|
| 1 | +name: ci |
| 2 | + |
| 3 | +on: |
| 4 | + push: |
| 5 | + branches: [main] |
| 6 | + pull_request: |
| 7 | + branches: [main] |
| 8 | + workflow_dispatch: |
| 9 | + |
| 10 | +permissions: |
| 11 | + contents: read |
| 12 | + |
| 13 | +concurrency: |
| 14 | + group: ci-${{ github.ref }} |
| 15 | + cancel-in-progress: false |
| 16 | + |
| 17 | +jobs: |
| 18 | + lint: |
| 19 | + name: lint + format + audit |
| 20 | + runs-on: ubuntu-latest |
| 21 | + steps: |
| 22 | + - uses: actions/checkout@v6 |
| 23 | + |
| 24 | + - name: lint |
| 25 | + run: bash tools/lint-bat.sh WinMasterBlocker.bat |
| 26 | + |
| 27 | + - name: format-check |
| 28 | + run: bash tools/format-check.sh WinMasterBlocker.bat |
| 29 | + |
| 30 | + - name: audit-coverage |
| 31 | + run: bash tools/audit-coverage.sh WinMasterBlocker.bat |
| 32 | + |
| 33 | + integration: |
| 34 | + name: WHATIF integration on Windows |
| 35 | + runs-on: windows-latest |
| 36 | + steps: |
| 37 | + - uses: actions/checkout@v6 |
| 38 | + |
| 39 | + - name: stage fake vendor tree |
| 40 | + shell: pwsh |
| 41 | + run: | |
| 42 | + $root = Join-Path $env:RUNNER_TEMP 'wmb-fake' |
| 43 | + New-Item -ItemType Directory -Force -Path $root | Out-Null |
| 44 | +
|
| 45 | + $adobe = Join-Path $root 'Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1' |
| 46 | + New-Item -ItemType Directory -Force -Path $adobe | Out-Null |
| 47 | + New-Item -ItemType File -Force -Path (Join-Path $adobe 'acrocef.exe') | Out-Null |
| 48 | +
|
| 49 | + $rdr = Join-Path $root 'Program Files\Adobe\Reader DC\Reader' |
| 50 | + New-Item -ItemType Directory -Force -Path $rdr | Out-Null |
| 51 | + New-Item -ItemType File -Force -Path (Join-Path $rdr 'RdrCEF.exe') | Out-Null |
| 52 | +
|
| 53 | + New-Item -ItemType Directory -Force -Path (Join-Path $root 'Program Files (x86)\Adobe') | Out-Null |
| 54 | + New-Item -ItemType Directory -Force -Path (Join-Path $root 'Common Files\Adobe') | Out-Null |
| 55 | + New-Item -ItemType Directory -Force -Path (Join-Path $root 'Common Files (x86)\Adobe') | Out-Null |
| 56 | + New-Item -ItemType Directory -Force -Path (Join-Path $root 'ProgramData\Adobe') | Out-Null |
| 57 | + New-Item -ItemType Directory -Force -Path (Join-Path $root 'AppData\Local\Adobe') | Out-Null |
| 58 | + New-Item -ItemType Directory -Force -Path (Join-Path $root 'AppData\Roaming\Adobe') | Out-Null |
| 59 | +
|
| 60 | + "FAKE_ROOT=$root" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8 |
| 61 | +
|
| 62 | + - name: run script in WHATIF mode |
| 63 | + shell: cmd |
| 64 | + env: |
| 65 | + WHATIF: "1" |
| 66 | + WMB_VENDOR: "Adobe" |
| 67 | + WMB_QUIET: "1" |
| 68 | + # WMB_TEST_ROOT redirects every path lookup to the fake tree we |
| 69 | + # staged above. Cleaner than trying to override %ProgramFiles% |
| 70 | + # from the workflow: GitHub Actions Windows runners ignore |
| 71 | + # workflow-level overrides for well-known Windows system vars. |
| 72 | + WMB_TEST_ROOT: ${{ runner.temp }}\wmb-fake |
| 73 | + run: | |
| 74 | + echo 0& WinMasterBlocker.bat |
| 75 | +
|
| 76 | + - name: assert rules emitted in transcript |
| 77 | + shell: pwsh |
| 78 | + run: | |
| 79 | + $log = Get-ChildItem $env:TEMP -Filter 'WinMasterBlocker-*.log' | Sort-Object LastWriteTime -Descending | Select-Object -First 1 |
| 80 | + if (-not $log) { Write-Error 'no transcript log produced'; exit 1 } |
| 81 | + Write-Host "transcript: $($log.FullName)" |
| 82 | + $body = Get-Content $log.FullName -Raw |
| 83 | + Write-Host "----- transcript -----" |
| 84 | + Write-Host $body |
| 85 | + Write-Host "----- /transcript -----" |
| 86 | + # Tightened: require an actual rule emission, not just a path walk. |
| 87 | + if ($body -notmatch 'add ".*acrocef.*Adobe-block"') { Write-Error 'transcript missing acrocef rule emission'; exit 1 } |
| 88 | + if ($body -notmatch 'add ".*RdrCEF.*Adobe-block"') { Write-Error 'transcript missing RdrCEF rule emission'; exit 1 } |
| 89 | + if ($body -notmatch 'WHATIF') { Write-Error 'transcript missing WHATIF marker'; exit 1 } |
| 90 | + Write-Host 'integration ok' |
| 91 | +
|
| 92 | + release: |
| 93 | + name: GitHub Release on version bump |
| 94 | + needs: [lint, integration] |
| 95 | + if: github.event_name == 'push' && github.ref == 'refs/heads/main' |
| 96 | + runs-on: ubuntu-latest |
| 97 | + permissions: |
| 98 | + contents: write |
| 99 | + steps: |
| 100 | + - uses: actions/checkout@v6 |
| 101 | + with: |
| 102 | + fetch-depth: 0 |
| 103 | + |
| 104 | + - name: Extract WMB_VERSION |
| 105 | + id: ver |
| 106 | + run: | |
| 107 | + V=$(grep -oE 'WMB_VERSION=[0-9]+\.[0-9]+\.[0-9]+' WinMasterBlocker.bat | head -1 | cut -d= -f2) |
| 108 | + if [ -z "$V" ]; then |
| 109 | + echo "::error::WMB_VERSION not found in WinMasterBlocker.bat" |
| 110 | + exit 1 |
| 111 | + fi |
| 112 | + echo "version=$V" >> "$GITHUB_OUTPUT" |
| 113 | + echo "tag=v$V" >> "$GITHUB_OUTPUT" |
| 114 | + echo "Script version: $V" |
| 115 | +
|
| 116 | + - name: Skip if release already exists |
| 117 | + id: check |
| 118 | + env: |
| 119 | + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 120 | + run: | |
| 121 | + if gh release view "${{ steps.ver.outputs.tag }}" >/dev/null 2>&1; then |
| 122 | + echo "exists=true" >> "$GITHUB_OUTPUT" |
| 123 | + echo "Release ${{ steps.ver.outputs.tag }} already exists, skipping." |
| 124 | + else |
| 125 | + echo "exists=false" >> "$GITHUB_OUTPUT" |
| 126 | + fi |
| 127 | +
|
| 128 | + - name: Verify CITATION.cff version matches |
| 129 | + if: steps.check.outputs.exists == 'false' |
| 130 | + run: | |
| 131 | + CFF=$(grep -oE '^version: "?[0-9]+\.[0-9]+\.[0-9]+"?' CITATION.cff | head -1 | awk '{print $2}' | tr -d '"') |
| 132 | + if [ "$CFF" != "${{ steps.ver.outputs.version }}" ]; then |
| 133 | + echo "::error::CITATION.cff version ($CFF) does not match WMB_VERSION (${{ steps.ver.outputs.version }})" |
| 134 | + exit 1 |
| 135 | + fi |
| 136 | +
|
| 137 | + - name: SHA-256 checksums |
| 138 | + if: steps.check.outputs.exists == 'false' |
| 139 | + run: | |
| 140 | + sha256sum WinMasterBlocker.bat LICENSE CITATION.cff > SHA256SUMS.txt |
| 141 | + cat SHA256SUMS.txt |
| 142 | +
|
| 143 | + - name: Release notes since previous tag |
| 144 | + if: steps.check.outputs.exists == 'false' |
| 145 | + env: |
| 146 | + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 147 | + run: | |
| 148 | + PREV=$(gh release list --limit 1 --json tagName -q '.[0].tagName' 2>/dev/null || true) |
| 149 | + { |
| 150 | + echo "## Changes since ${PREV:-initial}" |
| 151 | + echo |
| 152 | + if [ -n "$PREV" ]; then |
| 153 | + git log --pretty='* %s (%h)' "${PREV}..HEAD" |
| 154 | + else |
| 155 | + git log --pretty='* %s (%h)' |
| 156 | + fi |
| 157 | + } > RELEASE_NOTES.md |
| 158 | + cat RELEASE_NOTES.md |
| 159 | +
|
| 160 | + - name: Publish release |
| 161 | + if: steps.check.outputs.exists == 'false' |
| 162 | + uses: softprops/action-gh-release@v3 |
| 163 | + with: |
| 164 | + tag_name: ${{ steps.ver.outputs.tag }} |
| 165 | + name: WinMasterBlocker ${{ steps.ver.outputs.tag }} |
| 166 | + body_path: RELEASE_NOTES.md |
| 167 | + files: | |
| 168 | + WinMasterBlocker.bat |
| 169 | + LICENSE |
| 170 | + CITATION.cff |
| 171 | + SHA256SUMS.txt |
| 172 | + fail_on_unmatched_files: true |
| 173 | + make_latest: true |
0 commit comments