Files
security-game/.gitea/workflows/build.yml
T
zwitschi b4d189c325
Full build / Import + headless tests (push) Successful in 36s
Full build / Full desktop build + optional release (push) Successful in 3m37s
Publish releases with the runner's checkout credentials
The v0.2.10 tag build still failed to publish: its env dump showed no token at all,
because this Gitea/act runner does not provide `github.token`, and the repo has no
GITEA_TOKEN secret.

publish_release.sh now resolves credentials in order: GITEA_TOKEN,
GITEA_AUTH_HEADER, ~/.git-credentials, then the local git extraheader that
actions/checkout writes for the job. That header carries the runner's basic-auth
credentials for the same server, so tag builds publish with no repo secret.

Verified by adding the extraheader locally and publishing v0.2.10 (all five
artifacts: Linux/Windows/macOS ports, NSIS installer, AppImage), then removing it.

Docs: RELEASING describes the four credential sources and warns that github.token is
not available here; MEMORY records both failed attempts and the final fix; TODO keeps
the "verify on the next tag" follow-up. Version 0.2.11.
2026-10-31 21:30:24 +01:00

124 lines
4.7 KiB
YAML

name: Full build
on:
push:
branches: [main]
tags: ["v*"]
pull_request:
workflow_dispatch:
jobs:
checks:
name: Import + headless tests
runs-on: ubuntu-latest
env:
# The container runs as root; silence the recurring engine notice.
GODOT_SILENCE_ROOT_WARNING: "1"
steps:
- uses: actions/checkout@v4
- name: Install Godot 4.3
run: |
curl -sL -o /tmp/godot.zip \
https://github.com/godotengine/godot/releases/download/4.3-stable/Godot_v4.3-stable_linux.x86_64.zip
unzip -qo /tmp/godot.zip -d /tmp/godot-bin
sudo install /tmp/godot-bin/Godot_v4.3-stable_linux.x86_64 /usr/local/bin/godot
- name: Import project (build class cache)
run: godot --headless --import
- name: Run headless test suite
shell: bash
run: |
set +e
output=$(godot --headless --path . --script res://src/test/test_runner.gd 2>&1)
status=$?
echo "$output"
echo "exit=$status"
if [ "$status" -ne 0 ]; then
echo "::error::Tests failed"
exit 1
fi
if echo "$output" | grep -q "SCRIPT ERROR"; then
echo "::error::Script errors detected"
exit 1
fi
build:
name: Full desktop build + optional release
# Tags and manual dispatches produce installable binaries. Branch pushes and
# pull requests only run the cheap checks job (export templates are ~1 GB).
if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
runs-on: ubuntu-latest
needs: checks
env:
GODOT_SILENCE_ROOT_WARNING: "1"
steps:
- uses: actions/checkout@v4
- name: Install Godot 4.3 and export templates
run: |
curl -sL -o /tmp/godot.zip \
https://github.com/godotengine/godot/releases/download/4.3-stable/Godot_v4.3-stable_linux.x86_64.zip
unzip -qo /tmp/godot.zip -d /tmp/godot-bin
sudo install /tmp/godot-bin/Godot_v4.3-stable_linux.x86_64 /usr/local/bin/godot
curl -sL -o /tmp/templates.tpz \
https://github.com/godotengine/godot/releases/download/4.3-stable/Godot_v4.3-stable_export_templates.tpz
mkdir -p ~/.local/share/godot/export_templates/4.3.stable
cd /tmp && rm -rf tpl && mkdir tpl && unzip -qo templates.tpz -d tpl
cp tpl/templates/* "$HOME/.local/share/godot/export_templates/4.3.stable/" 2>/dev/null || true
ls "$HOME/.local/share/godot/export_templates/4.3.stable" | head -5
- name: Import project
run: godot --headless --import
- name: Export Linux, Windows, macOS
run: |
chmod +x tools/*.sh
./tools/build_releases.sh
- name: Package Windows installer (NSIS)
run: |
sudo apt-get update && sudo apt-get install -y nsis p7zip-full
VERSION="$(sed -n 's/.*config\/version="\([^"]*\)".*/\1/p' project.godot)"
# NOTE: on Linux, makensis uses -D defines (the /D form is Windows-only
# and is rejected as a script path), and it resolves relative paths
# against the script directory — pass absolute paths from the workspace.
cp assets/textures/icon.ico packaging/windows/step-line.ico
makensis \
-DVERSION="$VERSION" \
-DARTIFACT="$PWD/build/step-line-windows-$VERSION.exe" \
-DICON="$PWD/packaging/windows/step-line.ico" \
-DOUT="$PWD/build/step-line-setup-$VERSION.exe" \
packaging/windows/step-line.nsi
- name: Verify Windows installer contents
run: |
VERSION="$(sed -n 's/.*config\/version="\([^"]*\)".*/\1/p' project.godot)"
ls -la build/step-line-setup-$VERSION.exe
7z l build/step-line-setup-$VERSION.exe | grep -E "step-line.exe|uninstall.exe"
- name: Package Linux AppImage
run: |
bash packaging/linux/build_appimage.sh
- name: Upload installers (workflow_dispatch)
if: github.event_name == 'workflow_dispatch'
uses: actions/upload-artifact@v4
with:
name: step-line-build
path: build/*
if-no-files-found: error
- name: Publish Gitea release (tags only)
if: startsWith(github.ref, 'refs/tags/')
env:
# An explicit repo secret wins. Without one, publish_release.sh reuses
# the local git extraheader that actions/checkout configures for the job
# (the runner's own credentials), so tag builds still publish.
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
VERSION: ${{ github.ref_name }}
run: |
chmod +x tools/publish_release.sh
./tools/publish_release.sh "${VERSION#v}"