ci: fix release publish package (#378)

* ci: fix release publish package

* fix

* fix

* add gpg and sha

* fix

* update

* last test

* fix

.github/workflows/build.yml

@@ -177,9 +177,9 @@ jobs:
     name: Semantic release
     if: github.event_name != 'pull_request'
 
-    strategy:
-      matrix:
-        php-version: [7.4]
+    outputs:
+      new_release_published: ${{ steps.semantic.outputs.new_release_published }}
+      new_release_version: ${{ steps.semantic.outputs.new_release_version }}
 
     steps:
       - name: Checkout repository
@@ -203,8 +203,21 @@ jobs:
         run: |
           echo ${{ steps.semantic.outputs.new_release_version }}
 
+  package:
+    needs: semantic-release
+    runs-on: ubuntu-latest
+    name: Package release
+    if: needs.semantic-release.outputs.new_release_published == 'true'
+
+    strategy:
+      matrix:
+        php-version: [7.4]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
       - name: Setup PHP ${{ matrix.php-version }}
-        if: steps.semantic.outputs.new_release_published == 'true'
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php-version }}
@@ -213,11 +226,9 @@ jobs:
 
     # Composer
       - name: Get Composer Cache Directory
-        if: steps.semantic.outputs.new_release_published == 'true'
         id: composer-cache
         run: echo "::set-output name=dir::$(composer config cache-files-dir)"
       - name: Cache composer files
-        if: steps.semantic.outputs.new_release_published == 'true'
         uses: actions/cache@v2
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
@@ -228,11 +239,9 @@ jobs:
 
     # Yarn
       - name: Get yarn cache directory path
-        if: steps.semantic.outputs.new_release_published == 'true'
         id: yarn-cache
         run: echo "::set-output name=dir::$(yarn cache dir)"
       - name: Cache yarn files
-        if: steps.semantic.outputs.new_release_published == 'true'
         uses: actions/cache@v2
         with:
           path: ${{ steps.yarn-cache.outputs.dir }}
@@ -242,18 +251,36 @@ jobs:
             ${{ runner.os }}-yarn-
 
       - name: Create package
-        if: steps.semantic.outputs.new_release_published == 'true'
         id: package
+        run: scripts/package.sh 'v${{ needs.semantic-release.outputs.new_release_version }}'
+
+      - name: Import key
+        run: echo -e "$GPG_KEY" | gpg --batch --yes --import -
+        env:
+          GPG_KEY: ${{ secrets.GPG_KEY }}
+
+      - name: Sign package
         run: |
-          scripts/package.sh '${{ steps.semantic.outputs.new_release_version }}'
+          sha512sum '${{ steps.package.outputs.package }}' > '${{ steps.package.outputs.package }}.sha512'
+          for f in '${{ steps.package.outputs.package }}'{,.sha512}; do
+            echo "Signing '$f'..."
+            echo "$GPG_PASSPHRASE" | gpg --batch --yes --passphrase-fd 0 --pinentry-mode=loopback --local-user $GPG_FINGERPRINT --sign --armor --detach-sig --output "$f.asc" "$f"
+            echo -e "\nSigned with key fingerprint $GPG_FINGERPRINT" >> "$f.asc"
+          done
+        env:
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+          GPG_FINGERPRINT: ${{ secrets.GPG_FINGERPRINT }}
 
       - name: Publish package
-        if: steps.semantic.outputs.new_release_published == 'true'
         run: |
-          scripts/publish.sh '${{ steps.semantic.outputs.new_release_version }}' '${{ steps.package.outputs.package }}'
+          for f in '${{ steps.package.outputs.package }}'{,.asc,.sha512,.sha512.asc}; do
+            echo "Uploading release file '$f'..."
+            gh release upload 'v${{ needs.semantic-release.outputs.new_release_version }}' "$f" --clobber
+          done
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Store package
-        if: steps.semantic.outputs.new_release_published == 'true'
         uses: actions/upload-artifact@v2
         with:
           name: release

scripts/package.sh

@@ -21,38 +21,38 @@ composer install --no-progress --no-interaction --no-suggest --prefer-dist --opt
 yarn install --ignore-engines --frozen-lockfile
 
 # PACKAGE
-r=officelife-$version
-mkdir -p $r/database
-ln -s $ROOT/.env.example $r/
-ln -s $ROOT/artisan $r/
-ln -s $ROOT/CHANGELOG $r/
-ln -s $ROOT/composer.json $r/
-ln -s $ROOT/composer.lock $r/
-ln -s $ROOT/LICENSE $r/
-ln -s $ROOT/package.json $r/
-ln -s $ROOT/README.md $r/
-ln -s $ROOT/server.php $r/
-ln -s $ROOT/webpack.mix.js $r/
-ln -s $ROOT/yarn.lock $r/
-ln -s $ROOT/app $r/
-ln -s $ROOT/bootstrap $r/
-ln -s $ROOT/config $r/
-ln -s $ROOT/docs $r/
-ln -s $ROOT/public $r/
-ln -s $ROOT/resources $r/
-ln -s $ROOT/routes $r/
-ln -s $ROOT/vendor $r/
-
-ln -s $ROOT/database/factories $r/database/
-ln -s $ROOT/database/migrations $r/database/
-ln -s $ROOT/database/seeds $r/database/
-
-mkdir -p $r/storage/app/public
-mkdir -p $r/storage/logs
-mkdir -p $r/storage/framework/cache
-mkdir -p $r/storage/framework/views
-mkdir -p $r/storage/framework/sessions
-
-tar chfj $ROOT/$r.tar.bz2 --exclude .gitignore --exclude .gitkeep $r
-
-echo "::set-output name=package::$ROOT/$r.tar.bz2"
+package=officelife-$version
+mkdir -p $package/database
+ln -s $ROOT/.env.example $package/
+ln -s $ROOT/artisan $package/
+ln -s $ROOT/CHANGELOG $package/
+ln -s $ROOT/composer.json $package/
+ln -s $ROOT/composer.lock $package/
+ln -s $ROOT/LICENSE $package/
+ln -s $ROOT/package.json $package/
+ln -s $ROOT/README.md $package/
+ln -s $ROOT/server.php $package/
+ln -s $ROOT/webpack.mix.js $package/
+ln -s $ROOT/yarn.lock $package/
+ln -s $ROOT/app $package/
+ln -s $ROOT/bootstrap $package/
+ln -s $ROOT/config $package/
+ln -s $ROOT/docs $package/
+ln -s $ROOT/public $package/
+ln -s $ROOT/resources $package/
+ln -s $ROOT/routes $package/
+ln -s $ROOT/vendor $package/
+
+ln -s $ROOT/database/factories $package/database/
+ln -s $ROOT/database/migrations $package/database/
+ln -s $ROOT/database/seeds $package/database/
+
+mkdir -p $package/storage/app/public
+mkdir -p $package/storage/logs
+mkdir -p $package/storage/framework/cache
+mkdir -p $package/storage/framework/views
+mkdir -p $package/storage/framework/sessions
+
+tar chfj $ROOT/$package.tar.bz2 --exclude .gitignore --exclude .gitkeep $package
+
+echo "::set-output name=package::$package.tar.bz2"