mirror of
https://github.com/Darkrock-Studios/hammer-editor.git
synced 2026-08-05 23:59:46 +00:00
5a08059c94
- Grant contents: write to the publish-fdroid-tag caller job so the reusable workflow's git push tag actually has the token scope it needs (reusable workflows can't elevate beyond the caller). - Add a track input to publish-google-play (internal/alpha/beta/ production), default internal for manual dispatch so a stray workflow_dispatch click can't ship develop straight to Production. publish-release.yml explicitly passes track: production. - Pass release_tag through env vars in publish-snap and publish-fdroid-tag instead of interpolating into shell, closing the workflow_dispatch command-injection vector. - Validate fdroid release_tag matches semver before letting it near git tag / git push.
32 lines
882 B
YAML
32 lines
882 B
YAML
name: Publish — Snap Store
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
release_tag:
|
|
description: "Release tag to download hammer.snap from (e.g. v1.2.3)"
|
|
type: string
|
|
required: true
|
|
workflow_call:
|
|
inputs:
|
|
release_tag:
|
|
type: string
|
|
required: true
|
|
|
|
jobs:
|
|
publish-snap:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Download Snap from Release
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
RELEASE_TAG: ${{ inputs.release_tag }}
|
|
run: |
|
|
gh release download "$RELEASE_TAG" -p 'hammer.snap' -R "$GITHUB_REPOSITORY"
|
|
|
|
- name: Upload to Snap Store
|
|
uses: snapcore/action-publish@214b86e5ca036ead1668c79afb81e550e6c54d40 # v1.2.0
|
|
env:
|
|
SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_TOKEN }}
|
|
with:
|
|
snap: hammer.snap
|
|
release: stable
|