Configure/.github/workflows/release.yml at main · ImageMagick/Configure · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
on:
  workflow_dispatch:
  push:
    branches:
    - main
    paths:
    - .github/workflows/release.yml
    tags:
    - '*'

name: Release

permissions:
  contents: read

jobs:
  build:
    name: Build (${{matrix.architecture}})
    runs-on: windows-2025-vs2026

    strategy:
      fail-fast: false
      matrix:
        architecture: [ x86, x64, arm64 ]

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false

      - name: Build configure
        shell: cmd
        run: |
          call "C:\Program Files\Microsoft Visual Studio\18\Enterprise\Common7\Tools\VsDevCmd.bat"
          msbuild Configure.sln /m /t:Rebuild /p:Configuration=Release,Platform=${{matrix.architecture}}

      - name: Upload executable
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 #v7.0.2
        with:
          name: Configure.Release.${{matrix.architecture}}
          path: Artifacts/Release/${{matrix.architecture}}/bin

  release:
    name: Release
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
    environment: release
    runs-on: windows-2025-vs2026
    needs: build

    permissions:
      attestations: write
      id-token: write

    env:
      VERSION: ${{github.ref_name}}

    steps:
      - name: Create GitHub app token
        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 #v3.3.0
        id: app-token
        with:
          client-id: ${{vars.APP_CLIENT_ID}}
          private-key: ${{secrets.APP_PRIVATE_KEY}}
          permission-contents: write

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false

      - name: Download executables
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 #v8.0.2
        with:
          path: ${{github.workspace}}/Artifacts
          merge-multiple: true

      - name: Sign executables and libraries
        uses: ImageMagick/code-signing-action@11c51f7659405bee4dd3529748e1501a0d388911 #v1.0.1
        with:
          client-id: ${{secrets.AZURE_CLIENT_ID}}
          tenant-id: ${{secrets.AZURE_TENANT_ID}}
          subscription-id: ${{secrets.AZURE_SUBSCRIPTION_ID}}
          directory: ${{github.workspace}}\Artifacts
          files: '*.exe *.dll'

      - name: Create Configs archive
        shell: cmd
        run: |
          powershell -Command "Compress-Archive -Path 'ColorProfiles','Configs','Installer','OpenCL','PerlMagick','Tools' -DestinationPath 'files.zip'"

      - name: Generate SLSA provenance
        id: attest
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 #v4.2.2
        with:
          subject-path: |
            ${{github.workspace}}/Artifacts/Configure.*.exe
            ${{github.workspace}}/files.zip

      - name: Save provenance as multiple.intoto.jsonl
        shell: bash
        run: |
          cp "${{steps.attest.outputs.bundle-path}}" "${{github.workspace}}/multiple.intoto.jsonl"

      - name: Publish release
        shell: cmd
        env:
          GH_TOKEN: ${{steps.app-token.outputs.token}}
        run: |
          gh release create "%VERSION%" ^
            --verify-tag ^
            --title "%VERSION%" ^
            --notes "%VERSION%" ^
            ${{github.workspace}}\Artifacts\Configure.Release.x64.exe ^
            ${{github.workspace}}\Artifacts\Configure.Release.arm64.exe ^
            ${{github.workspace}}\Artifacts\Configure.Release.x86.exe ^
            ${{github.workspace}}\files.zip ^
            ${{github.workspace}}\multiple.intoto.jsonl