From f3233d948babbbef574dee9f8d2eb86388c96e23 Mon Sep 17 00:00:00 2001
From: yueh <yueh@users.noreply.github.com>
Date: Sat, 27 Jun 2020 15:30:07 +0200
Subject: [PATCH] Sign jars (#4435)

---
 .github/workflows/branches.yml  |  1 +
 .github/workflows/release.yml   | 45 +++++++++++++++++++++++----------
 build.gradle                    | 24 +++++++++++++++++-
 gradle/scripts/artifacts.gradle |  3 +++
 4 files changed, 58 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/branches.yml b/.github/workflows/branches.yml
index 21f0c3f1d..ec8a64c04 100644
--- a/.github/workflows/branches.yml
+++ b/.github/workflows/branches.yml
@@ -27,3 +27,4 @@ jobs:
           run: ./gradlew runData --no-daemon
       - name: Build with Gradle
         run: ./gradlew build --no-daemon
+        
\ No newline at end of file
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2728b511e..5e788d798 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,8 +11,16 @@ jobs:
     steps:
       - name: Validate semver
         env:
-          RELEASE: ${{ github.event.release.tag_name }}
-        run: echo $RELEASE | grep -oP '^v(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$'
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          echo $TAG | grep -oP '^v(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$'
+          echo "::set-env name=RELEASE::${TAG:1}"
+      - name: Export keystore
+        env:
+          KEY_STORE: ${{ secrets.KEY_STORE }}
+        run: |
+          echo $KEY_STORE | base64 -d > $HOME/keystore.jks
+          echo "::set-env name=KEY_STORE_FILE::$HOME/keystore.jks"
       - uses: actions/checkout@v2
       - name: Set up JDK 1.8
         uses: actions/setup-java@v1
@@ -20,23 +28,32 @@ jobs:
           java-version: 1.8
       - name: Grant execute permission for gradlew
         run: chmod +x gradlew
-      - name: Use gradle cache for faster builds
-        uses: actions/cache@v1
-        with:
-          path: ~/.gradle/caches
-          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}
       - name: Generate assets
         uses: GabrielBB/xvfb-action@v1.2
-        env:
-          RELEASE: ${{ github.event.release.tag_name }}
         with:
           run: ./gradlew runData --no-daemon
-      - name: Build with Gradle
+      - name: Build with Gradle and sign
         env:
-          RELEASE: ${{ github.event.release.tag_name }}
+          KEY_STORE_PASS: ${{ secrets.KEY_STORE_PASS }}
+          KEY_STORE_ALIAS: ${{ secrets.KEY_STORE_ALIAS }}
+          KEY_STORE_KEY_PASS: ${{ secrets.KEY_STORE_KEY_PASS }}
         run: ./gradlew build --no-daemon
-      - name: Publish package
+      - name: Prepare artifact metadata
+        id: prepare_artifact_metadata
+        run: |
+          echo ::set-output name=ARTIFACT_PATH::./build/libs/appliedenergistics2-${RELEASE}.jar
+          echo ::set-output name=ARTIFACT_NAME::appliedenergistics2-${RELEASE}.jar
+      - name: Upload Release Artifact
+        uses: actions/upload-release-asset@v1.0.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          RELEASE: ${{ github.event.release.tag_name }}
-        run: ./gradlew publish --no-daemon
+        with:
+          upload_url: ${{ github.event.release.upload_url }}
+          asset_path: ${{ steps.prepare_artifact_metadata.outputs.ARTIFACT_PATH }}
+          asset_name: ${{ steps.prepare_artifact_metadata.outputs.ARTIFACT_NAME }}
+# Disabled for testing releases
+#      - name: Publish package
+#        env:
+#          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+#          RELEASE: ${{ github.event.release.tag_name }}
+#        run: ./gradlew publish --no-daemon
diff --git a/build.gradle b/build.gradle
index 2a83f8868..36ac4474c 100644
--- a/build.gradle
+++ b/build.gradle
@@ -69,7 +69,7 @@ if (ext.branch) {
 
 ext.release = System.getenv('RELEASE') ?: ""
 if (ext.release) {
-  version = ext.release.substring(1)
+  version = ext.release
 }
 
 
@@ -142,6 +142,28 @@ minecraft {
     }
 }
 
+def signProps = [:]
+if (System.getenv("KEY_STORE_FILE")) {
+    signProps['keyStore'] = System.getenv("KEY_STORE_FILE")
+    signProps['storePass'] = System.getenv("KEY_STORE_PASS")
+    signProps['alias'] = System.getenv("KEY_STORE_ALIAS")
+    signProps['keyPass'] = System.getenv("KEY_STORE_KEY_PASS")
+}
+
+task signJar(type: net.minecraftforge.gradle.common.task.SignJar, dependsOn: 'reobfJar') {
+    onlyIf { !signProps.isEmpty() }
+
+    if (!signProps.isEmpty()) {
+        keyStore = signProps.keyStore
+        alias = signProps.alias
+        storePass = signProps.storePass
+        keyPass = signProps.keyPass
+
+        inputFile = jar.archivePath
+        outputFile = jar.archivePath
+    }
+}
+
 apply from: 'gradle/scripts/artifacts.gradle'
 
 publishing {
diff --git a/gradle/scripts/artifacts.gradle b/gradle/scripts/artifacts.gradle
index e3f1caf90..f9503ff9b 100644
--- a/gradle/scripts/artifacts.gradle
+++ b/gradle/scripts/artifacts.gradle
@@ -21,6 +21,9 @@ processResources {
 }
 
 jar {
+    finalizedBy 'reobfJar'
+    finalizedBy 'signJar'
+
     from sourceSets.main.output.classesDirs
     from sourceSets.api.output.classesDirs
     from sourceSets.main.output.resourcesDir