Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 36 additions & 2 deletions .github/workflows/build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@
done

if [ ${#versions[@]} -eq 0 ]; then
highest_version="0.0.0"
highest_version="1.0.0"
else
highest_version=$(printf '%s\n' "${versions[@]}" | sort -V | tail -n1)
fi
Expand Down Expand Up @@ -187,7 +187,7 @@
uses: actions/upload-artifact@v4.6.0
with:
name: uDesktopMascot_win64_installer_v${{ needs.check-branch.outputs.current_version }}
path: "uDesktopMascot_win64_installer_v${{ needs.check-branch.outputs.current_version }}.exe"
path: uDesktopMascot_win64_installer_v${{ needs.check-branch.outputs.current_version }}.exe

build-mac:
if: ${{ github.event_name == 'pull_request' || github.event_name == 'schedule' || inputs.build_mac }}
Expand Down Expand Up @@ -255,3 +255,37 @@
with:
name: uDesktopMascot_mac_installer_v${{ needs.check-branch.outputs.current_version }}
path: build/uDesktopMascot_mac_installer_v${{ needs.check-branch.outputs.current_version }}.pkg

deploy-itchio:
needs: [ build-windows, build-mac, check-branch ]
if: ${{ github.event_name == 'workflow_dispatch' || (github.event_name != 'pull_request' && (github.event_name == 'schedule' || startsWith(github.ref, 'refs/heads/main') || startsWith(github.ref, 'refs/tags/'))) }}
runs-on: ubuntu-latest

concurrency:
group: deploy-itchio-${{ github.ref }}-${{ matrix.platform }}
cancel-in-progress: true

strategy:
fail-fast: false
matrix:
platform: [ windows, mac ]

steps:
- name: Download build artifact
uses: actions/download-artifact@v4
with:
name: ${{ matrix.platform == 'windows' && format('Build-StandaloneWindows64-v{0}', needs.check-branch.outputs.current_version) || format('Build-StandaloneOSX-v{0}', needs.check-branch.outputs.current_version) }}
path: .

- name: Set package path
id: pkg
run: echo "pkg=." >> $GITHUB_OUTPUT

- name: Push to itch.io
uses: yeslayla/butler-publish-itchio-action@v1.0.3
env:
BUTLER_CREDENTIALS: ${{ secrets.ITCHIO_API_KEY }}
ITCH_USER: midralab
ITCH_GAME: uDesktopMascot
CHANNEL: ${{ matrix.platform == 'windows' && 'windows-x64' || 'osx-universal' }}
PACKAGE: ${{ steps.pkg.outputs.pkg }}
Comment on lines +260 to +291

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 1 year ago

To address this problem, add an explicit permissions block to the workflow YAML—either at the top level (root) to apply to all jobs, or at individual job levels if needing different scopes. Since this workflow mainly downloads/upload artifacts and interacts with Git LFS but does not push to the repository or do writes to issues or pull requests, the minimal safest setting is likely contents: read. If you add this block at the root of the workflow—after the name and before on or jobs—it will apply to all jobs, meeting the principle of least privilege and satisfying the CodeQL recommendation.

Changes:

  • Insert at the beginning of .github/workflows/build.yml (between the name and on fields) the line(s):
    permissions:
      contents: read
  • No other code, imports, or structural changes are required.

Suggested changeset 1
.github/workflows/build.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,4 +1,6 @@
 name: Run build
+permissions:
+  contents: read
 
 on:
   workflow_dispatch:
EOF
@@ -1,4 +1,6 @@
name: Run build
permissions:
contents: read

on:
workflow_dispatch:
Copilot is powered by AI and may make mistakes. Always verify output.
48 changes: 43 additions & 5 deletions .github/workflows/release-build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,7 @@ jobs:
done

if [ ${#versions[@]} -eq 0 ]; then
highest_version="0.0.0"
highest_version="1.0.0"
else
highest_version=$(printf '%s\n' "${versions[@]}" | sort -V | tail -n1)
fi
Expand Down Expand Up @@ -296,6 +296,48 @@ jobs:
name: uDesktopMascot_mac_v${{ needs.check-branch.outputs.current_version }}
path: build/uDesktopMascot_mac_v${{ needs.check-branch.outputs.current_version }}.zip

deploy-itchio:
needs: [build-windows, build-mac, check-branch]
if: ${{ github.event_name == 'workflow_dispatch' || (github.event_name != 'pull_request' && (github.event_name == 'schedule' || startsWith(github.ref, 'refs/heads/main') || startsWith(github.ref, 'refs/tags/'))) }}
runs-on: ubuntu-latest

concurrency:
group: deploy-itchio-${{ github.ref }}-${{ matrix.platform }}
cancel-in-progress: true

strategy:
fail-fast: false
matrix:
platform: [ windows, mac ]

steps:
- name: Download artifact
uses: actions/download-artifact@v4
with:
name: ${{ matrix.platform == 'windows' && format('uDesktopMascot_win_v{0}', needs.check-branch.outputs.current_version) || format('uDesktopMascot_mac_v{0}', needs.check-branch.outputs.current_version) }}
path: .

- name: Determine package path
id: pkg
shell: bash
run: |
if [ "${{ matrix.platform }}" == "windows" ]; then
echo "pkg_path=uDesktopMascot_win_v${{ needs.check-branch.outputs.current_version }}.zip" >> $GITHUB_OUTPUT
echo "channel=windows-x64" >> $GITHUB_OUTPUT
else
echo "pkg_path=uDesktopMascot_mac_v${{ needs.check-branch.outputs.current_version }}.zip" >> $GITHUB_OUTPUT
echo "channel=osx-universal" >> $GITHUB_OUTPUT
fi

- name: Push to itch.io
uses: yeslayla/butler-publish-itchio-action@v1.0.3
env:
BUTLER_CREDENTIALS: ${{ secrets.ITCHIO_API_KEY }}
ITCH_USER: midralab
ITCH_GAME: uDesktopMascot
CHANNEL: ${{ steps.pkg.outputs.channel }}
PACKAGE: ${{ steps.pkg.outputs.pkg_path }}

release:
needs: [create-tag, check-branch, build-windows, build-mac]
runs-on: ubuntu-latest
Expand All @@ -315,10 +357,6 @@ jobs:
echo "リリースタグ名は '${TAG_NAME}' です"
echo "tag_name=${TAG_NAME}" >> $GITHUB_OUTPUT

- name: アーティファクト構造の確認
run: |
ls -R ./artifacts

- name: ドラフトリリースを作成し、アーティファクトをアップロード
uses: softprops/action-gh-release@v2
with:
Expand Down
8 changes: 8 additions & 0 deletions Assets/Resources.meta

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 8 additions & 0 deletions Assets/Resources/uPiper.meta

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 8 additions & 0 deletions Assets/Resources/uPiper/Models.meta

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Binary file not shown.
Loading
Loading