Archive -Path "$StagingDir/*" -DestinationPath $ZipFile -Force
|
|
|
|
$ZipHash = (Get-FileHash -Path $ZipFile -Algorithm SHA256).Hash.ToLower()
|
|
$ExeHash = (Get-FileHash -Path "target/release/sanctum.exe" -Algorithm SHA256).Hash.ToLower()
|
|
|
|
@("$ZipHash ${PackageName}.zip", "$ExeHash sanctum.exe") | Set-Content -Path "${DistDir}/SHA256SUMS.txt" -Encoding utf8
|
|
|
|
|
|
echo "ZIP_FILE=$ZipFile" >> $env:GITHUB_OUTPUT
|
|
echo "PACKAGE_NAME=$PackageName" >> $env:GITHUB_OUTPUT
|
|
|
|
- name: Sign Checksums with Minisign
|
|
shell: pwsh
|
|
env:
|
|
MINISIGN_SECRET_KEY: ${{ secrets.MINISIGN_SECRET_KEY }}
|
|
run: |
|
|
if (-not $env:MINISIGN_SECRET_KEY) {
|
|
Write-Error "Secret MINISIGN_SECRET_KEY ist nicht gesetzt! Release ohne Signatur verboten."
|
|
exit 1
|
|
}
|
|
if (-not (Get-Command minisign -ErrorAction SilentlyContinue)) {
|
|
Invoke-WebRequest -Uri "https://github.com/jedisct1/minisign/releases/download/0.11/minisign-0.11-win64.zip" -OutFile "minisign.zip"
|
|
Expand-Archive -Path "minisign.zip" -DestinationPath "minisign-bin"
|
|
$MinisignExe = "minisign-bin/minisign-win64/minisign.exe"
|
|
} else {
|
|
$MinisignExe = "minisign"
|
|
}
|
|
|
|
$KeyFile = "sanctum-ci-release.key"
|
|
[System.IO.File]::WriteAllText($KeyFile, $env:MINISIGN_SECRET_KEY)
|
|
try {
|
|
& $MinisignExe -S -s $KeyFile -m "dist/SHA256SUMS.txt" -W -x "dist/SHA256SUMS.txt.minisig"
|
|
if ($LASTEXITCODE -ne 0 -or -not (Test-Path "dist/SHA256SUMS.txt.minisig")) {
|
|
Write-Error "Minisign-Signierung fehlgeschlagen!"
|
|
exit 1
|
|
}
|
|
} finally {
|
|
Remove-Item $KeyFile -Force -ErrorAction SilentlyContinue
|
|
}
|
|
|
|
- name: Create Gitea Release
|
|
uses: softprops/action-gh-release@v2
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
with:
|
|
files: |
|
|
dist/*.zip
|
|
dist/SHA256SUMS.txt
|
|
dist/SHA256SUMS.txt.minisig
|
|
target/release/sanctum.exe
|
|
body_path: CHANGELOG.md
|
|
draft: false
|
|
prerelease: false
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|