fix: Github actions failed because of signing WIN package not configured

2026-09-02 11:13:11 +02:00 · 2026-08-31 20:56:40 +02:00
parent 2c879e4ebc
commit cb774383b1
2 changed files with 103 additions and 31 deletions
@@ -0,0 +1,97 @@
+name: "Release KétaPK"
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+jobs:
+  build-tauri:
+    permissions:
+      contents: write
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: 'windows-latest'
+            os: 'windows'
+          - platform: 'macos-latest'
+            os: 'macos'
+          - platform: 'ubuntu-22.04'
+            os: 'linux'
+
+    runs-on: ${{ matrix.platform }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          cache: 'npm'
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      # Linux dependancies
+      - name: Install Linux dependencies
+        if: matrix.os == 'linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libwebkit2gtk-4.1-dev build-essential curl wget file libxdo-dev libssl-dev libayatana-appindicator3-dev librsvg2-dev
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      # ------------------------------------------------------------------------
+      # BUILD TAURI (non-signed version)
+      # ------------------------------------------------------------------------
+      - name: Build Tauri App
+        uses: tauri-apps/tauri-action@v0
+        id: tauri
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          tagName: v__VERSION__
+          releaseName: 'KétaPK v__VERSION__'
+          releaseBody: 'Rapport de release automatique KétaPK.'
+          releaseDraft: true
+          prerelease: false
+
+      # ------------------------------------------------------------------------
+      # WINDOWS : SIGNPATH.IO signing
+      # ------------------------------------------------------------------------
+      - name: Upload Unsigned Windows Artifact to GitHub
+        if: matrix.os == 'windows'
+        id: upload-unsigned
+        uses: actions/upload-artifact@v4
+        with:
+          name: unsigned-ketapk-windows
+          path: src-tauri/target/release/bundle/msi/*.msi
+
+      - name: Submit Signing Request to SignPath
+        if: matrix.os == 'windows'
+        uses: signpath/github-action-submit-signing-request@v2
+        with:
+          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
+          organization-id: '${{ secrets.SIGNPATH_ORGANIZATION_ID }}'
+          project-slug: 'ketapk'
+          signing-policy-slug: 'release-signing'
+          github-artifact-id: '${{ steps.upload-unsigned.outputs.artifact-id }}'
+          wait-for-completion: true
+          output-artifact-directory: 'signed-windows-installer'
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+
+      # Non-signed asset replacement by signed assed on Github release
+      - name: Upload Signed Windows MSI to Release
+        if: matrix.os == 'windows'
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ steps.tauri.outputs.releaseTagName }}
+          files: signed-windows-installer/*.msi
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -64,34 +64,9 @@ jobs:

      # ------------------------------------------------------------------------
      # WINDOWS : SIGNPATH.IO signing
-      # ------------------------------------------------------------------------
-      - name: Upload Unsigned Windows Artifact to GitHub
-        if: matrix.os == 'windows'
-        id: upload-unsigned
-        uses: actions/upload-artifact@v4
-        with:
-          name: unsigned-ketapk-windows
-          path: src-tauri/target/release/bundle/msi/*.msi
-
-      - name: Submit Signing Request to SignPath
-        if: matrix.os == 'windows'
-        uses: signpath/github-action-submit-signing-request@v2
-        with:
-          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
-          organization-id: '${{ secrets.SIGNPATH_ORGANIZATION_ID }}'
-          project-slug: 'ketapk'
-          signing-policy-slug: 'release-signing'
-          github-artifact-id: '${{ steps.upload-unsigned.outputs.artifact-id }}'
-          wait-for-completion: true
-          output-artifact-directory: 'signed-windows-installer'
-          github-token: '${{ secrets.GITHUB_TOKEN }}'
-
-      # Non-signed asset replacement by signed assed on Github release
-      - name: Upload Signed Windows MSI to Release
-        if: matrix.os == 'windows'
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: ${{ steps.tauri.outputs.releaseTagName }}
-          files: signed-windows-installer/*.msi
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # Disabled until SIGNPATH_API_TOKEN / SIGNPATH_ORGANIZATION_ID secrets are
+      # configured. The full signing flow is preserved in
+      # .github/release.yml.signpath-backup — restore it from there once the
+      # SignPath key is available. Until then, tauri-action above already
+      # uploads the unsigned MSI to the draft release directly.
+      # ------------------------------------------------------------------------