Patrick Niebeling
5bd3181f10
Build package / php-lint (8.5) (push) Successful in 1m51s
Build package / xml-lint (push) Successful in 49s
Build package / unit-tests (push) Successful in 1m51s
Build package / php-lint (8.4) (push) Successful in 1m47s
Build package / package (push) Successful in 2m39s
appstore.yml signs the tarball of an existing v* release and registers its Gitea download URL with the App Store; it only runs on workflow_dispatch. Also adds the AGPL LICENSE and points website, bugs and repository in info.xml at the Gitea repository.
85 lines
3.3 KiB
YAML
85 lines
3.3 KiB
YAML
name: Publish to App Store
|
|
|
|
# Manual only: pushes an already published v* release to apps.nextcloud.com.
|
|
# It does not build anything - it signs the exact tarball build-main.yml
|
|
# attached to the Gitea release, because the App Store downloads the file from
|
|
# that URL and checks the signature against it. That release only exists if
|
|
# the checks were green, so this workflow needs no `needs:` of its own.
|
|
#
|
|
# Secrets:
|
|
# APPSTORE_PRIVATE_KEY workflow_deck_automation.key (PEM, the key the App
|
|
# Store certificate was issued for)
|
|
# APPSTORE_TOKEN API token from https://apps.nextcloud.com/account/token
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: 'Release-Tag, z. B. v35.2.3'
|
|
required: true
|
|
type: string
|
|
|
|
jobs:
|
|
appstore:
|
|
runs-on: gitea-runner-server03
|
|
permissions:
|
|
contents: read
|
|
env:
|
|
TAG: ${{ inputs.tag }}
|
|
DOWNLOAD_URL: ${{ gitea.server_url }}/${{ gitea.repository }}/releases/download/${{ inputs.tag }}/workflow_deck_automation.tar.gz
|
|
steps:
|
|
- name: Check tag
|
|
run: |
|
|
# latest-main is rebuilt on every push, so its tarball (and signature)
|
|
# would not stay valid - only real version tags go to the store.
|
|
if ! printf '%s' "$TAG" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
|
|
echo "::error::'$TAG' is not a version tag (vX.Y.Z)"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Download release tarball
|
|
run: |
|
|
# Anonymous on purpose: the App Store fetches this URL without
|
|
# credentials, so a private or missing release has to fail here.
|
|
curl -fsSL "$DOWNLOAD_URL" -o workflow_deck_automation.tar.gz
|
|
|
|
- name: Check version in tarball
|
|
run: |
|
|
VERSION=$(tar -xzOf workflow_deck_automation.tar.gz workflow_deck_automation/appinfo/info.xml \
|
|
| sed -n 's:.*<version>\(.*\)</version>.*:\1:p')
|
|
if [ "v$VERSION" != "$TAG" ]; then
|
|
echo "::error::info.xml says version '$VERSION', tag is '$TAG'"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Sign and upload
|
|
env:
|
|
PRIVATE_KEY: ${{ secrets.APPSTORE_PRIVATE_KEY }}
|
|
APPSTORE_TOKEN: ${{ secrets.APPSTORE_TOKEN }}
|
|
run: |
|
|
set -e
|
|
if [ -z "$PRIVATE_KEY" ] || [ -z "$APPSTORE_TOKEN" ]; then
|
|
echo "::error::APPSTORE_PRIVATE_KEY and APPSTORE_TOKEN must be set"
|
|
exit 1
|
|
fi
|
|
|
|
KEY_FILE=$(mktemp)
|
|
trap 'rm -f "$KEY_FILE"' EXIT
|
|
chmod 600 "$KEY_FILE"
|
|
printf '%s\n' "$PRIVATE_KEY" > "$KEY_FILE"
|
|
|
|
# -A keeps the base64 on one line, so it can go into the JSON as is.
|
|
SIGNATURE=$(openssl dgst -sha512 -sign "$KEY_FILE" workflow_deck_automation.tar.gz | openssl base64 -A)
|
|
|
|
STATUS=$(curl -sS -o response.json -w '%{http_code}' -X POST \
|
|
-H "Authorization: Token $APPSTORE_TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"download\":\"$DOWNLOAD_URL\",\"signature\":\"$SIGNATURE\",\"nightly\":false}" \
|
|
https://apps.nextcloud.com/api/v1/apps/releases)
|
|
|
|
cat response.json; echo
|
|
# 201 = new release, 200 = existing release replaced
|
|
case "$STATUS" in
|
|
200|201) echo "App Store accepted $TAG (HTTP $STATUS)" ;;
|
|
*) echo "::error::App Store answered HTTP $STATUS"; exit 1 ;;
|
|
esac
|