Skip to content

Update release notes and code signature timestamping URL-s #1397

Update release notes and code signature timestamping URL-s

Update release notes and code signature timestamping URL-s #1397

Workflow file for this run

name: CI
on: [push, pull_request]
permissions:
contents: read
env:
BUILD_NUMBER: ${{ github.run_number }}
CMAKE_BUILD_PARALLEL_LEVEL: 4
UBUNTU_DEPS: cmake libxml2-dev libxmlsec1-dev zlib1g-dev
jobs:
macos:
name: Build on macOS for ${{ matrix.target }}
runs-on: macos-latest
strategy:
matrix:
target: [macos, iphoneos, iphonesimulator, androidarm, androidarm64, androidx86_64]
steps:
- name: Checkout
uses: actions/checkout@v4
with:
submodules: recursive
- name: Install dependencies
run: |
brew update
brew install --formula ninja swig doxygen boost
brew unlink [email protected] || true
brew unlink [email protected] || true
brew unlink xz
- name: Cache
uses: actions/cache@v4
id: cache
with:
path: cache
key: ${{ matrix.target }}-${{ hashFiles('prepare_osx_build_environment.sh') }}
- name: Build openssl
if: steps.cache.outputs.cache-hit != 'true'
run: ./prepare_osx_build_environment.sh openssl ${{ matrix.target }}
- name: Build libxml2
if: steps.cache.outputs.cache-hit != 'true'
run: ./prepare_osx_build_environment.sh libxml2 ${{ matrix.target }}
- name: Build xmlsec
if: steps.cache.outputs.cache-hit != 'true'
run: ./prepare_osx_build_environment.sh xmlsec ${{ matrix.target }}
- name: Move to cache
if: steps.cache.outputs.cache-hit != 'true'
run: |
mkdir cache
sudo mv /Library/libdigidocpp* cache
- name: Setup cache
run: sudo ln -s $PWD/cache/* /Library/
- name: Build macOS
if: matrix.target == 'macos'
run: |
cmake --preset ${{ matrix.target }} -DCMAKE_BUILD_TYPE=RelWithDebInfo
cmake --build --preset ${{ matrix.target }}
cmake --build --preset ${{ matrix.target }} --target test pkcs11sign zipdebug embedlibs pkgbuild
- name: Build ${{ matrix.target }}
if: matrix.target != 'macos'
run: |
cmake --preset ${{ matrix.target }} -DCMAKE_BUILD_TYPE=RelWithDebInfo
cmake --build --preset ${{ matrix.target }}
sudo cmake --build --preset ${{ matrix.target }} --target install/strip
cd /Library
zip -q -r ${OLDPWD}/libdigidocpp.${{ matrix.target }}.zip libdigidocpp.*
- name: Archive artifacts
if: matrix.target == 'macos'
uses: actions/upload-artifact@v4
with:
name: macOS
path: build/macos/libdigidocpp*.*
- name: Archive artifacts
if: matrix.target != 'macos'
uses: actions/upload-artifact@v4
with:
name: ${{ matrix.target }}
path: libdigidocpp*.zip
fedora:
name: Build on Fedora ${{ matrix.container }}
runs-on: ubuntu-latest
container: fedora:${{ matrix.container }}
strategy:
matrix:
container: [39, 40]
steps:
- name: Install Deps
run: |
dnf install -y --setopt=install_weak_deps=False \
git gcc-c++ cmake rpm-build libxml2-devel xmlsec1-openssl-devel libtool-ltdl-devel zlib-devel doxygen boost-test swig python3-devel java-17-openjdk-devel minizip-devel
- name: Install CMake
if: matrix.container == 39
run: |
dnf install -y --setopt=install_weak_deps=False wget
wget -q https://github.com/Kitware/CMake/releases/download/v3.28.1/cmake-3.28.1-linux-x86_64.sh
sh cmake-3.28.1-linux-x86_64.sh --skip-license --prefix=/usr/local
- name: Checkout
uses: actions/checkout@v4
with:
submodules: recursive
- name: Build
run: |
cmake -DCMAKE_INSTALL_SYSCONFDIR=/etc -B build -S .
cmake --build build
cmake --build build --target package
- name: Archive artifacts
uses: actions/upload-artifact@v4
with:
name: fedora_${{ matrix.container }}
path: build/libdigidocpp*.rpm
ubuntu:
name: Build on Ubuntu ${{ matrix.container }}
runs-on: ubuntu-latest
container: ubuntu:${{ matrix.container }}
strategy:
matrix:
container: ['20.04', '22.04', '24.04']
env:
DEBIAN_FRONTEND: noninteractive
DEBFULLNAME: github-actions
DEBEMAIL: [email protected]
steps:
- name: Install dependencies
run: apt update -qq && apt install --no-install-recommends -y git lsb-release build-essential devscripts debhelper lintian pkg-config ${UBUNTU_DEPS} doxygen swig openjdk-11-jdk-headless libpython3-dev python3-setuptools libboost-test-dev
- name: Checkout
uses: actions/checkout@v4
with:
submodules: recursive
- name: Setup changelog
run: |
export VERSION=$(grep project CMakeLists.txt | egrep -o "([0-9]{1,}\.)+[0-9]{1,}")
export VERSIONEX=${VERSION}.${BUILD_NUMBER}.$(lsb_release -rs)
dch --distribution $(lsb_release -cs) -v ${VERSIONEX} "Release ${VERSIONEX}."
- name: Build packages
run: |
dpkg-buildpackage -us -uc
mv ../libdigidocpp*.* .
- name: Lintian
run: lintian *.deb;
- name: Archive artifacts
uses: actions/upload-artifact@v4
with:
name: ubuntu_${{ matrix.container }}
path: libdigidocpp*.*
windows:
name: Build on Windows
runs-on: ${{ matrix.image }}
strategy:
matrix:
toolset: [143, 142]
platform: [x86, x64]
include:
- toolset: 143
image: windows-2022
vcvars: "C:\\Program Files\\Microsoft Visual Studio\\2022\\Enterprise\\VC\\Auxiliary\\Build\\vcvarsall.bat"
- toolset: 142
image: windows-2019
vcvars: "C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Enterprise\\VC\\Auxiliary\\Build\\vcvarsall.bat"
env:
VER_SUFFIX: .VS${{ matrix.toolset }}
CXXFLAGS: '/D_DISABLE_CONSTEXPR_MUTEX_CONSTRUCTOR' # https://github.com/actions/runner-images/issues/10004
VCPKG_INSTALLED_DIR: ${{ github.workspace }}/vcpkg_installed
steps:
- name: Checkout
uses: actions/checkout@v4
with:
submodules: recursive
- name: Prepare vcpkg
uses: lukka/run-vcpkg@v11
with:
vcpkgGitCommitId: 0f8b6ddf49fa8ae66a7826234e9ba3fda5f46d3c
vcpkgJsonGlob: ./vcpkg.json
runVcpkgInstall: true
runVcpkgFormatString: "[`install`, `--recurse`, `--clean-after-build`, `--x-install-root`, `$[env.VCPKG_INSTALLED_DIR]`, `--triplet`, `$[env.VCPKG_DEFAULT_TRIPLET]`, `--x-feature`, `tests`]"
env:
VCPKG_DEFAULT_TRIPLET: ${{ matrix.platform }}-windows
- name: Install dependencies
run: choco install doxygen.install -y > $null
- uses: actions/setup-python@v5
if: matrix.platform == 'x86'
with:
python-version: 3.12
architecture: x86
- name: Install WiX
run: |
dotnet tool install -g wix --version 5.0.1
wix extension -g add WixToolset.UI.wixext/5.0.1
- name: Build
run: |
& .\build.ps1 `
-vcpkg_installed ${{ env.VCPKG_INSTALLED_DIR }} `
-vcvars "${{ matrix.vcvars }}" `
-platform ${{ matrix.platform }} `
-swig C:/ProgramData/chocolatey/bin/swig.exe `
-doxygen "C:/Program files/doxygen/bin/doxygen.exe" `
-boost
- name: Archive artifacts
uses: actions/upload-artifact@v4
with:
name: msi_${{ matrix.toolset }}_${{ matrix.platform }}
path: ./*.msi
pages:
name: Deploy pages
if: github.repository == 'open-eid/libdigidocpp' && contains(github.ref, 'master')
runs-on: ubuntu-22.04
permissions:
contents: write
steps:
- name: Checkout
uses: actions/checkout@v4
with:
submodules: recursive
- name: Install dependencies
run: sudo apt update -qq && sudo apt install --no-install-recommends -y doxygen ${UBUNTU_DEPS}
- name: Build docs
run: |
cmake -B build -S .
cmake --build build --target docs
- name: Deploy
uses: peaceiris/actions-gh-pages@v4
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
publish_dir: ./build/doc
force_orphan: true
coverity:
name: Run Coverity tests
if: github.repository == 'open-eid/libdigidocpp' && contains(github.ref, 'coverity_scan')
runs-on: ubuntu-22.04
env:
TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
PROJECTNAME: ${{ github.repository }}
steps:
- name: Checkout
uses: actions/checkout@v4
with:
submodules: recursive
- name: Install dependencies
run: sudo apt update -qq && sudo apt install --no-install-recommends -y curl ca-certificates ${UBUNTU_DEPS}
- name: Download Coverity Build Tool
run: |
curl --silent --data "token=$TOKEN&project=$PROJECTNAME" -o cov-analysis-linux64.tar.gz https://scan.coverity.com/download/cxx/linux64
mkdir cov-analysis-linux64
tar xzf cov-analysis-linux64.tar.gz --strip 1 -C cov-analysis-linux64
- name: Build
run: |
cmake .
export PATH=$PWD/cov-analysis-linux64/bin:$PATH
cov-build --dir cov-int cmake --build .
- name: Submit the result to Coverity Scan
run: |
tar czvf upload.tgz cov-int
curl --silent \
--form project=$PROJECTNAME \
--form token=$TOKEN \
--form [email protected] \
--form [email protected] \
--form version=master \
--form description="Github Actions CI build" \
https://scan.coverity.com/builds?project=$PROJECTNAME
codeql:
name: Run CodeQL tests
if: github.repository == 'open-eid/libdigidocpp'
runs-on: ubuntu-22.04
permissions:
security-events: write
steps:
- name: Checkout
uses: actions/checkout@v4
with:
submodules: recursive
- name: Install dependencies
run: sudo apt update -qq && sudo apt install --no-install-recommends -y ${UBUNTU_DEPS}
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: cpp
queries: +security-and-quality
- name: Build
run: |
cmake -B build -S . \
-DCMAKE_DISABLE_FIND_PACKAGE_SWIG=YES \
-DCMAKE_DISABLE_FIND_PACKAGE_Boost=YES \
-DCMAKE_DISABLE_FIND_PACKAGE_Doxygen=YES \
-DBUILD_TOOLS=NO
cmake --build build
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
with:
upload: False
output: sarif-results
- name: Filter results
uses: advanced-security/filter-sarif@develop
with:
patterns: |
-src/json.hpp
-src/minizip/*
-**:cpp/poorly-documented-function
-**:cpp/loop-variable-changed
input: sarif-results/cpp.sarif
output: sarif-results/cpp.sarif
- name: Upload results
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: sarif-results/cpp.sarif