desktop.test-windows.sign.yml

name: Desktop Windows Sign & Release On Windows Machine

on:
  workflow_dispatch:
  push:
    branches:
      - 'karolsojko/sta-2151-windows-desktop-signing'

jobs:
  Windows:
    runs-on: windows-latest

    defaults:
      run:
        working-directory: packages/desktop

    steps:
      - uses: actions/checkout@v3

      - uses: actions/setup-node@v3
        with:
          registry-url: 'https://registry.npmjs.org'
          node-version-file: '.nvmrc'
          cache: 'yarn'

      - run: yarn install --immutable

      - run: yarn build:desktop

      - run: yarn run webpack --config desktop.webpack.prod.js

      - name: Set up certificate
        run: |
          echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12
        shell: bash

      - name: Set variables
        id: variables
        run: |
          dir
          echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
          echo "KEYPAIR_NAME=snkeypair" >> $GITHUB_OUTPUT
          echo "CERTIFICATE_NAME=sncertificate" >> $GITHUB_OUTPUT
          echo "SM_HOST=${{ secrets.SM_HOST }}" >> "$GITHUB_ENV"
          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV"
          echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV"
          echo "C:\Program Files (x86)\Windows Kits\10\App Certification Kit" >> $GITHUB_PATH
          echo "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools" >> $GITHUB_PATH
          echo "C:\Program Files\DigiCert\DigiCert Keylocker Tools" >> $GITHUB_PATH
        shell: bash

      - name: Setup Keylocker KSP on windows
        run: |
          curl -X GET  https://one.digicert.com/signingmanager/api-ui/v1/releases/Keylockertools-windows-x64.msi/download -H "x-api-key:%SM_API_KEY%" -o Keylockertools-windows-x64.msi
          msiexec /i Keylockertools-windows-x64.msi /quiet /qn
          smksp_registrar.exe list
          smctl.exe keypair ls
          C:\Windows\System32\certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
        shell: cmd

      - name: Certificates Sync
        run: |
           smctl windows certsync
        shell: cmd

      - run: yarn run electron-builder --windows --x64 --ia32 --publish=never --c.extraMetadata.version=$(node -p "require('./../web/package.json').version")

      - name: Upload
        uses: actions/upload-artifact@v3.0.0
        with:
          name: assets
          path: |
            packages/desktop/dist/*.blockmap
            packages/desktop/dist/*.exe
            packages/desktop/dist/*.yml
            packages/desktop/dist/*.yaml