mirror of
https://github.com/unpoller/unpoller.git
synced 2026-09-30 19:41:16 +02:00
David Newhall IIandCursor
eeda665b7e
Release tags now fail closed without signing secrets, ship a signed Windows PE via house signerd, and replace per-arch Darwin tarballs with one stapled universal archive. Co-authored-by: Cursor <cursoragent@cursor.com>
37 lines
778 B
Bash
Executable File
37 lines
778 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Fail closed when a publishing secret is empty. GitHub maps missing secrets
|
|
# to "" so `if: secrets.FOO != ''` is not a substitute.
|
|
set -euo pipefail
|
|
|
|
missing=0
|
|
need() {
|
|
local name=$1
|
|
local val=${!name-}
|
|
if [ -z "${val}" ]; then
|
|
echo "missing secret: ${name}" >&2
|
|
missing=1
|
|
fi
|
|
}
|
|
|
|
need GORELEASER_KEY
|
|
need GPG_SIGNING_KEY
|
|
need DOCKER_USERNAME
|
|
need DOCKER_PASSWORD
|
|
need CODESIGN_URL
|
|
need CODESIGN_CLIENT_CERT
|
|
need CODESIGN_CLIENT_KEY
|
|
need MACOS_SIGN_P12
|
|
need MACOS_SIGN_PASSWORD
|
|
need MACOS_NOTARY_KEY
|
|
need MACOS_NOTARY_KEY_ID
|
|
need MACOS_NOTARY_ISSUER_ID
|
|
need PACKAGECLOUD_TOKEN
|
|
need HOMEBREW_TAP_GITHUB_TOKEN
|
|
|
|
if [ "${missing}" -ne 0 ]; then
|
|
echo "refusing to publish with empty secrets" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "required secrets are present"
|