Windows Build #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Windows Build | |
| on: | |
| # push: | |
| # branches: [ main ] | |
| # pull_request: | |
| workflow_dispatch: | |
| workflow_call: | |
| jobs: | |
| build-windows: | |
| name: Build Windows | |
| runs-on: windows-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Setup Flutter | |
| uses: flutter-actions/setup-flutter@v4 | |
| with: | |
| channel: stable | |
| version: latest | |
| - name: Install dependencies | |
| run: flutter pub get | |
| # - name: Build Windows app | |
| # run: flutter build windows --release | |
| - name: Create MSIX Installer | |
| run: dart run msix:create | |
| shell: pwsh | |
| - name: Verify signtool exists | |
| run: | | |
| $signtool = "C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64\signtool.exe" | |
| if (Test-Path $signtool) { | |
| Write-Host "Signtool found at $signtool" | |
| } else { | |
| Write-Host "Signtool NOT found at $signtool. Searching..." | |
| Get-ChildItem -Path "C:\Program Files (x86)\Windows Kits" -Filter "signtool.exe" -Recurse | Select-Object -First 5 | |
| } | |
| shell: pwsh | |
| - name: Setup eSigner CKA | |
| run: | | |
| $url = "https://www.ssl.com/download/ssl-com-esigner-cka/" | |
| curl.exe -L $url -o eSignerCKA_Setup.zip | |
| Expand-Archive -Path eSignerCKA_Setup.zip -DestinationPath eSignerCKA_Setup | |
| # The zip contains an EXE, not an MSI directly | |
| $exePath = Get-ChildItem -Path eSignerCKA_Setup -Filter "*.exe" -Recurse | Select-Object -First 1 | |
| if ($null -eq $exePath) { throw "eSignerCKA EXE not found." } | |
| # Run the EXE installer silently | |
| Write-Host "Installing $($exePath.FullName)..." | |
| # SSL.com eSigner CKA uses Inno Setup. | |
| # According to the help output, correct flags for silent install are: | |
| # /VERYSILENT - completely silent | |
| # /SUPPRESSMSGBOXES - no dialogs | |
| # /NORESTART - do not reboot | |
| # /SP- - skip "This will install..." prompt | |
| $process = Start-Process -FilePath $exePath.FullName -ArgumentList "/VERYSILENT", "/SUPPRESSMSGBOXES", "/NORESTART", "/SP-", "/LOG=install.log" -PassThru -Wait | |
| if (Test-Path "install.log") { | |
| Get-Content "install.log" | Select-Object -Last 20 | |
| } | |
| # Wait a bit more just in case | |
| Start-Sleep -Seconds 60 | |
| # Add eSignerCKA to PATH | |
| $ckaPath = "C:\Program Files\SSL.com\eSignerCKA" | |
| if (!(Test-Path $ckaPath)) { | |
| $ckaPath = "C:\Program Files (x86)\SSL.com\eSignerCKA" | |
| } | |
| if (!(Test-Path $ckaPath)) { | |
| # One more check - sometimes it installs to just SSL.com | |
| $ckaPath = Get-ChildItem -Path "C:\Program Files", "C:\Program Files (x86)" -Filter "eSignerCKA" -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1 -ExpandProperty FullName | |
| } | |
| if ($ckaPath -and (Test-Path $ckaPath)) { | |
| Write-Host "eSignerCKA installed at $ckaPath" | |
| echo "$ckaPath" >> $env:GITHUB_PATH | |
| } else { | |
| # Debug: show where it might have been installed | |
| Get-ChildItem -Path "C:\Program Files", "C:\Program Files (x86)" -Filter "*SSL*" -Recurse -Depth 2 -ErrorAction SilentlyContinue | |
| throw "eSignerCKA installation failed. Directory not found." | |
| } | |
| shell: pwsh | |
| - name: Sign MSIX with eSigner CKA | |
| run: | | |
| # Config and Login | |
| eSignerCKA.exe config -mode manual -set_path "C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64\signtool.exe" | |
| eSignerCKA.exe login ` | |
| -username "${{ secrets.SS_USER_NAME }}" ` | |
| -password "${{ secrets.SS_USER_PASSWORD }}" ` | |
| -credential_id "${{ secrets.SS_CREDENTIAL_ID }}" ` | |
| -totp_secret "${{ secrets.SS_TOTP_SECRET }}" ` | |
| -save | |
| $msixPath = Get-ChildItem -Path build/windows/x64/runner/Release/*.msix | Select-Object -First 1 | |
| if ($null -eq $msixPath) { throw "MSIX file not found." } | |
| $absoluteMsixPath = $msixPath.FullName | |
| $absoluteOutputDir = Join-Path (Get-Location).Path "build/windows/x64/runner/Release/signed" | |
| if (!(Test-Path $absoluteOutputDir)) { New-Item -ItemType Directory -Force -Path $absoluteOutputDir } | |
| $signedMsixPath = Join-Path $absoluteOutputDir $msixPath.Name | |
| # Copy to signed dir first because signtool signs in-place | |
| Copy-Item -Path $absoluteMsixPath -Destination $signedMsixPath | |
| # Sign with signtool | |
| # We use signtool directly. eSignerCKA provides the KSP "SSL.com KSP". | |
| & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64\signtool.exe" sign /debug /fd sha256 /tr http://ts.ssl.com /td sha256 /f "${{ secrets.SS_CREDENTIAL_ID }}" /csp "SSL.com KSP" /kc "${{ secrets.SS_USER_NAME }}" "$signedMsixPath" | |
| # Logout | |
| eSignerCKA.exe logout | |
| shell: pwsh | |
| - name: Upload Windows build | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: windows-msix | |
| path: | | |
| build/windows/x64/runner/Release/*.msix | |
| build/windows/x64/runner/Release/signed/*.msix |