Build AppControl Manager MSIX Package #54
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build AppControl Manager MSIX Package | |
| on: | |
| workflow_dispatch: # Only the repository's owner can initiate this workflow | |
| # Prevent the workflow from running more than once per change | |
| concurrency: | |
| group: ${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build: | |
| runs-on: windows-2025 | |
| # Create outputs for this job where only other job that use "needs" keyword can use them. This job itself cannot access them. | |
| outputs: | |
| DRAFT_RELEASE_ID: ${{ steps.find_draft_release.outputs.DRAFT_RELEASE_ID }} | |
| DRAFT_RELEASE_TAG: ${{ steps.find_draft_release.outputs.DRAFT_RELEASE_TAG }} | |
| MSIX_PATH: ${{ steps.main_buildOp.outputs.MSIX_PATH }} | |
| MSIX_NAME: ${{ steps.main_buildOp.outputs.MSIX_NAME }} | |
| PACKAGE_VERSION: ${{ steps.main_buildOp.outputs.PACKAGE_VERSION }} | |
| MSIXBundle_PATH: ${{ steps.main_buildOp.outputs.MSIXBundle_PATH }} | |
| MSIXBundle_NAME: ${{ steps.main_buildOp.outputs.MSIXBundle_NAME }} | |
| X64MSBuildLog_PATH: ${{ steps.main_buildOp.outputs.X64MSBuildLog_PATH }} | |
| ARM64MSBuildLog_PATH: ${{ steps.main_buildOp.outputs.ARM64MSBuildLog_PATH }} | |
| X64Symbol_PATH: ${{ steps.main_buildOp.outputs.X64Symbol_PATH }} | |
| X64Symbol_NAME: ${{ steps.main_buildOp.outputs.X64Symbol_NAME }} | |
| ARM64Symbol_PATH: ${{ steps.main_buildOp.outputs.ARM64Symbol_PATH }} | |
| ARM64Symbol_NAME: ${{ steps.main_buildOp.outputs.ARM64Symbol_NAME }} | |
| permissions: | |
| contents: write # Required for adding files to the GitHub draft release | |
| steps: | |
| # Builds the AppControl Manager application securely with 0 usage of 3rd party tools, workflows and such. | |
| - name: Installing the necessary programs | |
| run: | | |
| winget source update | |
| Write-Host -Object "`nInstalling .NET SDK" -ForegroundColor Magenta | |
| $null = winget install --id Microsoft.DotNet.SDK.9 --exact --accept-package-agreements --accept-source-agreements --uninstall-previous --force --source winget | |
| if ($LASTEXITCODE -ne 0) { throw [System.InvalidOperationException]::New('Failed to install .NET SDK') } | |
| Write-Host -Object "`nInstalling Visual Studio Build Tools" -ForegroundColor Magenta | |
| $null = winget install --id Microsoft.VisualStudio.2022.BuildTools --exact --accept-package-agreements --accept-source-agreements --uninstall-previous --force --source winget --override '--force --wait --passive --add Microsoft.VisualStudio.Workload.ManagedDesktop --add Microsoft.VisualStudio.Workload.VCTools --add Microsoft.VisualStudio.Workload.MSBuildTools --add Microsoft.VisualStudio.Workload.UniversalBuildTools --add Microsoft.VisualStudio.ComponentGroup.WindowsAppSDK.Cs --add Microsoft.VisualStudio.Component.VC.Tools.x86.x64 --add Microsoft.VisualStudio.Component.VC.v141.x86.x64 --add Microsoft.VisualStudio.Component.Windows11SDK.26100 --includeRecommended --add Microsoft.VisualStudio.Component.VC.Tools.ARM64 --add Microsoft.VisualStudio.Component.UWP.VC.ARM64' | |
| if ($LASTEXITCODE -ne 0) { throw [System.InvalidOperationException]::New('Failed to install Visual Studio Build Tools') } | |
| Write-Host -Object "`nInstalling Visual C++ Redistributable" -ForegroundColor Magenta | |
| $null = winget install --id Microsoft.VCRedist.2015+.x64 --exact --accept-package-agreements --accept-source-agreements --uninstall-previous --force --source winget | |
| - name: Check out the repository code | |
| uses: actions/checkout@v4 | |
| - name: Building And Packaging the AppControl Manager | |
| id: main_buildOp | |
| shell: pwsh | |
| working-directory: './AppControl Manager' # Setting up working directory to ensure dotnet build will see the global.json file in the "AppControl Manager" sub-directory | |
| run: | | |
| $global:ErrorActionPreference = 'Stop' | |
| [System.String]$AppControlManagerDirectory = $PWD.Path | |
| Write-Host -Object "`nChecking .NET info`n`n" -ForegroundColor Magenta | |
| dotnet --info | |
| Write-Host -Object "`nListing installed .NET SDKs`n`n" -ForegroundColor Magenta | |
| dotnet --list-sdks | |
| Function Find-mspdbcmf { | |
| # "-products *" is necessary to detect BuildTools too | |
| [string]$VisualStudioPath = . 'C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe' -prerelease -latest -property resolvedInstallationPath -products * | |
| [string]$BasePath = [System.IO.Path]::Combine($VisualStudioPath, 'VC', 'Tools', 'MSVC') | |
| # Get all subdirectories under the base path | |
| [System.String[]]$VersionDirs = [System.IO.Directory]::GetDirectories($BasePath) | |
| # Initialize the highest version with a minimal version value. | |
| [System.Version]$HighestVersion = [System.Version]::New('0.0.0.0') | |
| [System.String]$HighestVersionFolder = $null | |
| # Loop through each directory to find the highest version folder. | |
| foreach ($Dir in $VersionDirs) { | |
| # Extract the folder name | |
| [System.String]$FolderName = [System.IO.Path]::GetFileName($Dir) | |
| [System.Version]$CurrentVersion = $null | |
| # Try parsing the folder name as a Version. | |
| if ([System.Version]::TryParse($FolderName, [ref] $CurrentVersion)) { | |
| # Compare versions | |
| if ($CurrentVersion.CompareTo($HighestVersion) -gt 0) { | |
| $HighestVersion = $CurrentVersion | |
| $HighestVersionFolder = $FolderName | |
| } | |
| } | |
| } | |
| # If no valid version folder is found | |
| if (!$HighestVersionFolder) { | |
| throw [System.IO.DirectoryNotFoundException]::New("No valid version directories found in $BasePath") | |
| } | |
| # Combine the base path, the highest version folder, the architecture folder, and the file name. | |
| [System.String]$mspdbcmfPath = [System.IO.Path]::Combine($BasePath, $HighestVersionFolder, 'bin', 'Hostx64', 'x64', 'mspdbcmf.exe') | |
| if (![System.IO.File]::Exists($mspdbcmfPath)) { | |
| throw [System.IO.FileNotFoundException]::New("mspdbcmf.exe not found at $mspdbcmfPath") | |
| } | |
| return $mspdbcmfPath | |
| } | |
| [string]$mspdbcmfPath = Find-mspdbcmf | |
| # https://github.com/Microsoft/vswhere/wiki/Start-Developer-Command-Prompt#using-powershell | |
| $installationPath = . 'C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe' -prerelease -latest -property installationPath | |
| if ($installationPath -and (Test-Path -Path "$installationPath\Common7\Tools\vsdevcmd.bat" -PathType Leaf)) { | |
| & "${env:COMSPEC}" /s /c "`"$installationPath\Common7\Tools\vsdevcmd.bat`" -no_logo && set" | ForEach-Object -Process { | |
| $name, $value = $_ -split '=', 2 | |
| Set-Content -Path env:\"$name" -Value $value -Force | |
| } | |
| } | |
| # https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-build | |
| # https://learn.microsoft.com/en-us/visualstudio/msbuild/msbuild-command-line-reference | |
| # https://learn.microsoft.com/en-us/visualstudio/msbuild/common-msbuild-project-properties | |
| # Generate for X64 architecture | |
| dotnet build 'AppControl Manager.sln' --configuration Release --verbosity minimal /p:Platform=x64 | |
| dotnet msbuild 'AppControl Manager.sln' /p:Configuration=Release /p:AppxPackageDir="MSIXOutputX64\" /p:GenerateAppxPackageOnBuild=true /p:Platform=x64 -v:minimal /p:MsPdbCmfExeFullpath=$mspdbcmfPath -bl:X64MSBuildLog.binlog | |
| # Generate for ARM64 architecture | |
| dotnet build 'AppControl Manager.sln' --configuration Release --verbosity minimal /p:Platform=ARM64 | |
| dotnet msbuild 'AppControl Manager.sln' /p:Configuration=Release /p:AppxPackageDir="MSIXOutputARM64\" /p:GenerateAppxPackageOnBuild=true /p:Platform=ARM64 -v:minimal /p:MsPdbCmfExeFullpath=$mspdbcmfPath -bl:ARM64MSBuildLog.binlog | |
| Function Get-MSIXFile { | |
| Param( | |
| [System.String]$BasePath, | |
| [System.String]$FolderPattern, | |
| [System.String]$FileNamePattern, | |
| [System.String]$ErrorMessageFolder, | |
| [System.String]$ErrorMessageFile | |
| ) | |
| # Get all subdirectories in the base path matching the folder pattern | |
| [System.String[]]$Folders = [System.IO.Directory]::GetDirectories($BasePath) | |
| [System.String]$DetectedFolder = $null | |
| foreach ($Folder in $Folders) { | |
| if ([System.Text.RegularExpressions.Regex]::IsMatch($Folder, $FolderPattern)) { | |
| $DetectedFolder = $Folder | |
| break | |
| } | |
| } | |
| if (!$DetectedFolder) { | |
| Throw [System.InvalidOperationException]::New($ErrorMessageFolder) | |
| } | |
| # Get the full path of the first file matching the file name pattern inside the found folder | |
| [System.String[]]$Files = [System.IO.Directory]::GetFiles($DetectedFolder) | |
| [System.String]$DetectedFile = $null | |
| foreach ($File in $Files) { | |
| if ([System.Text.RegularExpressions.Regex]::IsMatch($File, $FileNamePattern)) { | |
| $DetectedFile = $File | |
| break | |
| } | |
| } | |
| if (!$DetectedFile) { | |
| Throw [System.InvalidOperationException]::New($ErrorMessageFile) | |
| } | |
| return $DetectedFile | |
| } | |
| #region Finding X64 outputs | |
| [System.String]$FinalMSIXX64Path = Get-MSIXFile -BasePath ([System.IO.Path]::Combine($PWD.Path, 'MSIXOutputX64')) -FolderPattern 'AppControl Manager_\d+\.\d+\.\d+\.\d+_Test' -FileNamePattern 'AppControl Manager_\d+\.\d+\.\d+\.\d+_x64\.msix' -ErrorMessageFolder 'Could not find the directory for X64 MSIX file' -ErrorMessageFile 'Could not find the X64 MSIX file' | |
| [System.String]$FinalMSIXX64Name = [System.IO.Path]::GetFileName($FinalMSIXX64Path) | |
| [System.String]$FinalMSIXX64SymbolPath = Get-MSIXFile -BasePath ([System.IO.Path]::Combine($PWD.Path, 'MSIXOutputX64')) -FolderPattern 'AppControl Manager_\d+\.\d+\.\d+\.\d+_Test' -FileNamePattern 'AppControl Manager_\d+\.\d+\.\d+\.\d+_x64\.msixsym' -ErrorMessageFolder 'Could not find the directory for X64 symbol file' -ErrorMessageFile 'Could not find the X64 symbol file' | |
| [System.String]$FinalMSIXX64SymbolName = [System.IO.Path]::GetFileName($FinalMSIXX64SymbolPath) | |
| #endregion | |
| #region Finding ARM64 outputs | |
| [System.String]$FinalMSIXARM64Path = Get-MSIXFile -BasePath ([System.IO.Path]::Combine($PWD.Path, 'MSIXOutputARM64')) -FolderPattern 'AppControl Manager_\d+\.\d+\.\d+\.\d+_Test' -FileNamePattern 'AppControl Manager_\d+\.\d+\.\d+\.\d+_arm64\.msix' -ErrorMessageFolder 'Could not find the directory for ARM64 MSIX file' -ErrorMessageFile 'Could not find the ARM64 MSIX file' | |
| [System.String]$FinalMSIXARM64Name = [System.IO.Path]::GetFileName($FinalMSIXARM64Path) | |
| [System.String]$FinalMSIXARM64SymbolPath = Get-MSIXFile -BasePath ([System.IO.Path]::Combine($PWD.Path, 'MSIXOutputARM64')) -FolderPattern 'AppControl Manager_\d+\.\d+\.\d+\.\d+_Test' -FileNamePattern 'AppControl Manager_\d+\.\d+\.\d+\.\d+_arm64\.msixsym' -ErrorMessageFolder 'Could not find the directory for ARM64 symbol file' -ErrorMessageFile 'Could not find the ARM64 symbol file' | |
| [System.String]$FinalMSIXARM64SymbolName = [System.IO.Path]::GetFileName($FinalMSIXARM64SymbolPath) | |
| #endregion | |
| #region Detect and Validate File Versions | |
| [System.Text.RegularExpressions.Regex]$versionRegexX64 = [System.Text.RegularExpressions.Regex]::New('AppControl Manager_(\d+\.\d+\.\d+\.\d+)_x64\.msix') | |
| [System.Text.RegularExpressions.Regex]$versionRegexARM64 = [System.Text.RegularExpressions.Regex]::New('AppControl Manager_(\d+\.\d+\.\d+\.\d+)_arm64\.msix') | |
| [System.Text.RegularExpressions.Match]$MatchX64 = $versionRegexX64.Match($FinalMSIXX64Name) | |
| [System.Text.RegularExpressions.Match]$MatchARM64 = $versionRegexARM64.Match($FinalMSIXARM64Name) | |
| if (!$MatchX64.Success) { | |
| Throw [System.InvalidOperationException]::New('Could not detect version from X64 file name') | |
| } | |
| if (!$MatchARM64.Success) { | |
| Throw [System.InvalidOperationException]::New('Could not detect version from ARM64 file name') | |
| } | |
| [System.String]$versionX64 = $MatchX64.Groups[1].Value | |
| [System.String]$versionARM64 = $MatchARM64.Groups[1].Value | |
| if ($versionX64 -ne $versionARM64) { | |
| Throw [System.InvalidOperationException]::New('The versions in X64 and ARM64 files do not match') | |
| } | |
| # Craft the file name for the MSIX Bundle file | |
| [System.String]$FinalBundleFileName = "AppControl Manager_$versionX64.msixbundle" | |
| #endregion | |
| # Creating the directory where the MSIX packages will be copied to | |
| [System.String]$MSIXBundleOutput = [System.IO.Directory]::CreateDirectory([System.IO.Path]::Combine($AppControlManagerDirectory, 'MSIXBundleOutput')).FullName | |
| [System.IO.File]::Copy($FinalMSIXX64Path, [System.IO.Path]::Combine($MSIXBundleOutput, $FinalMSIXX64Name), $true) | |
| [System.IO.File]::Copy($FinalMSIXARM64Path, [System.IO.Path]::Combine($MSIXBundleOutput, $FinalMSIXARM64Name), $true) | |
| # The path to the final MSIX Bundle file | |
| [System.String]$MSIXBundle = [System.IO.Path]::Combine($MSIXBundleOutput, $FinalBundleFileName) | |
| Function Get-MakeAppxPath { | |
| [System.String]$BasePath = 'C:\Program Files (x86)\Windows Kits\10\bin' | |
| # Get all subdirectories under the base path | |
| [System.String[]]$VersionDirs = [System.IO.Directory]::GetDirectories($BasePath) | |
| # Initialize the highest version with a minimal version value. | |
| [System.Version]$HighestVersion = [System.Version]::New('0.0.0.0') | |
| [System.String]$HighestVersionFolder = $null | |
| # Loop through each directory to find the highest version folder. | |
| foreach ($Dir in $VersionDirs) { | |
| # Extract the folder name | |
| [System.String]$FolderName = [System.IO.Path]::GetFileName($Dir) | |
| [System.Version]$CurrentVersion = $null | |
| # Try parsing the folder name as a Version. | |
| if ([System.Version]::TryParse($FolderName, [ref] $CurrentVersion)) { | |
| # Compare versions | |
| if ($CurrentVersion.CompareTo($HighestVersion) -gt 0) { | |
| $HighestVersion = $CurrentVersion | |
| $HighestVersionFolder = $FolderName | |
| } | |
| } | |
| } | |
| # If no valid version folder is found | |
| if (!$HighestVersionFolder) { | |
| throw [System.IO.DirectoryNotFoundException]::New("No valid version directories found in $BasePath") | |
| } | |
| [string]$CPUArch = @{AMD64 = 'x64'; ARM64 = 'arm64' }[$Env:PROCESSOR_ARCHITECTURE] | |
| if ([System.String]::IsNullOrWhiteSpace($CPUArch)) { throw [System.PlatformNotSupportedException]::New('Only AMD64 and ARM64 architectures are supported.') } | |
| # Combine the base path, the highest version folder, the architecture folder, and the file name. | |
| [System.String]$MakeAppxPath = [System.IO.Path]::Combine($BasePath, $HighestVersionFolder, $CPUArch, 'makeappx.exe') | |
| return $MakeAppxPath | |
| } | |
| [System.String]$MakeAppxPath = Get-MakeAppxPath | |
| if ([System.string]::IsNullOrWhiteSpace($MakeAppxPath)) { | |
| throw [System.IO.FileNotFoundException]::New('Could not find the makeappx.exe') | |
| } | |
| # https://learn.microsoft.com/en-us/windows/win32/appxpkg/make-appx-package--makeappx-exe-#to-create-a-package-bundle-using-a-directory-structure | |
| . $MakeAppxPath bundle /d $MSIXBundleOutput /p $MSIXBundle /o /v | |
| if ($LASTEXITCODE -ne 0) { Throw [System.InvalidOperationException]::New("MakeAppx failed creating the MSIXBundle. Exit Code: $LASTEXITCODE") } | |
| #Endregion | |
| [XML]$CSProjXMLContent = Get-Content -Path '.\AppControl Manager.csproj' -Force | |
| [string]$MSIXVersion = $CSProjXMLContent.Project.PropertyGroup.FileVersion | |
| [string]$MSIXVersion = $MSIXVersion.Trim() # It would have trailing whitespaces | |
| if ([string]::IsNullOrWhiteSpace($FinalMSIXX64Path) -or [string]::IsNullOrWhiteSpace($FinalMSIXX64Name) -or [string]::IsNullOrWhiteSpace($MSIXVersion)) { throw "Necessary info could not be found" } | |
| # Write the MSIXPath, MSIXName and MSIXVersion to GITHUB_ENV to set it as an environment variable for the entire workflow | |
| Add-Content -Path ($env:GITHUB_ENV, $env:GITHUB_OUTPUT) -Value "MSIX_PATH=$FinalMSIXX64Path" | |
| Add-Content -Path ($env:GITHUB_ENV, $env:GITHUB_OUTPUT) -Value "MSIX_NAME=$FinalMSIXX64Name" | |
| Add-Content -Path ($env:GITHUB_ENV, $env:GITHUB_OUTPUT) -Value "PACKAGE_VERSION=$MSIXVersion" | |
| # Saving the details for the MSIX Bundle file | |
| Add-Content -Path ($env:GITHUB_ENV, $env:GITHUB_OUTPUT) -Value "MSIXBundle_PATH=$MSIXBundle" | |
| Add-Content -Path ($env:GITHUB_ENV, $env:GITHUB_OUTPUT) -Value "MSIXBundle_NAME=$FinalBundleFileName" | |
| # Saving the details of the log files | |
| Add-Content -Path ($env:GITHUB_ENV, $env:GITHUB_OUTPUT) -Value "X64MSBuildLog_PATH=$((Resolve-Path -Path .\X64MSBuildLog.binlog).Path)" | |
| Add-Content -Path ($env:GITHUB_ENV, $env:GITHUB_OUTPUT) -Value "ARM64MSBuildLog_PATH=$((Resolve-Path -Path .\ARM64MSBuildLog.binlog).Path)" | |
| # Saving the details of the X64 symbol file | |
| Add-Content -Path ($env:GITHUB_ENV, $env:GITHUB_OUTPUT) -Value "X64Symbol_PATH=$FinalMSIXX64SymbolPath" | |
| Add-Content -Path ($env:GITHUB_ENV, $env:GITHUB_OUTPUT) -Value "X64Symbol_NAME=$FinalMSIXX64SymbolName" | |
| # Saving the details of the ARM64 symbol file | |
| Add-Content -Path ($env:GITHUB_ENV, $env:GITHUB_OUTPUT) -Value "ARM64Symbol_PATH=$FinalMSIXARM64SymbolPath" | |
| Add-Content -Path ($env:GITHUB_ENV, $env:GITHUB_OUTPUT) -Value "ARM64Symbol_NAME=$FinalMSIXARM64SymbolName" | |
| - name: Finding the Latest Draft Release | |
| id: find_draft_release | |
| shell: pwsh | |
| run: | | |
| # Find the latest draft release via GitHub REST API | |
| $Response = Invoke-RestMethod -Uri "https://api.github.com/repos/${{ github.repository }}/releases" -Headers @{ Authorization = "token ${{ secrets.GITHUB_TOKEN }}" } | |
| $DraftRelease = $Response | Where-Object -FilterScript { $_.draft -eq $true } | Select-Object -First 1 | |
| if (!$DraftRelease) { | |
| throw "No draft release found" | |
| } | |
| # Capture the draft release ID and tag | |
| $DRAFT_RELEASE_ID = $DraftRelease.id | |
| $DRAFT_RELEASE_TAG = $DraftRelease.tag_name | |
| # Save both the release ID and tag to environment variables for later steps | |
| Add-Content -Path ($env:GITHUB_ENV, $env:GITHUB_OUTPUT) -Value "DRAFT_RELEASE_ID=$DRAFT_RELEASE_ID" | |
| Add-Content -Path ($env:GITHUB_ENV, $env:GITHUB_OUTPUT) -Value "DRAFT_RELEASE_TAG=$DRAFT_RELEASE_TAG" | |
| Write-Host -Object "GitHub Draft ID: $DRAFT_RELEASE_ID" | |
| Write-Host -Object "GitHub Draft Tag: $DRAFT_RELEASE_TAG" | |
| - name: Uploading Assets to the Draft Release | |
| shell: pwsh | |
| run: | | |
| $Assets = @( | |
| @{ Path = "${{ env.MSIX_PATH }}"; Name = "${{ env.MSIX_NAME }}" } | |
| @{ Path = "${{ env.MSIXBundle_PATH }}"; Name = "${{ env.MSIXBundle_NAME }}" } | |
| @{ Path = "${{ env.X64MSBuildLog_PATH }}"; Name = 'X64MSBuildLog.binlog' } | |
| @{ Path = "${{ env.ARM64MSBuildLog_PATH }}"; Name = 'ARM64MSBuildLog.binlog' } | |
| @{ Path = "${{ env.X64Symbol_PATH }}"; Name = "${{ env.X64Symbol_NAME }}" } | |
| @{ Path = "${{ env.ARM64Symbol_PATH }}"; Name = "${{ env.ARM64Symbol_NAME }}" } | |
| ) | |
| [string]$DraftReleaseId = $env:DRAFT_RELEASE_ID | |
| [string]$Repo = "${{ github.repository }}" | |
| [string]$AuthHeader = "token ${{ secrets.GITHUB_TOKEN }}" | |
| foreach ($Asset in $Assets) { | |
| if (-Not [string]::IsNullOrEmpty($Asset.Path)) { | |
| [string]$UploadUrl = "https://uploads.github.com/repos/$Repo/releases/$DraftReleaseId/assets?name=$($Asset.Name)" | |
| Write-Host -Object "Uploading $($Asset.Name) to draft release..." | |
| $null = Invoke-RestMethod -Uri $UploadUrl -Method Put -InFile $Asset.Path -Headers @{ | |
| 'Authorization' = $AuthHeader | |
| 'Content-Type' = 'application/octet-stream' | |
| } | |
| } | |
| } | |
| - name: Uploading Artifact 1 | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| retention-days: 1 | |
| compression-level: 0 | |
| name: ${{ env.MSIX_NAME }} | |
| path: ${{ env.MSIX_PATH }} | |
| - name: Uploading Artifact 2 | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| retention-days: 1 | |
| compression-level: 0 | |
| name: ${{ env.MSIXBundle_NAME }} | |
| path: ${{ env.MSIXBundle_PATH }} | |
| - name: Uploading Artifact 3 | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| retention-days: 1 | |
| compression-level: 0 | |
| name: X64MSBuildLog.binlog | |
| path: ${{ env.X64MSBuildLog_PATH }} | |
| - name: Uploading Artifact 4 | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| retention-days: 1 | |
| compression-level: 0 | |
| name: ARM64MSBuildLog.binlog | |
| path: ${{ env.ARM64MSBuildLog_PATH }} | |
| - name: Uploading Artifact 5 | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| retention-days: 1 | |
| compression-level: 0 | |
| name: ${{ env.X64Symbol_NAME }} | |
| path: ${{ env.X64Symbol_PATH }} | |
| - name: Uploading Artifact 6 | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| retention-days: 1 | |
| compression-level: 0 | |
| name: ${{ env.ARM64Symbol_NAME }} | |
| path: ${{ env.ARM64Symbol_PATH }} | |
| attest: | |
| needs: build | |
| runs-on: windows-2025 | |
| permissions: | |
| attestations: write | |
| id-token: write | |
| steps: | |
| - name: Downloading all Artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: Downloaded-Artifacts # Download all artifacts in this folder | |
| merge-multiple: true | |
| - name: Display structure of downloaded files | |
| run: ls -R Downloaded-Artifacts | |
| - name: Generating Artifact Attestation | |
| uses: actions/attest-build-provenance@v2 | |
| with: | |
| # subject-path: "${{ needs.build.outputs.MSIX_PATH }}, ${{ needs.build.outputs.MSIXBundle_PATH }}, ${{ needs.build.outputs.X64MSBuildLog_PATH }}, ${{ needs.build.outputs.ARM64MSBuildLog_PATH }}, ${{ needs.build.outputs.X64Symbol_PATH }}, ${{ needs.build.outputs.ARM64Symbol_PATH }}" | |
| subject-path: "Downloaded-Artifacts/*" # Use all the files in the artifact downloads folder | |
| sbom: | |
| needs: build | |
| runs-on: windows-2025 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Check out the repository code | |
| uses: actions/checkout@v4 | |
| - name: Generating SBOM | |
| uses: anchore/sbom-action@v0 | |
| with: | |
| dependency-snapshot: false # This would require more permissions than "contents: read". This action is not to be trusted with more permissions. | |
| upload-release-assets: false # Done manually in next steps | |
| upload-artifact: false # Done manually in next steps | |
| output-file: ./HardenWindowsSecurityRepoSBOM.spdx | |
| # artifact-name: HardenWindowsSecurityRepoSBOM.spdx | |
| - name: Uploading Artifact 7 | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| retention-days: 1 | |
| compression-level: 0 | |
| name: HardenWindowsSecurityRepoSBOM.spdx | |
| path: ./HardenWindowsSecurityRepoSBOM.spdx | |
| SbomAttest: | |
| needs: [build, sbom] | |
| runs-on: windows-2025 | |
| permissions: | |
| contents: read | |
| attestations: write | |
| id-token: write | |
| steps: | |
| - name: Downloading all Artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: Downloaded-Artifacts # Download all artifacts in this folder | |
| merge-multiple: true | |
| - name: Display structure of downloaded files | |
| run: ls -R Downloaded-Artifacts | |
| - name: Generating SBOM attestation | |
| uses: actions/attest-sbom@v2 | |
| with: | |
| # subject-path: "${{ needs.build.outputs.MSIX_PATH }}, ${{ needs.build.outputs.MSIXBundle_PATH }}, ${{ needs.build.outputs.X64MSBuildLog_PATH }}, ${{ needs.build.outputs.ARM64MSBuildLog_PATH }}, ${{ needs.build.outputs.X64Symbol_PATH }}, ${{ needs.build.outputs.ARM64Symbol_PATH }}" | |
| subject-path: "Downloaded-Artifacts/*" # Use all the files in the artifact downloads folder | |
| sbom-path: ./Downloaded-Artifacts/HardenWindowsSecurityRepoSBOM.spdx | |
| show-summary: true | |
| final: | |
| needs: [build, attest, sbom, SbomAttest] | |
| runs-on: windows-2025 | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| steps: | |
| - name: Check out the repository code | |
| uses: actions/checkout@v4 | |
| - name: Downloading an Artifact | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: HardenWindowsSecurityRepoSBOM.spdx | |
| path: Downloaded-Artifacts | |
| merge-multiple: true | |
| - name: Display structure of downloaded files | |
| run: ls -R Downloaded-Artifacts | |
| - name: Uploading the SBOM file to the Draft Release | |
| shell: pwsh | |
| run: | | |
| [string]$DraftReleaseId = ${{ needs.build.outputs.DRAFT_RELEASE_ID }} | |
| [string]$FilePath = ".\Downloaded-Artifacts\HardenWindowsSecurityRepoSBOM.spdx" | |
| [string]$FileName = "HardenWindowsSecurityRepoSBOM.spdx" | |
| [string]$UploadUrl = "https://uploads.github.com/repos/${{ github.repository }}/releases/$DraftReleaseId/assets?name=$FileName" | |
| $Response = Invoke-RestMethod -Uri $UploadUrl -Method Put -InFile $FilePath -Headers @{ | |
| "Authorization" = "token ${{ secrets.GITHUB_TOKEN }}" | |
| "Content-Type" = "application/octet-stream" | |
| } | |
| Write-Host -Object "Uploaded the SBOM file to the draft release: $Response.name" | |
| - name: Updating The MSIX/MSIXBundle Download Links and Version via Pull Request | |
| shell: pwsh | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| [string]$MSIXName = "${{ needs.build.outputs.MSIX_NAME }}" | |
| [string]$MSIXBundleName = "${{ needs.build.outputs.MSIXBundle_NAME }}" | |
| # Spaces in files added to the GitHub assets will be replaced with dots, so we need to do the same when constructing the download link | |
| [string]$AdjustedMSIXName = $MSIXName.Replace('AppControl Manager', 'AppControl.Manager') | |
| [string]$AdjustedMSIXBundleName = $MSIXBundleName.Replace('AppControl Manager', 'AppControl.Manager') | |
| [string]$DRAFT_RELEASE_TAG = "${{ needs.build.outputs.DRAFT_RELEASE_TAG }}" | |
| [string]$GitHubRepository = "${{ github.repository }}" | |
| [string]$PACKAGE_VERSION = "${{ needs.build.outputs.PACKAGE_VERSION }}" | |
| # Construct the download URL using the draft release tag and MSIX file name | |
| [string]$DownloadURL = "https://github.com/$GitHubRepository/releases/download/$DRAFT_RELEASE_TAG/$AdjustedMSIXName" | |
| [string]$DownloadURLForMSIXBundle = "https://github.com/$GitHubRepository/releases/download/$DRAFT_RELEASE_TAG/$AdjustedMSIXBundleName" | |
| # Path to the files that will be updated | |
| [string]$DownloadURLFilePath = '.\AppControl Manager\DownloadURL.txt' | |
| [string]$DownloadURLFilePathForMSIXBundle = '.\AppControl Manager\MSIXBundleDownloadURL.txt' | |
| [string]$VersionFilePath = '.\AppControl Manager\version.txt' | |
| # Update the file content with the new URL | |
| Set-Content -Path $DownloadURLFilePath -Value $DownloadURL -Force | |
| Write-Host -Object "Updated DownloadURL.txt with download URL: $DownloadURL" | |
| Set-Content -Path $DownloadURLFilePathForMSIXBundle -Value $DownloadURLForMSIXBundle -Force | |
| Write-Host -Object "Updated MSIXBundleDownloadURL.txt with download URL: $DownloadURLForMSIXBundle" | |
| Set-Content -Path $VersionFilePath -Value $PACKAGE_VERSION -Force | |
| Write-Host -Object "Updated version.txt with version: $PACKAGE_VERSION" | |
| # Configure Git for committing changes | |
| git config --global user.email 'spynetgirl@outlook.com' | |
| git config --global user.name 'HotCakeX' | |
| # Create a new branch for the pull request, making sure branch name has valid characters | |
| [string]$NewBranchName = 'AppControl-Manager-DownloadLink-Version-Update' | |
| git checkout -b $NewBranchName | |
| [string]$CommitMessageAndPRTitle = "AppControl-Manager-DownloadLink-Version-Update-Version-$PACKAGE_VERSION" | |
| # Stage and commit the change | |
| git add $DownloadURLFilePath | |
| git add $DownloadURLFilePathForMSIXBundle | |
| git add $VersionFilePath | |
| git commit -m $CommitMessageAndPRTitle | |
| # Push the new branch to the remote repository | |
| git push -u origin $NewBranchName | |
| [string]$PRBody = @" | |
| This PR updates DownloadURL.txt to | |
| `````` | |
| $DownloadURL | |
| `````` | |
| And MSIXBundleDownloadURL.txt to | |
| `````` | |
| $DownloadURLForMSIXBundle | |
| `````` | |
| And version.txt to | |
| `````` | |
| $PACKAGE_VERSION | |
| `````` | |
| "@ | |
| # Create the pull request | |
| gh pr create --title $CommitMessageAndPRTitle --body $PRBody --base main --label 'Automated 🤖' --assignee HotCakeX | |
| - name: Add Body Text to the Draft Release | |
| shell: pwsh | |
| run: | | |
| $ReleaseId = "${{ needs.build.outputs.DRAFT_RELEASE_ID }}" | |
| $Repo = "${{ github.repository }}" | |
| [string]$Note = @" | |
| # What's New | |
| <br> | |
| > [!IMPORTANT]\ | |
| > **How To Install: Copy and Paste this command in a PowerShell window as Admin. ([Technical explanation available here](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager#how-to-install-or-update-the-app))** | |
| > ``````powershell | |
| > (irm 'https://raw.githubusercontent.com/HotCakeX/Harden-Windows-Security/main/Harden-Windows-Security.ps1')+'AppControl'|iex | |
| > `````` | |
| <br> | |
| <br> | |
| How to [verify](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds#verifying-artifact-attestations-with-the-github-cli) the MSIXBundle's authenticity: | |
| `````` | |
| gh attestation verify "Path To MSIXBundle" --repo HotCakeX/Harden-Windows-Security --format json | |
| `````` | |
| You can [install the GitHub CLI](https://github.com/cli/cli?tab=readme-ov-file#windows) from Winget: | |
| `````` | |
| winget install --id GitHub.cli | |
| `````` | |
| <br> | |
| > [!NOTE]\ | |
| > As mentioned at the top, please **[refer to this page](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager#how-to-install-or-update-the-app)** for installation instructions. | |
| <br> | |
| "@ | |
| $Payload = @{ body = $Note } | ConvertTo-Json | |
| $Url = "https://api.github.com/repos/$Repo/releases/$ReleaseId" | |
| Invoke-RestMethod -Uri $Url -Method Patch -Headers @{ | |
| "Authorization" = "token ${{ secrets.GITHUB_TOKEN }}" | |
| "Content-Type" = "application/json" | |
| } -Body $Payload |