379 lines
17 KiB
YAML
379 lines
17 KiB
YAML
name: Build and deploy OutlookAddin
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags: ['v*']
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
env:
|
|
REGISTRY: gitea.dev.marcus-law.co.il
|
|
CDN_IMAGE_NAME: espocrm-extensions/outlook-addin-cdn
|
|
PROVIDER_URL: 'https://platform.dev.marcus-law.co.il/outlook-addin/OutlookAddin.vsto'
|
|
# Force NuGet to install + resolve packages outside C:\Windows\System32\.
|
|
# NuGet's UserProfile lookup uses SHGetKnownFolderPath which ignores our
|
|
# USERPROFILE override and returns the LocalSystem profile when the runner
|
|
# service runs as LocalSystem. 32-bit MSBuild then hits Win32 File System
|
|
# Redirector and "loses" packages -> NETSDK1064. NUGET_PACKAGES short-
|
|
# circuits the lookup and keeps everything outside system32.
|
|
NUGET_PACKAGES: 'C:\actions-home\.nuget\packages'
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: windows-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Add Office-capable MSBuild to PATH
|
|
shell: powershell
|
|
run: |
|
|
# microsoft/setup-msbuild@v2 picks `vswhere -latest`, which prefers
|
|
# Build Tools 2022. Build Tools has no VSTO targets (MSB4226), so
|
|
# locate a VS installation that explicitly has the Office workload
|
|
# (the one that ships Microsoft.VisualStudio.Tools.Office.targets).
|
|
$vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
|
|
$installPath = & $vswhere -products * -requires Microsoft.VisualStudio.Workload.Office -property installationPath | Select-Object -First 1
|
|
if (-not $installPath) { throw "No VS installation with the Office workload found on this runner." }
|
|
$msbuildDir = Join-Path $installPath 'MSBuild\Current\Bin'
|
|
Write-Host "Using MSBuild from $msbuildDir"
|
|
Add-Content -Path $env:GITHUB_PATH -Value $msbuildDir
|
|
|
|
- name: Import code-signing cert into CurrentUser\My
|
|
# The VSTO ResolveKeySource target reads ManifestCertificateThumbprint
|
|
# straight from the csproj XML and looks for it under Cert:\CurrentUser\My
|
|
# (not LocalMachine\My). Import the real Marcus-Law cert there.
|
|
shell: powershell
|
|
env:
|
|
PFX_B64: ${{ secrets.CODESIGN_CERT_PFX_BASE64 }}
|
|
PFX_PWD: ${{ secrets.CODESIGN_CERT_PASSWORD }}
|
|
THUMB: ${{ secrets.CODESIGN_THUMBPRINT }}
|
|
run: |
|
|
$existing = Get-ChildItem Cert:\CurrentUser\My -ErrorAction SilentlyContinue |
|
|
Where-Object { $_.Thumbprint -eq $env:THUMB }
|
|
if ($existing) { Write-Host "Cert already in CurrentUser\My."; return }
|
|
$pfxBytes = [Convert]::FromBase64String($env:PFX_B64)
|
|
$tmp = Join-Path $env:TEMP "codesign-$([Guid]::NewGuid()).pfx"
|
|
[IO.File]::WriteAllBytes($tmp, $pfxBytes)
|
|
$pwd = ConvertTo-SecureString -String $env:PFX_PWD -Force -AsPlainText
|
|
Import-PfxCertificate -FilePath $tmp -CertStoreLocation Cert:\CurrentUser\My -Password $pwd | Out-Null
|
|
Remove-Item -Force $tmp
|
|
Write-Host "Cert imported into CurrentUser\My."
|
|
|
|
- name: Patch csproj to use real cert thumbprint
|
|
# VS's compile-time manifest signing reads the thumbprint from the
|
|
# csproj XML (not from /p: overrides), so we rewrite it in place to
|
|
# point at our Marcus-Law cert.
|
|
shell: powershell
|
|
env:
|
|
THUMB: ${{ secrets.CODESIGN_THUMBPRINT }}
|
|
run: |
|
|
$csproj = 'src/OutlookAddin/OutlookAddin.csproj'
|
|
$orig = '2399E9BF73820F3B1FC744BCBFA7F82D536E3256'
|
|
$content = Get-Content $csproj -Raw
|
|
$patched = $content -replace [regex]::Escape($orig), $env:THUMB
|
|
if ($patched -eq $content) { Write-Warning "Thumbprint $orig not present in csproj." }
|
|
else { Set-Content -Path $csproj -Value $patched -NoNewline; Write-Host "Patched: $orig -> $env:THUMB" }
|
|
|
|
- name: Build (restore + compile)
|
|
shell: powershell
|
|
run: |
|
|
$msbuildArgs = @(
|
|
'OutlookAddin.sln',
|
|
'/restore',
|
|
'/t:Build',
|
|
'/p:Configuration=Release',
|
|
'/p:Platform="Any CPU"',
|
|
'/m',
|
|
'/flp:logfile=build.log;verbosity=detailed',
|
|
'/flp1:logfile=build-errors.log;errorsonly',
|
|
'/flp2:logfile=build-warnings.log;warningsonly'
|
|
)
|
|
& msbuild @msbuildArgs 2>&1 | Tee-Object -FilePath build.console.log
|
|
$code = $LASTEXITCODE
|
|
Write-Host "msbuild exit code: $code"
|
|
if ($code -ne 0) { exit $code }
|
|
|
|
- name: Upload build logs
|
|
if: always()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: build-logs-run${{ github.run_id }}
|
|
path: |
|
|
build.log
|
|
build-errors.log
|
|
build-warnings.log
|
|
build.console.log
|
|
retention-days: 7
|
|
if-no-files-found: warn
|
|
|
|
- name: Test
|
|
run: dotnet test src/OutlookAddin.Tests/OutlookAddin.Tests.csproj --configuration Release --no-build --logger "trx;LogFileName=test-results.trx"
|
|
|
|
- name: Upload test results
|
|
if: always()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: test-results
|
|
path: '**/*.trx'
|
|
|
|
publish-clickonce:
|
|
needs: build
|
|
runs-on: windows-latest
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Add Office-capable MSBuild to PATH
|
|
shell: powershell
|
|
run: |
|
|
$vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
|
|
$installPath = & $vswhere -products * -requires Microsoft.VisualStudio.Workload.Office -property installationPath | Select-Object -First 1
|
|
if (-not $installPath) { throw "No VS installation with the Office workload found on this runner." }
|
|
Add-Content -Path $env:GITHUB_PATH -Value (Join-Path $installPath 'MSBuild\Current\Bin')
|
|
|
|
- name: Resolve mage.exe + signtool.exe paths
|
|
id: tools
|
|
shell: powershell
|
|
run: |
|
|
# mage.exe lives under .NET 4.8 Developer Pack. Find any installed copy.
|
|
$mage = Get-ChildItem 'C:\Program Files (x86)\Microsoft SDKs\Windows' -Recurse -Filter mage.exe -ErrorAction SilentlyContinue |
|
|
Sort-Object FullName -Descending | Select-Object -First 1
|
|
if (-not $mage) { throw "mage.exe not found" }
|
|
|
|
# signtool.exe lives under Windows SDK. Pick the highest-version x64 copy.
|
|
$signtool = Get-ChildItem 'C:\Program Files (x86)\Windows Kits\10\bin' -Recurse -Filter signtool.exe -ErrorAction SilentlyContinue |
|
|
Where-Object { $_.FullName -like '*\x64\*' } |
|
|
Sort-Object { [version](Split-Path -Leaf (Split-Path -Parent (Split-Path -Parent $_.FullName))) } -Descending |
|
|
Select-Object -First 1
|
|
if (-not $signtool) { throw "signtool.exe not found" }
|
|
|
|
Write-Host "MAGE: $($mage.FullName)"
|
|
Write-Host "SIGNTOOL: $($signtool.FullName)"
|
|
"MAGE=$($mage.FullName)" | Out-File -Append $env:GITHUB_ENV
|
|
"SIGNTOOL=$($signtool.FullName)" | Out-File -Append $env:GITHUB_ENV
|
|
|
|
- name: Compute version from tag
|
|
id: ver
|
|
shell: powershell
|
|
run: |
|
|
$tag = "${{ github.ref_name }}"
|
|
if ($tag -notmatch '^v(\d+\.\d+\.\d+)$') {
|
|
throw "Tag $tag is not in vMAJOR.MINOR.PATCH form"
|
|
}
|
|
$version = "$($Matches[1]).0"
|
|
"version=$version" | Out-File -Append $env:GITHUB_OUTPUT
|
|
"versionDot=$($Matches[1])" | Out-File -Append $env:GITHUB_OUTPUT
|
|
"versionUscore=$($version -replace '\.','_')" | Out-File -Append $env:GITHUB_OUTPUT
|
|
Write-Host "Version: $version"
|
|
|
|
- name: Ensure code-signing cert in CurrentUser\My AND LocalMachine\My
|
|
shell: powershell
|
|
env:
|
|
THUMB: ${{ secrets.CODESIGN_THUMBPRINT }}
|
|
PFX_B64: ${{ secrets.CODESIGN_CERT_PFX_BASE64 }}
|
|
PFX_PWD: ${{ secrets.CODESIGN_CERT_PASSWORD }}
|
|
run: |
|
|
$thumb = $env:THUMB
|
|
# Import to CurrentUser\My (where VSTO ResolveKeySource looks).
|
|
$inUser = Get-ChildItem Cert:\CurrentUser\My -ErrorAction SilentlyContinue |
|
|
Where-Object { $_.Thumbprint -eq $thumb }
|
|
if (-not $inUser) {
|
|
$pfxBytes = [Convert]::FromBase64String($env:PFX_B64)
|
|
$tmp = Join-Path $env:TEMP "cs-$([Guid]::NewGuid()).pfx"
|
|
[IO.File]::WriteAllBytes($tmp, $pfxBytes)
|
|
$pwd = ConvertTo-SecureString -String $env:PFX_PWD -Force -AsPlainText
|
|
Import-PfxCertificate -FilePath $tmp -CertStoreLocation Cert:\CurrentUser\My -Password $pwd | Out-Null
|
|
Remove-Item -Force $tmp
|
|
Write-Host "Imported into CurrentUser\My."
|
|
} else { Write-Host "Already in CurrentUser\My." }
|
|
|
|
$found = Get-ChildItem Cert:\LocalMachine\My -ErrorAction SilentlyContinue |
|
|
Where-Object { $_.Thumbprint -eq $thumb }
|
|
if ($found) {
|
|
Write-Host "Cert $thumb already in LocalMachine\My."
|
|
return
|
|
}
|
|
Write-Warning "Cert $thumb missing from LocalMachine\My. Importing from CODESIGN_CERT_PFX_BASE64."
|
|
$pfxBytes = [Convert]::FromBase64String($env:PFX_B64)
|
|
$tmpPfx = Join-Path $env:TEMP "codesign-$([Guid]::NewGuid()).pfx"
|
|
[IO.File]::WriteAllBytes($tmpPfx, $pfxBytes)
|
|
$securePwd = ConvertTo-SecureString -String $env:PFX_PWD -Force -AsPlainText
|
|
Import-PfxCertificate -FilePath $tmpPfx `
|
|
-CertStoreLocation Cert:\LocalMachine\My `
|
|
-Password $securePwd | Out-Null
|
|
Remove-Item -Force $tmpPfx
|
|
Write-Host "Cert imported."
|
|
|
|
- name: Patch csproj to use real cert thumbprint
|
|
shell: powershell
|
|
env:
|
|
THUMB: ${{ secrets.CODESIGN_THUMBPRINT }}
|
|
run: |
|
|
$csproj = 'src/OutlookAddin/OutlookAddin.csproj'
|
|
$orig = '2399E9BF73820F3B1FC744BCBFA7F82D536E3256'
|
|
$content = Get-Content $csproj -Raw
|
|
$patched = $content -replace [regex]::Escape($orig), $env:THUMB
|
|
if ($patched -ne $content) { Set-Content -Path $csproj -Value $patched -NoNewline; Write-Host "Patched csproj." }
|
|
else { Write-Warning "Original thumbprint not present in csproj." }
|
|
|
|
- name: Build Release (restore + compile)
|
|
run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /m
|
|
|
|
# Code signing -- cert in LocalMachine\My (or CurrentUser\My); signtool
|
|
# picks it by thumbprint, the service runs as LocalSystem so the runtime
|
|
# search reaches both stores.
|
|
- name: Sign assemblies
|
|
shell: powershell
|
|
run: |
|
|
$thumb = "${{ secrets.CODESIGN_THUMBPRINT }}"
|
|
& "$env:SIGNTOOL" sign /sha1 $thumb /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 `
|
|
src/OutlookAddin/bin/Release/MarcusLaw.OutlookAddin.dll `
|
|
src/OutlookAddin.Core/bin/Release/net48/MarcusLaw.OutlookAddin.Core.dll `
|
|
src/OutlookAddin.UI/bin/Release/net48/MarcusLaw.OutlookAddin.UI.dll `
|
|
src/OutlookAddinProtocolHandler/bin/Release/net48/OutlookAddinProtocolHandler.exe
|
|
|
|
- name: Publish ClickOnce
|
|
shell: powershell
|
|
run: |
|
|
$version = "${{ steps.ver.outputs.version }}"
|
|
$versionUscore = "${{ steps.ver.outputs.versionUscore }}"
|
|
$thumb = "${{ secrets.CODESIGN_THUMBPRINT }}"
|
|
|
|
$appBin = "src/OutlookAddin/bin/Release"
|
|
$publishDir = "publish"
|
|
$appFilesDir = "$publishDir/Application Files/OutlookAddin_$versionUscore"
|
|
|
|
New-Item -ItemType Directory -Force -Path $appFilesDir | Out-Null
|
|
Copy-Item -Recurse -Force "$appBin/*" $appFilesDir
|
|
|
|
# Application manifest (.dll.manifest)
|
|
& "$env:MAGE" -New Application `
|
|
-ToFile "$appFilesDir/MarcusLaw.OutlookAddin.dll.manifest" `
|
|
-Name "Marcus-Law OutlookAddin" `
|
|
-Version $version `
|
|
-FromDirectory $appFilesDir `
|
|
-TrustLevel FullTrust
|
|
|
|
& "$env:MAGE" -Sign "$appFilesDir/MarcusLaw.OutlookAddin.dll.manifest" `
|
|
-CertHash $thumb `
|
|
-TimeStampUri http://timestamp.digicert.com
|
|
|
|
# Deployment manifest (.vsto)
|
|
Copy-Item "$appFilesDir/MarcusLaw.OutlookAddin.dll.manifest" "$publishDir/OutlookAddin.vsto"
|
|
& "$env:MAGE" -Update "$publishDir/OutlookAddin.vsto" `
|
|
-AppManifest "$appFilesDir/MarcusLaw.OutlookAddin.dll.manifest" `
|
|
-ProviderUrl "$env:PROVIDER_URL" `
|
|
-Publisher "Marcus-Law" `
|
|
-Install true
|
|
|
|
& "$env:MAGE" -Sign "$publishDir/OutlookAddin.vsto" `
|
|
-CertHash $thumb `
|
|
-TimeStampUri http://timestamp.digicert.com
|
|
|
|
# Rename payload files to .deploy (ClickOnce convention).
|
|
Get-ChildItem -Recurse -File "$appFilesDir" |
|
|
Where-Object { $_.Extension -notin '.manifest','.deploy' } |
|
|
ForEach-Object { Rename-Item -LiteralPath $_.FullName -NewName ($_.Name + '.deploy') }
|
|
|
|
- name: Stage protocol handler
|
|
shell: powershell
|
|
run: |
|
|
$stagingDir = "publish/protocol-handler"
|
|
New-Item -ItemType Directory -Force -Path $stagingDir | Out-Null
|
|
Copy-Item -Recurse -Force "src/OutlookAddinProtocolHandler/bin/Release/net48/*" $stagingDir
|
|
Copy-Item -Force "tools/install-protocol.ps1" "$stagingDir/install-protocol.ps1"
|
|
Copy-Item -Force "tools/uninstall-protocol.ps1" "$stagingDir/uninstall-protocol.ps1"
|
|
|
|
- name: Upload publish artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: clickonce-${{ steps.ver.outputs.versionDot }}
|
|
path: publish/
|
|
|
|
dockerize-and-deploy:
|
|
needs: publish-clickonce
|
|
runs-on: ubuntu-latest
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
env:
|
|
# Set this Gitea Actions secret AFTER the outlook-addin-cdn Coolify app
|
|
# is created. If empty, the trigger step is skipped (image still builds).
|
|
COOLIFY_UUID: ${{ secrets.COOLIFY_UUID }}
|
|
steps:
|
|
- name: Checkout (Dockerfile + nginx.conf)
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Compute version from tag
|
|
id: ver
|
|
run: |
|
|
TAG="${GITHUB_REF##refs/tags/}"
|
|
if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
|
|
echo "Tag $TAG is not in vMAJOR.MINOR.PATCH form" >&2
|
|
exit 1
|
|
fi
|
|
VERSION="${TAG#v}"
|
|
echo "version=$VERSION" >> $GITHUB_OUTPUT
|
|
echo "tag=$TAG" >> $GITHUB_OUTPUT
|
|
|
|
- name: Download publish artifact
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: clickonce-${{ steps.ver.outputs.version }}
|
|
path: cdn/publish/
|
|
|
|
- name: Login to Gitea Registry
|
|
run: |
|
|
echo "${{ secrets.REGISTRY_PASSWORD }}" | \
|
|
docker login ${{ env.REGISTRY }} \
|
|
-u "${{ secrets.REGISTRY_USER }}" --password-stdin
|
|
|
|
- name: Build and push image
|
|
run: |
|
|
BASE="${{ env.REGISTRY }}/${{ env.CDN_IMAGE_NAME }}"
|
|
docker build \
|
|
-t "${BASE}:latest" \
|
|
-t "${BASE}:${{ steps.ver.outputs.tag }}" \
|
|
-t "${BASE}:build-${{ github.run_number }}" \
|
|
cdn/
|
|
docker push "${BASE}:latest"
|
|
docker push "${BASE}:${{ steps.ver.outputs.tag }}"
|
|
docker push "${BASE}:build-${{ github.run_number }}"
|
|
|
|
- name: Trigger Coolify redeploy
|
|
if: env.COOLIFY_UUID != ''
|
|
run: |
|
|
curl -sf \
|
|
"http://coolify:8080/api/v1/deploy?uuid=${{ env.COOLIFY_UUID }}&force=true" \
|
|
-H "Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}"
|
|
|
|
- name: Notify Mattermost (success)
|
|
if: success()
|
|
env:
|
|
WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK_RELEASES }}
|
|
run: |
|
|
if [ -z "$WEBHOOK" ]; then exit 0; fi
|
|
VERSION="${{ steps.ver.outputs.version }}"
|
|
curl -sf -X POST -H 'Content-Type: application/json' "$WEBHOOK" -d "$(cat <<EOF
|
|
{
|
|
"text": ":package: **OutlookAddin v$VERSION** שוחרר — https://platform.dev.marcus-law.co.il/outlook-addin/OutlookAddin.vsto",
|
|
"channel": "git-verelasim"
|
|
}
|
|
EOF
|
|
)"
|
|
|
|
- name: Notify Mattermost (failure)
|
|
if: failure()
|
|
env:
|
|
WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK_RELEASES }}
|
|
run: |
|
|
if [ -z "$WEBHOOK" ]; then exit 0; fi
|
|
curl -sf -X POST -H 'Content-Type: application/json' "$WEBHOOK" -d "$(cat <<EOF
|
|
{
|
|
"text": ":warning: OutlookAddin publish ל-${{ github.ref_name }} נכשל — ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
|
|
"channel": "git-verelasim"
|
|
}
|
|
EOF
|
|
)"
|