413 lines
20 KiB
YAML
413 lines
20 KiB
YAML
name: Build and deploy OutlookAddin
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags: ['v*']
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
env:
|
|
REGISTRY: gitea.dev.marcus-law.co.il
|
|
CDN_IMAGE_NAME: espocrm-extensions/outlook-addin-cdn
|
|
PROVIDER_URL: 'https://platform.dev.marcus-law.co.il/outlook-addin/OutlookAddin.vsto'
|
|
# Force NuGet to install + resolve packages outside C:\Windows\System32\.
|
|
# NuGet's UserProfile lookup uses SHGetKnownFolderPath which ignores our
|
|
# USERPROFILE override and returns the LocalSystem profile when the runner
|
|
# service runs as LocalSystem. 32-bit MSBuild then hits Win32 File System
|
|
# Redirector and "loses" packages -> NETSDK1064. NUGET_PACKAGES short-
|
|
# circuits the lookup and keeps everything outside system32.
|
|
NUGET_PACKAGES: 'C:\actions-home\.nuget\packages'
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: windows-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Add Office-capable MSBuild to PATH
|
|
shell: powershell
|
|
run: |
|
|
# microsoft/setup-msbuild@v2 picks `vswhere -latest`, which prefers
|
|
# Build Tools 2022. Build Tools has no VSTO targets (MSB4226), so
|
|
# locate a VS installation that explicitly has the Office workload
|
|
# (the one that ships Microsoft.VisualStudio.Tools.Office.targets).
|
|
$vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
|
|
$installPath = & $vswhere -products * -requires Microsoft.VisualStudio.Workload.Office -property installationPath | Select-Object -First 1
|
|
if (-not $installPath) { throw "No VS installation with the Office workload found on this runner." }
|
|
$msbuildDir = Join-Path $installPath 'MSBuild\Current\Bin'
|
|
Write-Host "Using MSBuild from $msbuildDir"
|
|
Add-Content -Path $env:GITHUB_PATH -Value $msbuildDir
|
|
|
|
- name: Prepare + Build (single-step with full transcript)
|
|
shell: powershell
|
|
env:
|
|
PFX_B64: ${{ secrets.CODESIGN_CERT_PFX_BASE64 }}
|
|
PFX_PWD: ${{ secrets.CODESIGN_CERT_PASSWORD }}
|
|
THUMB: ${{ secrets.CODESIGN_THUMBPRINT }}
|
|
run: |
|
|
$ErrorActionPreference = 'Continue'
|
|
Start-Transcript -Path build.console.log -IncludeInvocationHeader -Force
|
|
|
|
try {
|
|
# --- 1. Cert into CurrentUser\My (VSTO target needs it there) ---
|
|
Write-Host "=== STEP 1: Import cert into CurrentUser\My ==="
|
|
$existing = Get-ChildItem Cert:\CurrentUser\My -ErrorAction SilentlyContinue |
|
|
Where-Object { $_.Thumbprint -eq $env:THUMB }
|
|
if ($existing) {
|
|
Write-Host "Cert $env:THUMB already in CurrentUser\My."
|
|
} else {
|
|
$pfxBytes = [Convert]::FromBase64String($env:PFX_B64)
|
|
$tmp = Join-Path $env:TEMP "codesign-$([Guid]::NewGuid()).pfx"
|
|
[IO.File]::WriteAllBytes($tmp, $pfxBytes)
|
|
$pwd = ConvertTo-SecureString -String $env:PFX_PWD -Force -AsPlainText
|
|
Import-PfxCertificate -FilePath $tmp -CertStoreLocation Cert:\CurrentUser\My -Password $pwd -ErrorAction Stop | Out-Null
|
|
Remove-Item -Force $tmp
|
|
Write-Host "Imported into CurrentUser\My."
|
|
}
|
|
|
|
# Verify what's in the store now
|
|
Write-Host "Certs in CurrentUser\My:"
|
|
Get-ChildItem Cert:\CurrentUser\My | ForEach-Object {
|
|
Write-Host " $($_.Thumbprint) $($_.Subject)"
|
|
}
|
|
|
|
# --- 2. Patch csproj ---
|
|
Write-Host "=== STEP 2: Patch csproj ==="
|
|
$csproj = 'src/OutlookAddin/OutlookAddin.csproj'
|
|
$orig = '2399E9BF73820F3B1FC744BCBFA7F82D536E3256'
|
|
$content = Get-Content $csproj -Raw
|
|
if ($content -match [regex]::Escape($orig)) {
|
|
$patched = $content -replace [regex]::Escape($orig), $env:THUMB
|
|
Set-Content -Path $csproj -Value $patched -NoNewline
|
|
Write-Host "Patched csproj: $orig -> $env:THUMB"
|
|
} else {
|
|
Write-Host "Thumbprint $orig already replaced (or not present)."
|
|
}
|
|
# Verify
|
|
Write-Host "Resulting ManifestCertificateThumbprint:"
|
|
(Get-Content $csproj | Select-String 'ManifestCertificateThumbprint') -join "`n" | Write-Host
|
|
|
|
# --- 3. Build ---
|
|
Write-Host "=== STEP 3: msbuild /restore /t:Build ==="
|
|
$msbuildArgs = @(
|
|
'OutlookAddin.sln',
|
|
'/restore',
|
|
'/t:Build',
|
|
'/p:Configuration=Release',
|
|
'/p:Platform="Any CPU"',
|
|
'/m',
|
|
'/flp:logfile=build.log;verbosity=detailed',
|
|
'/flp1:logfile=build-errors.log;errorsonly'
|
|
)
|
|
& msbuild @msbuildArgs
|
|
$code = $LASTEXITCODE
|
|
Write-Host "msbuild exit code: $code"
|
|
} catch {
|
|
Write-Host "FATAL: $($_.Exception.Message)"
|
|
Write-Host $_.ScriptStackTrace
|
|
$code = 1
|
|
} finally {
|
|
Stop-Transcript
|
|
}
|
|
if ($code -ne 0) { exit $code }
|
|
|
|
- name: Push build logs to Gitea generic package registry
|
|
if: always()
|
|
shell: powershell
|
|
env:
|
|
REG_USER: ${{ secrets.REGISTRY_USER }}
|
|
REG_PASS: ${{ secrets.REGISTRY_PASSWORD }}
|
|
RUN_ID: ${{ github.run_id }}
|
|
run: |
|
|
$logs = @(
|
|
@{ name = 'build.console.log'; path = 'build.console.log' },
|
|
@{ name = 'build.log'; path = 'build.log' },
|
|
@{ name = 'build-errors.log'; path = 'build-errors.log' },
|
|
@{ name = 'OutlookAddin.csproj'; path = 'src/OutlookAddin/OutlookAddin.csproj' }
|
|
)
|
|
$base = "https://gitea.dev.marcus-law.co.il/api/packages/espocrm-extensions/generic/outlook-addin-build-log/run-$env:RUN_ID"
|
|
$pair = "$($env:REG_USER):$($env:REG_PASS)"
|
|
$auth = "Basic " + [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes($pair))
|
|
foreach ($entry in $logs) {
|
|
if (Test-Path $entry.path) {
|
|
Write-Host "Uploading $($entry.name)..."
|
|
try {
|
|
$resp = Invoke-WebRequest -Method Put `
|
|
-Uri "$base/$($entry.name)" `
|
|
-Headers @{ Authorization = $auth } `
|
|
-InFile $entry.path `
|
|
-ContentType 'text/plain' `
|
|
-UseBasicParsing `
|
|
-ErrorAction Stop
|
|
Write-Host " HTTP $($resp.StatusCode)"
|
|
} catch {
|
|
Write-Host " upload failed: $($_.Exception.Message)"
|
|
}
|
|
} else {
|
|
Write-Host "Skip $($entry.path) (not found)"
|
|
}
|
|
}
|
|
|
|
# Tests temporarily disabled -- actions/upload-artifact@v4 fails on this
|
|
# self-hosted runner. Add back once the artifact action is fixed or once
|
|
# we move test reporting to a different mechanism.
|
|
|
|
publish-clickonce:
|
|
needs: build
|
|
runs-on: windows-latest
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Publish ClickOnce (single step with transcript)
|
|
shell: powershell
|
|
env:
|
|
THUMB: ${{ secrets.CODESIGN_THUMBPRINT }}
|
|
PFX_B64: ${{ secrets.CODESIGN_CERT_PFX_BASE64 }}
|
|
PFX_PWD: ${{ secrets.CODESIGN_CERT_PASSWORD }}
|
|
run: |
|
|
$ErrorActionPreference = 'Continue'
|
|
Start-Transcript -Path publish.console.log -IncludeInvocationHeader -Force
|
|
$code = 0
|
|
try {
|
|
$thumb = $env:THUMB
|
|
|
|
Write-Host "=== STEP 0a: locate Office-capable MSBuild ==="
|
|
$vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
|
|
$vsInstall = & $vswhere -products * -requires Microsoft.VisualStudio.Workload.Office -property installationPath | Select-Object -First 1
|
|
if (-not $vsInstall) { throw "No VS installation with the Office workload found." }
|
|
$msbuildBin = Join-Path $vsInstall 'MSBuild\Current\Bin'
|
|
$env:PATH = "$msbuildBin;$env:PATH"
|
|
Write-Host " MSBuild: $msbuildBin"
|
|
|
|
Write-Host "=== STEP 0: resolve mage.exe + signtool.exe ==="
|
|
$mage = Get-ChildItem 'C:\Program Files (x86)\Microsoft SDKs\Windows' -Recurse -Filter mage.exe -ErrorAction SilentlyContinue |
|
|
Sort-Object FullName -Descending | Select-Object -First 1
|
|
if (-not $mage) { throw "mage.exe not found" }
|
|
$env:MAGE = $mage.FullName
|
|
Write-Host " MAGE: $($env:MAGE)"
|
|
$signtool = Get-ChildItem 'C:\Program Files (x86)\Windows Kits\10\bin' -Recurse -Filter signtool.exe -ErrorAction SilentlyContinue |
|
|
Where-Object { $_.FullName -like '*\x64\*' } |
|
|
Sort-Object { [version](Split-Path -Leaf (Split-Path -Parent (Split-Path -Parent $_.FullName))) } -Descending |
|
|
Select-Object -First 1
|
|
if (-not $signtool) { throw "signtool.exe not found" }
|
|
$env:SIGNTOOL = $signtool.FullName
|
|
Write-Host " SIGNTOOL: $($env:SIGNTOOL)"
|
|
|
|
Write-Host "=== STEP A: cert into stores ==="
|
|
$inUser = Get-ChildItem Cert:\CurrentUser\My -EA SilentlyContinue | ? { $_.Thumbprint -eq $thumb }
|
|
if (-not $inUser) {
|
|
$b = [Convert]::FromBase64String($env:PFX_B64); $t = Join-Path $env:TEMP "u.pfx"
|
|
[IO.File]::WriteAllBytes($t, $b)
|
|
$p = ConvertTo-SecureString $env:PFX_PWD -Force -AsPlainText
|
|
Import-PfxCertificate -FilePath $t -CertStoreLocation Cert:\CurrentUser\My -Password $p | Out-Null
|
|
Remove-Item -Force $t
|
|
}
|
|
Write-Host " CurrentUser\My ok"
|
|
$inMach = Get-ChildItem Cert:\LocalMachine\My -EA SilentlyContinue | ? { $_.Thumbprint -eq $thumb }
|
|
if (-not $inMach) {
|
|
$b = [Convert]::FromBase64String($env:PFX_B64); $t = Join-Path $env:TEMP "m.pfx"
|
|
[IO.File]::WriteAllBytes($t, $b)
|
|
$p = ConvertTo-SecureString $env:PFX_PWD -Force -AsPlainText
|
|
Import-PfxCertificate -FilePath $t -CertStoreLocation Cert:\LocalMachine\My -Password $p | Out-Null
|
|
Remove-Item -Force $t
|
|
}
|
|
Write-Host " LocalMachine\My ok"
|
|
|
|
Write-Host "=== STEP B: patch csproj ==="
|
|
$csproj = 'src/OutlookAddin/OutlookAddin.csproj'
|
|
$cnt = Get-Content $csproj -Raw
|
|
$new = $cnt -replace [regex]::Escape('2399E9BF73820F3B1FC744BCBFA7F82D536E3256'), $thumb
|
|
if ($new -ne $cnt) { Set-Content $csproj -Value $new -NoNewline; Write-Host "patched" }
|
|
else { Write-Host "already patched" }
|
|
|
|
Write-Host "=== STEP C: msbuild /t:Publish (VSTO ClickOnce publish target) ==="
|
|
# Resolve version inline -- act_runner doesn't propagate steps.outputs
|
|
# between steps reliably, so don't depend on the "Compute version" step.
|
|
$tag = "${{ github.ref_name }}"
|
|
if ($tag -notmatch '^v(\d+\.\d+\.\d+)$') {
|
|
throw "Tag '$tag' is not in vMAJOR.MINOR.PATCH form"
|
|
}
|
|
$version = "$($Matches[1]).0"
|
|
$versionDot = $Matches[1]
|
|
$versionUscore = $version -replace '\.','_'
|
|
Write-Host " version=$version versionUscore=$versionUscore"
|
|
|
|
# /t:Publish is the standard VSTO publish target: it builds, signs
|
|
# assemblies, generates and signs the manifests, copies everything
|
|
# into the PublishDir, and renames payload files to .deploy.
|
|
$publishDir = (Resolve-Path .).Path + "\publish\"
|
|
$msbuildArgs = @(
|
|
'OutlookAddin.sln',
|
|
'/restore',
|
|
'/t:Publish',
|
|
'/p:Configuration=Release',
|
|
'/p:Platform="Any CPU"',
|
|
('/p:PublishDir={0}' -f $publishDir),
|
|
'/p:InstallUrl=https://platform.dev.marcus-law.co.il/outlook-addin/',
|
|
'/p:UpdateUrl=https://platform.dev.marcus-law.co.il/outlook-addin/',
|
|
('/p:ApplicationVersion={0}' -f $version),
|
|
('/p:MinimumRequiredVersion={0}' -f $version),
|
|
'/m',
|
|
'/flp:logfile=publish-msbuild.log;verbosity=detailed'
|
|
)
|
|
Write-Host " msbuild $($msbuildArgs -join ' ')"
|
|
& msbuild @msbuildArgs
|
|
if ($LASTEXITCODE -ne 0) { throw "msbuild /t:Publish failed with $LASTEXITCODE" }
|
|
|
|
# Sanity check: did the VSTO publish target produce a .vsto file?
|
|
$vsto = Get-ChildItem -Recurse -Filter '*.vsto' -Path publish | Select-Object -First 1
|
|
if (-not $vsto) { throw "msbuild /t:Publish completed but no .vsto file found under publish/" }
|
|
Write-Host " produced $($vsto.FullName)"
|
|
|
|
# Rename to canonical OutlookAddin.vsto so the ClickOnce manifest
|
|
# URL matches PROVIDER_URL (which is hardcoded to .../OutlookAddin.vsto).
|
|
if ($vsto.Name -ne 'OutlookAddin.vsto') {
|
|
Rename-Item -LiteralPath $vsto.FullName -NewName 'OutlookAddin.vsto'
|
|
}
|
|
|
|
Write-Host "=== STEP F: stage protocol handler ==="
|
|
$stagingDir = "publish/protocol-handler"
|
|
New-Item -ItemType Directory -Force -Path $stagingDir | Out-Null
|
|
Copy-Item -Recurse -Force "src/OutlookAddinProtocolHandler/bin/Release/net48/*" $stagingDir
|
|
Copy-Item -Force "tools/install-protocol.ps1" "$stagingDir/install-protocol.ps1"
|
|
Copy-Item -Force "tools/uninstall-protocol.ps1" "$stagingDir/uninstall-protocol.ps1"
|
|
|
|
Write-Host "=== publish-clickonce single step done; pack happens in Upload step ==="
|
|
} catch {
|
|
Write-Host "FATAL: $($_.Exception.Message)"
|
|
Write-Host $_.ScriptStackTrace
|
|
$code = 1
|
|
} finally {
|
|
try { Stop-Transcript -ErrorAction SilentlyContinue } catch {}
|
|
}
|
|
# Persist exit code to a side-channel file so we can inspect even if
|
|
# the transcript got closed before the value was written.
|
|
"code=$code at $(Get-Date)" | Out-File -FilePath publish-finish.log -Encoding ASCII
|
|
# Force explicit exit -- ignore any trailing $LASTEXITCODE noise from
|
|
# native commands above.
|
|
if ($code -ne 0) { exit $code } else { exit 0 }
|
|
|
|
- name: Pack + upload publish.tar.gz
|
|
if: success()
|
|
shell: powershell
|
|
env:
|
|
REG_USER: ${{ secrets.REGISTRY_USER }}
|
|
REG_PASS: ${{ secrets.REGISTRY_PASSWORD }}
|
|
run: |
|
|
$tag = "${{ github.ref_name }}"
|
|
if ($tag -notmatch '^v(\d+\.\d+\.\d+)$') { throw "tag $tag not in vMAJOR.MINOR.PATCH" }
|
|
$versionDot = $Matches[1]
|
|
|
|
& tar -czf publish.tar.gz publish
|
|
if ($LASTEXITCODE -ne 0) { throw "tar failed with $LASTEXITCODE" }
|
|
|
|
$pair = "$($env:REG_USER):$($env:REG_PASS)"
|
|
$auth = "Basic " + [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes($pair))
|
|
$uri = "https://gitea.dev.marcus-law.co.il/api/packages/espocrm-extensions/generic/outlook-addin-publish/$versionDot/publish.tar.gz"
|
|
Invoke-WebRequest -Method Put -Uri $uri -Headers @{ Authorization = $auth } -InFile publish.tar.gz -ContentType 'application/gzip' -UseBasicParsing | Out-Null
|
|
Write-Host "Uploaded $((Get-Item publish.tar.gz).Length) bytes to $uri"
|
|
|
|
- name: Push publish logs to generic package
|
|
if: always()
|
|
shell: powershell
|
|
env:
|
|
REG_USER: ${{ secrets.REGISTRY_USER }}
|
|
REG_PASS: ${{ secrets.REGISTRY_PASSWORD }}
|
|
RUN_ID: ${{ github.run_id }}
|
|
run: |
|
|
$pair = "$($env:REG_USER):$($env:REG_PASS)"
|
|
$auth = "Basic " + [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes($pair))
|
|
$base = "https://gitea.dev.marcus-law.co.il/api/packages/espocrm-extensions/generic/outlook-addin-publish-log/run-$env:RUN_ID"
|
|
foreach ($f in @('publish.console.log','publish-msbuild.log','publish-finish.log','src/OutlookAddin/OutlookAddin.csproj')) {
|
|
if (Test-Path $f) {
|
|
$name = (Split-Path $f -Leaf)
|
|
Write-Host "PUT $base/$name"
|
|
try { Invoke-WebRequest -Method Put -Uri "$base/$name" -Headers @{ Authorization = $auth } -InFile $f -ContentType 'text/plain' -UseBasicParsing | Out-Null } catch { Write-Host " failed: $($_.Exception.Message)" }
|
|
}
|
|
}
|
|
|
|
dockerize-and-deploy:
|
|
needs: publish-clickonce
|
|
runs-on: ubuntu-latest
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
env:
|
|
# Set this Gitea Actions secret AFTER the outlook-addin-cdn Coolify app
|
|
# is created. If empty, the trigger step is skipped (image still builds).
|
|
COOLIFY_UUID: ${{ secrets.COOLIFY_UUID }}
|
|
steps:
|
|
- name: Checkout (Dockerfile + nginx.conf)
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Download publish artifact + build + push image
|
|
env:
|
|
REG_USER: ${{ secrets.REGISTRY_USER }}
|
|
REG_PASS: ${{ secrets.REGISTRY_PASSWORD }}
|
|
run: |
|
|
set -e
|
|
# act_runner does not propagate steps.outputs between steps, so parse
|
|
# the tag inline.
|
|
TAG="${GITHUB_REF##refs/tags/}"
|
|
if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
|
|
echo "Tag $TAG is not in vMAJOR.MINOR.PATCH form" >&2
|
|
exit 1
|
|
fi
|
|
VERSION="${TAG#v}"
|
|
|
|
URL="https://gitea.dev.marcus-law.co.il/api/packages/espocrm-extensions/generic/outlook-addin-publish/${VERSION}/publish.tar.gz"
|
|
curl -sfL -u "$REG_USER:$REG_PASS" "$URL" -o publish.tar.gz
|
|
mkdir -p cdn
|
|
tar -xzf publish.tar.gz -C cdn
|
|
ls -la cdn/publish/
|
|
|
|
echo "$REG_PASS" | docker login ${{ env.REGISTRY }} -u "$REG_USER" --password-stdin
|
|
BASE="${{ env.REGISTRY }}/${{ env.CDN_IMAGE_NAME }}"
|
|
docker build \
|
|
-t "${BASE}:latest" \
|
|
-t "${BASE}:${TAG}" \
|
|
-t "${BASE}:build-${{ github.run_number }}" \
|
|
cdn/
|
|
docker push "${BASE}:latest"
|
|
docker push "${BASE}:${TAG}"
|
|
docker push "${BASE}:build-${{ github.run_number }}"
|
|
|
|
- name: Trigger Coolify redeploy
|
|
if: env.COOLIFY_UUID != ''
|
|
run: |
|
|
curl -sf \
|
|
"http://coolify:8080/api/v1/deploy?uuid=${{ env.COOLIFY_UUID }}&force=true" \
|
|
-H "Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}"
|
|
|
|
- name: Notify Mattermost (success)
|
|
if: success()
|
|
env:
|
|
WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK_RELEASES }}
|
|
run: |
|
|
if [ -z "$WEBHOOK" ]; then exit 0; fi
|
|
TAG="${GITHUB_REF##refs/tags/}"
|
|
VERSION="${TAG#v}"
|
|
curl -sf -X POST -H 'Content-Type: application/json' "$WEBHOOK" -d "$(cat <<EOF
|
|
{
|
|
"text": ":package: **OutlookAddin v$VERSION** שוחרר — https://platform.dev.marcus-law.co.il/outlook-addin/OutlookAddin.vsto",
|
|
"channel": "git-verelasim"
|
|
}
|
|
EOF
|
|
)"
|
|
|
|
- name: Notify Mattermost (failure)
|
|
if: failure()
|
|
env:
|
|
WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK_RELEASES }}
|
|
run: |
|
|
if [ -z "$WEBHOOK" ]; then exit 0; fi
|
|
curl -sf -X POST -H 'Content-Type: application/json' "$WEBHOOK" -d "$(cat <<EOF
|
|
{
|
|
"text": ":warning: OutlookAddin publish ל-${{ github.ref_name }} נכשל — ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
|
|
"channel": "git-verelasim"
|
|
}
|
|
EOF
|
|
)"
|