build-hammer.yml

name: Build Hammer

on:
  push:
    branches: [main]
  pull_request_target:
  workflow_dispatch:

jobs:
  build:
    name: ${{matrix.buildname}}
    runs-on: ${{matrix.os}}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-20.04
            # name to show in the logs
            buildname: 'linux'
            # qml.net version to use from https://github.com/qmlnet/qt-runtimes/releases/tag/releases
            qt-version: '5.15.1-7fc8b10'
            # .NET platform identifier
            dotnet-platform: 'linux-x64'
            # .NET platform version:
            dotnet-version: 'net5.0'
            # resulting zip or executable name
            deployment-platform: 'linux'
          - os: macos-10.15
            buildname: 'macos'
            qt-version: '5.15.1-7fc8b10'
            dotnet-platform: 'osx-x64'
            dotnet-version: 'net5.0'
            deployment-platform: 'macos'
          - os: windows-2019
            buildname: 'windows'
            qt-version: '5.15.1-7fc8b10'
            dotnet-platform: 'win-x64'
            dotnet-version: 'net5.0'
            deployment-platform: 'windows'

    env:
      DOTNET_CLI_TELEMETRY_OPTOUT: true
      DOTNET_NOLOGO: true

    steps:
    - name: Checkout source code
      uses: actions/checkout@v3

    - name: Restore maven cache
      uses: actions/cache@v3.0.7
      with:
        path: ~/.m2/repository
        key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
        restore-keys: |
          ${{ runner.os }}-maven-

    - name: Setup .NET Core SDK
      uses: actions/setup-dotnet@v2.1.0
      with:
        dotnet-version: 5.0.x

    - name: Clone Java validator
      run: git clone --depth 1 --shallow-submodules https://github.com/health-validator/org.hl7.fhir.core

      # build Java first as it's needed by .NET for copying into the publish folder
    - name: Build Java validator
      shell: bash
      run: |
        cd org.hl7.fhir.core
        echo "Git revision of the validator code: $(git rev-parse HEAD)"
        mvn package -Dmaven.test.skip=true --projects org.hl7.fhir.validation.cli --no-transfer-progress
        mv org.hl7.fhir.validation.cli/target/org.hl7.fhir.validation.cli*-SNAPSHOT.jar $GITHUB_WORKSPACE/org.hl7.fhir.validator.jar

        # validate Java validator works
        cd $GITHUB_WORKSPACE
        java -jar org.hl7.fhir.validator.jar

    - name: (Linux) Build Hammer
      if: runner.os == 'Linux'
      run: |
        sed -i 's|// import appmodel 1.0|import appmodel 1.0|g' Main.qml
        dotnet publish --configuration Release --runtime ${{matrix.dotnet-platform}}

    - name: (macOS) Build Hammer
      if: runner.os == 'macOS'
      run: |
        sed -i '' 's|// import appmodel 1.0|import appmodel 1.0|g' Main.qml
        dotnet restore --runtime=osx-x64
        dotnet msbuild -p:Configuration=Release -t:BundleApp -p:RuntimeIdentifier=osx-x64 -p:UseAppHost=true

    - name: (Windows) Build Hammer
      if: runner.os == 'Windows'
      run: |
        sed -i 's|// import appmodel 1.0|import appmodel 1.0|g' Main.qml
        dotnet publish --configuration Release --runtime ${{matrix.dotnet-platform}}

    - name: (Windows) Trim createdump
      if: runner.os == 'Windows'
      shell: bash
      run: |
        # remove createdump.exe as it's not necessary
        jqi() {
          cat <<< "$(jq "$1" < "$2")" > "$2"
        }
        jqi "del(..|.\"createdump.exe\"?)" bin/Release/${{matrix.dotnet-version}}/${{matrix.dotnet-platform}}/publish/Hammer.deps.json
        rm -f bin/Release/${{matrix.dotnet-version}}/${{matrix.dotnet-platform}}/publish/createdump.exe

    - name: Download runtime
      shell: bash
      run: |
        curl --location --output qt-runtime.tar.gz https://github.com/qmlnet/qt-runtimes/releases/download/releases/qt-${{matrix.qt-version}}-${{matrix.dotnet-platform}}-runtime.tar.gz

    - name: (macOS) Extract runtime
      shell: bash
      if: runner.os == 'macOS'
      run: |
        mkdir -p bin/Release/${{matrix.dotnet-version}}/${{matrix.dotnet-platform}}/publish/Hammer.app/Contents/MacOS/qt-runtime
        tar -xf qt-runtime.tar.gz -C bin/Release/${{matrix.dotnet-version}}/${{matrix.dotnet-platform}}/publish/Hammer.app/Contents/MacOS/qt-runtime

        # trim unnecessary Tools folder (containing only Conan support)
        rm -rf bin/Release/${{matrix.dotnet-version}}/${{matrix.dotnet-platform}}/publish/Hammer.app/Contents/MacOS/qt-runtime/Tools

        # clean up the publish folder, leaving the .app only
        cd bin/Release/${{matrix.dotnet-version}}/${{matrix.dotnet-platform}}/publish
        mv Hammer.app /tmp/Hammer.app
        rm -rf *
        cp -r /tmp/Hammer.app .

    - name: (Windows/Linux) Extract runtime
      shell: bash
      if: runner.os == 'Windows' || runner.os == 'Linux'
      run: |
        mkdir -p bin/Release/${{matrix.dotnet-version}}/${{matrix.dotnet-platform}}/publish/qt-runtime
        tar -xf qt-runtime.tar.gz -C bin/Release/${{matrix.dotnet-version}}/${{matrix.dotnet-platform}}/publish/qt-runtime

    - name: (macOS) Generate dmg & sign the app
      shell: bash
      if: runner.os == 'macOS'
      env:
        MACOS_SIGNING_PASS: ${{secrets.MACOS_SIGNING_PASS}}
        AC_USERNAME: ${{secrets.APPLE_USERNAME}}
        AC_PASSWORD: ${{secrets.APPLE_PASSWORD}}
      run: |
        brew install mitchellh/gon/gon

        KEYCHAIN=build.keychain
        security create-keychain -p travis $KEYCHAIN
        security default-keychain -s $KEYCHAIN
        security unlock-keychain -p travis $KEYCHAIN
        security set-keychain-settings -t 3600 -u $KEYCHAIN
        security import assets/code-signing-certificate-macos.p12 -k $KEYCHAIN -P "$MACOS_SIGNING_PASS" -T /usr/bin/codesign
        security set-key-partition-list -S apple-tool:,apple: -s -k travis $KEYCHAIN
        export IDENTITY="Developer ID Application"
        echo "Imported identity:"
        security find-identity
        echo "----"
        npm install -g appdmg

        cd bin/Release/${{matrix.dotnet-version}}/${{matrix.dotnet-platform}}/publish

        cp -r $GITHUB_WORKSPACE/assets/hammer-appdmg.json .
        cp -r $GITHUB_WORKSPACE/assets/hammer-logo.icns .

        # Fix up QmlModel.2 folder which codesign does not like
        pip3 install macholib
        # python3 $GITHUB_WORKSPACE/assets/fix_app_qt_folder_names_for_codesign.py "Hammer.app"

        # codesign --deep --force -o runtime --sign "$IDENTITY" "Hammer.app"
        # deep isn't really deep; sign everything inside as well
        # find Hammer.app | parallel 'codesign --deep --force -o runtime --sign "$IDENTITY" {}'

        # appdmg hammer-appdmg.json Hammer.dmg

        # codesign --deep --force -o runtime --sign "$IDENTITY" "Hammer.dmg"
        # echo "Signed final .dmg"

        cat << EOF > gon.json
        {
          "notarize": [{
            "path": "./Hammer.dmg",
            "bundle_id": "healthcare.hammer",
            "staple": true
          }]
        }
        EOF

        # gon gon.json

        # security delete-keychain $KEYCHAIN

    - name: (Windows) Sign executables
      shell: powershell
      if: runner.os == 'Windows' && env.WINDOWS_CODE_SIGNING != null
      env:
        WINDOWS_CODE_SIGNING: ${{secrets.WINDOWS_CODE_SIGNING}}
        WORKSPACEGIT: ${{runner.workspace}}\Hammer
      run: |
        $env:path += ";${env:ProgramFiles(x86)}\Windows Kits\10\bin\x64"

        Get-ChildItem "bin/Release/${{matrix.dotnet-version}}/${{matrix.dotnet-platform}}/publish/" -Filter *.dll -Recurse |
        Foreach-Object {
          echo "Signing $($_.FullName)..."
          # tried paths with \ for /f, didn't work
          signtool.exe sign /a /f $env:WORKSPACEGIT/assets/code-signing-certificate-windows.p12 /p $env:WINDOWS_CODE_SIGNING /fd sha256 /tr http://timestamp.digicert.com /td sha256 "$($_.FullName)"
        }
        Get-ChildItem "bin/Release/${{matrix.dotnet-version}}/${{matrix.dotnet-platform}}/publish/" -Filter *.exe -Recurse |
        Foreach-Object {
          echo "Signing $($_.FullName)..."
          signtool.exe sign /a /f $env:WORKSPACEGIT/assets/code-signing-certificate-windows.p12 /p $env:WINDOWS_CODE_SIGNING /fd sha256 /tr http://timestamp.digicert.com /td sha256 "$($_.FullName)"
        }

    - name: Zip up artifact
      shell: bash
      run: cd bin/Release/${{matrix.dotnet-version}}/${{matrix.dotnet-platform}}/publish/ && 7z a -tzip $GITHUB_WORKSPACE/publish/Hammer-${{matrix.deployment-platform}}.zip

    - name: Upload as a Github artifact
      uses: actions/upload-artifact@v3
      with:
        name: hammer-${{matrix.buildname}}
        path: publish/*

    # We only need to run this on one OS - so run it on the quickest one
    - name: (Linux) Publish pre-release to nuget
      if: runner.os == 'Linux' && github.ref == 'refs/heads/main'
      env:
        NUGET_API_KEY: ${{secrets.NUGET_API_KEY}}
      shell: bash
      run: |
        sed -i -r 's|<Version>(.+?)<\/Version>|<Version>\1-rc${{github.run_number}}</Version>|g' Hammer.csproj
        sed -i 's|<PackageId>Hammer</PackageId>|<PackageId>Hammer.TestVersion</PackageId>|g' Hammer.csproj
        dotnet pack
        dotnet nuget push nupkg/Hammer.*.nupkg --skip-duplicate --api-key ${{env.NUGET_API_KEY}} --source https://api.nuget.org/v3/index.json


  upload_artifacts:
    name: Upload to pre-release
    runs-on: ubuntu-20.04
    needs: build
    if: github.event_name == 'push'

    steps:
    - uses: actions/download-artifact@v3
      with:
        path: artifacts

    - name: Deploy to a preview link
      uses: marvinpinto/action-automatic-releases@v1.2.1
      with:
        repo_token: ${{secrets.GITHUB_TOKEN}}
        prerelease: true
        automatic_release_tag: preview
        title: Latest in-development build
        files: |
          artifacts/hammer-linux/Hammer-linux.zip
          artifacts/hammer-windows/Hammer-windows.zip
          artifacts/hammer-macos/Hammer-macos.zip


  validate_examples_metadata:
    name: Validate examples metadata file

    runs-on: ubuntu-20.04

    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 2

      - name: Check if metadata or schema have changed
        id: changed-files-specific
        uses: tj-actions/changed-files@v24.1
        with:
          files: |
            assets/examples/.metadata.schema.json
            assets/examples/metadata.json

      - name: Set up npm
        if: steps.changed-files-specific.outputs.any_changed == 'true'
        uses: actions/setup-node@v3.4.1
        with:
          node-version: 12

      - name: Install ajv
        if: steps.changed-files-specific.outputs.any_changed == 'true'
        run: npm install -g ajv-cli

      - name: Validate metadata
        if: steps.changed-files-specific.outputs.any_changed == 'true'
        run: ajv -s assets/examples/.metadata.schema.json -d assets/examples/metadata.json