Merge 7b370a0 into ea668ee

seanbudd · web-flow · commit 4d993609f10b · 2025-06-30T16:17:31.000+10:00
diff --git a/.github/workflows/testAndPublish.yml b/.github/workflows/testAndPublish.yml
@@ -3,20 +3,18 @@ name: CI/CD
 on:
   push:
     branches:
-    - master
-    - beta
-    - rc
-    - 'try-**'
-    # Currently disabled while the 2025.1 release is in progress.
-    # Blocked by #17878
-    # tags:
-    # - 'release-**'
+      - master
+      - beta
+      - rc
+      - 'try-**'
+    tags:
+      - 'release-**'
 
   pull_request:
     branches:
-    - master
-    - beta
-    - rc
+      - master
+      - beta
+      - rc
 
   workflow_dispatch:
 
@@ -37,6 +35,11 @@ jobs:
   buildNVDA:
     name: Build NVDA
     runs-on: windows-latest
+    outputs:
+      version: ${{ steps.releaseInfo.outputs.VERSION }}
+      versionType: ${{ steps.releaseInfo.outputs.VERSION_TYPE }}
+      APIVersion: ${{ steps.releaseInfo.outputs.NVDA_API_VERSION }}
+      APIBackCompat: ${{ steps.releaseInfo.outputs.NVDA_API_COMPAT_TO }}
     steps:
     - name: Checkout NVDA
       uses: actions/checkout@v4
@@ -74,6 +77,13 @@ jobs:
       with:
         path: ${{ github.workspace }}
         key: ${{ github.ref }}-${{ github.run_id }}
+    - name: Store release metadata information
+      id: releaseInfo
+      run: |
+        Write-Output VERSION=$env:version >> $env:GITHUB_OUTPUT
+        Write-Output VERSION_TYPE=$env:versionType >> $env:GITHUB_OUTPUT
+        Write-Output NVDA_API_VERSION=$(python -c "import sys; sys.path.append('source'); from addonAPIVersion import CURRENT; print('{}.{}.{}'.format(*CURRENT))") >> $env:GITHUB_OUTPUT
+        Write-Output NVDA_API_COMPAT_TO=$(python -c "import sys; sys.path.append('source'); from addonAPIVersion import BACK_COMPAT_TO; print('{}.{}.{}'.format(*BACK_COMPAT_TO))") >> $env:GITHUB_OUTPUT
 
   checkPot:
     name: Check translator comments
@@ -179,6 +189,9 @@ jobs:
     name: Create launcher
     runs-on: windows-latest
     needs: buildNVDA
+    outputs:
+      launcherUrl: ${{ steps.uploadLauncher.outputs.artifact-url }}
+      launcherSha256: ${{ steps.addJobSummary.outputs.SHA256 }}
     steps:
     - name: Checkout cached build
       uses: actions/cache/restore@v4
@@ -206,38 +219,38 @@ jobs:
       uses: actions/upload-artifact@v4
       with:
         name: NVDA launcher
-        path: output/nvda*.exe
+        path: |
+          output/nvda*.exe
+          output/nvda*controllerClient.zip
     - name: Upload documentation artifacts
       uses: actions/upload-artifact@v4
-      id: uploadDocsArtifacts
+      id: uploadBuildArtifacts
       with:
-        name: Documentation files
+        name: Documentation files and packaging metadata
         path: |
           output/devDocs
           output/*.html
           output/*.css
-    - name: Upload build artifacts
-      uses: actions/upload-artifact@v4
-      id: uploadBuildArtifacts
-      with:
-        name: Controller client and packaging metadata
-        path: |
-          output/nvda*controllerClient.zip
           output/library_modules.txt
           output/installed_python_packages.txt
     - name: Add job summary
+      id: addJobSummary
       shell: bash
       run: |
-        echo "* [Download the NVDA launcher](${{ steps.uploadLauncher.outputs.artifact-url }}) (${{ steps.uploadLauncher.outputs.artifact-digest }})" >> $GITHUB_STEP_SUMMARY
-        echo "* [Download the documentation](${{ steps.uploadDocsArtifacts.outputs.artifact-url }})" >> $GITHUB_STEP_SUMMARY
-        echo "* [Download the other build artifacts](${{ steps.uploadBuildArtifacts.outputs.artifact-url }})" >> $GITHUB_STEP_SUMMARY
-        echo "    * Controller client" >> $GITHUB_STEP_SUMMARY
-        echo "    * Packaging metadata (library modules, installed python packages)" >> $GITHUB_STEP_SUMMARY
+        NVDA_EXE_NAME=$(ls output/nvda*.exe | head -n 1)
+        SHA256=$(sha256sum "$NVDA_EXE_NAME" | cut -d ' ' -f 1)
+        echo SHA256=$SHA256 >> $GITHUB_OUTPUT
+        echo "* [Download the NVDA launcher](${{ steps.uploadLauncher.outputs.artifact-url }})" >> $GITHUB_STEP_SUMMARY
+        echo "    * SHA256 of launcher exe file: \`$SHA256\`" >> $GITHUB_STEP_SUMMARY
+        echo "* [Download the documentation and other build artifacts](${{ steps.uploadBuildArtifacts.outputs.artifact-url }})" >> $GITHUB_STEP_SUMMARY
+        echo "    * User guide, change log, developer guide" >> $GITHUB_STEP_SUMMARY
+        echo "    * Packaging metadata: library modules, installed python packages" >> $GITHUB_STEP_SUMMARY
 
   systemTests:
     strategy:
       fail-fast: false
       matrix:
+        # To skip tests, and just run install, replace with [excluded_from_build]
         testSuite: [chrome, installer, startupShutdown]
     name: Run system tests
     runs-on: windows-latest
@@ -288,6 +301,8 @@ jobs:
     name: Create symbols
     runs-on: windows-latest
     needs: buildNVDA
+    outputs:
+      symbolsUrl: ${{ steps.uploadArtifact.outputs.artifact-url }}
     steps:
     - name: Checkout cached build
       uses: actions/cache/restore@v4
@@ -299,7 +314,8 @@ jobs:
       env:
         symStore: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\symstore.exe
       run: ci/scripts/buildSymbolStore.ps1
-    - name: Upload symbols
+    - name: Upload symbols artifact
+      id: uploadArtifact
       uses: actions/upload-artifact@v4
       with:
         name: Symbols
@@ -357,13 +373,67 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
 
+  deploySnapshot:
+    name: Deploy NVDA snapshot
+    permissions:
+      contents: write
+      deployments: write
+    runs-on: ubuntu-latest
+    needs: [buildNVDA, checkPot, licenseCheck, unitTests, createLauncher, systemTests, createSymbols]
+    if: ${{ github.event_name == 'push' && !startsWith(github.ref_name, 'release-') }}
+    concurrency:
+      group: snapshot
+      cancel-in-progress: true
+    environment:
+      name: snapshot
+    steps:
+    - name: Get NVDA launcher
+      uses: actions/download-artifact@v4
+      with:
+        name: NVDA launcher
+        path: output
+    - name: Deploy snapshot
+      shell: bash
+      id: deploySnapshot
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        NVDA_EXE_NAME=$(ls output/nvda*.exe | head -n 1)
+        NVDA_HASH=$(sha1sum "$NVDA_EXE_NAME" | cut -d ' ' -f 1)
+
+        gh api \
+          --method POST \
+          -H "Accept: application/vnd.github+json" \
+          -H "X-GitHub-Api-Version: 2022-11-28" \
+          /repos/${{ github.repository }}/deployments \
+          -f "task=release" \
+          -f "description=Release of $NVDA_EXE_NAME" \
+          -f "ref=${{ github.ref_name }}" \
+          -F "auto_merge=true" \
+          -f "environment=snapshot" \
+          -f "required_contexts[]" \
+          -f "payload[NVDA_HASH]=$NVDA_HASH" \
+          -f "payload[NVDA_DOWNLOAD_URL]=${{ needs.createLauncher.outputs.launcherUrl }}" \
+          -f "payload[SYMBOLS_DOWNLOAD_URL]=${{ needs.createSymbols.outputs.symbolsUrl }}" \
+          -f "payload[NVDA_VERSION]=${{ needs.buildNVDA.outputs.version }}" \
+          -f "payload[NVDA_VERSION_TYPE]=${{ needs.buildNVDA.outputs.versionType }}" \
+          -f "payload[NVDA_API_VERSION]=${{ needs.buildNVDA.outputs.APIVersion }}" \
+          -f "payload[NVDA_API_COMPAT_TO]=${{ needs.buildNVDA.outputs.APIBackCompat }}"
+
   release:
     name: Release NVDA
     permissions:
       contents: write
+      deployments: write
+      discussions: write
     runs-on: ubuntu-latest
-    needs: [checkPot, licenseCheck, unitTests, systemTests, createSymbols]
+    needs: [buildNVDA, checkPot, licenseCheck, unitTests, createLauncher, systemTests, createSymbols]
     if: startsWith(github.ref_name, 'release-')
+    concurrency:
+      group: release
+      cancel-in-progress: true
+    environment:
+      name: production
     steps:
     - name: Get normalized tag names
       id: getReleaseNotes
@@ -388,26 +458,60 @@ jobs:
       run: |
         vtUrl=$(echo ${{ steps.virusTotal.outputs.analysis }} | sed -E 's/([^=]*)=([^,]*).*/\2/')
         echo VT_URL=$vtUrl >> $GITHUB_OUTPUT
+    - name: Deploy release
+      shell: bash
+      id: deployRelease
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        NVDA_EXE_NAME=$(ls output/nvda*.exe | head -n 1)
+        NVDA_HASH=$(sha1sum "$NVDA_EXE_NAME" | cut -d ' ' -f 1)
+
+        gh api \
+          --method POST \
+          -H "Accept: application/vnd.github+json" \
+          -H "X-GitHub-Api-Version: 2022-11-28" \
+          /repos/${{ github.repository }}/deployments \
+          -f "task=release" \
+          -f "description=Release of $NVDA_EXE_NAME" \
+          -f "ref=${{ github.ref_name }}" \
+          -F "auto_merge=false" \
+          -f "environment=production" \
+          -f "required_contexts[]" \
+          -f "payload[NVDA_HASH]=$NVDA_HASH" \
+          -f "payload[NVDA_DOWNLOAD_URL]=${{ needs.createLauncher.outputs.launcherUrl }}" \
+          -f "payload[NVDA_VERSION]=${{ needs.buildNVDA.outputs.version }}" \
+          -f "payload[NVDA_VERSION_TYPE]=${{ needs.buildNVDA.outputs.versionType }}" \
+          -f "payload[NVDA_API_VERSION]=${{ needs.buildNVDA.outputs.APIVersion }}" \
+          -f "payload[NVDA_API_COMPAT_TO]=${{ needs.buildNVDA.outputs.APIBackCompat }}"
+    - name: Create release notes
+      id: createReleaseNotes
+      shell: bash
+      run: |
+        echo "* Highlights can be found in the [release blog post](https://www.nvaccess.org/post/nvda-${{ steps.getReleaseNotes.outputs.NORMALIZED_TAG_NAME }}/)." >> /tmp/releaseNotes.md
+        echo "* [VirusTotal scan results](${{ steps.getVTUrl.outputs.VT_URL }})" >> /tmp/releaseNotes.md
+        echo "* SHA256 sum: \`${{ needs.createLauncher.outputs.launcherSha256 }}\`" >> /tmp/releaseNotes.md
     - name: Publish pre-release
       if: ${{ contains(github.ref_name, 'rc') || contains(github.ref_name, 'beta') }}
-      uses: softprops/action-gh-release@v2
-      with:
-        prerelease: true
-        make_latest: false
-        name: ${{ steps.getReleaseNotes.outputs.RELEASE_NAME }}
-        files: output/nvda*.exe
-        body: |
-          * Highlights can be found in the [release blog post](https://www.nvaccess.org/post/nvda-${{ steps.getReleaseNotes.outputs.NORMALIZED_TAG_NAME }}/).
-          * [VirusTotal scan results](${{ steps.getVTUrl.outputs.VT_URL }}).
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        gh release create ${{github.ref_name }} \
+          --repo ${{ github.repository }} \
+          --prerelease \
+          --title "${{ steps.getReleaseNotes.outputs.RELEASE_NAME }}" \
+          --notes-file /tmp/releaseNotes.md \
+          --verify-tag
     - name: Publish stable release
       if: ${{ !contains(github.ref_name, 'rc') && !contains(github.ref_name, 'beta') }}
-      uses: softprops/action-gh-release@v2
-      with:
-        prerelease: false
-        make_latest: true
-        discussion_category_name: Releases
-        name: ${{ steps.getReleaseNotes.outputs.RELEASE_NAME }}
-        files: output/nvda*.exe
-        body: |
-          * Highlights can be found in the [release blog post](https://www.nvaccess.org/post/nvda-${{ steps.getReleaseNotes.outputs.NORMALIZED_TAG_NAME }}/).
-          * [VirusTotal scan results](${{ steps.getVTUrl.outputs.VT_URL }}).
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        gh release create ${{github.ref_name }} \
+          --repo ${{ github.repository }} \
+          --title "${{ steps.getReleaseNotes.outputs.RELEASE_NAME }}" \
+          --notes-file /tmp/releaseNotes.md \
+          --verify-tag \
+          --discussion-category Releases
diff --git a/ci/README.md b/ci/README.md
@@ -29,7 +29,7 @@ Some of these steps run concurrently.
   * Build launcher
   * Install NVDA
   * Run systems tests
-* Deploy (not fully active currently):
+* Deploy:
   * On tagged/snapshot builds, upload symbols to Mozilla
   * On beta branch builds, upload translation to Crowdin.
   * On snapshot builds, deploy to the server.
