obs-studio/.github/actions/bouf/action.yaml

name: Run bouf
description: Generates signed OBS install files and updater files
inputs:
  gcpWorkloadIdentityProvider:
    description: GCP Identity Provider Pool ID
    required: true
  gcpServiceAccountName:
    description: Google service account name
    required: true
  gcpManifestSigningKeyName:
    description: Name of the manifest signing key in GCP KMS
    required: false
  version:
    description: Version string (e.g., 30.0.0-rc1)
    required: true
  channel:
    description: Update channel
    required: false
    default: 'stable'

runs:
  using: composite
  steps:
    - name: Extract Artifact
      shell: pwsh
      run: |
        Expand-Archive -Path build\*.zip -DestinationPath build
        Remove-Item build\*.zip

    - name: Setup bouf
      shell: pwsh
      env:
        BOUF_TAG: 'v0.6.2'
        BOUF_HASH: '40ca34457a8ac60b9710a41b4cde2a0fc36d8740ab21b01d702069be2e1c5fb9'
        BOUF_NSIS_HASH: '88958a9e4e0f3cb6f78e8359fdfa3343d050d5c2158e3ee77cb2cc4a8785ac61'
        GH_TOKEN: ${{ github.token }}
      run: |
        # Download bouf release
        . ${env:GITHUB_ACTION_PATH}\Ensure-Location.ps1
        . ${env:GITHUB_ACTION_PATH}\Invoke-External.ps1
        Ensure-Location bouf
        $windows_zip = "bouf-windows-${env:BOUF_TAG}.zip"
        $nsis_zip = "bouf-nsis-${env:BOUF_TAG}.zip"
        Invoke-External gh release download "${env:BOUF_TAG}" -R "obsproject/bouf" -p $windows_zip -p $nsis_zip
        
        if ((Get-FileHash $windows_zip -Algorithm SHA256).Hash -ne "${env:BOUF_HASH}") {
          throw "bouf hash does not match."
        }
        if ((Get-FileHash $nsis_zip -Algorithm SHA256).Hash -ne "${env:BOUF_NSIS_HASH}") {
          throw "NSIS package hash does not match."
        }
        
        Expand-Archive -Path $windows_zip -DestinationPath bin
        Expand-Archive -Path $nsis_zip -DestinationPath nsis

    - name: Download Google CNG Provider
      shell: pwsh
      env:
        CNG_TAG: 'cng-v1.0'
        GH_TOKEN: ${{ github.token }}
      run: |
        # Download Google CNG provider release from github
        . ${env:GITHUB_ACTION_PATH}\Ensure-Location.ps1
        . ${env:GITHUB_ACTION_PATH}\Invoke-External.ps1
        Ensure-Location gcng
        
        Invoke-External gh release download "${env:CNG_TAG}" -R "GoogleCloudPlatform/kms-integrations" -p "*amd64.zip"
        Expand-Archive -Path *.zip
        $sigPath = Get-ChildItem *.sig -Recurse
        $msiPath = Get-ChildItem *.msi -Recurse
        # Verify digital signature against Google's public key
        Invoke-External openssl dgst -sha384 -verify "${env:GITHUB_ACTION_PATH}/cng-release-signing-key.pem" -signature $sigPath $msiPath
        # Finally, install the CNG provider
        Invoke-External msiexec /i $msiPath /qn /norestart

    - name: Install pandoc and rclone
      shell: pwsh
      run: |
        choco install rclone --version=1.64.2 -y --no-progress
        choco install pandoc --version=3.1.9 -y --no-progress

    - name: Prepare Release Notes
      shell: pwsh
      run: |
        # Release notes are just the tag body on Windows
        Set-Location repo
        git tag -l --format='%(contents:body)' ${{ inputs.version }} > "${{ github.workspace }}/notes.rst"
    
    - name: 'Authenticate to Google Cloud'
      uses: 'google-github-actions/auth@5a50e581162a13f4baa8916d01180d2acbc04363'
      with:
        workload_identity_provider: ${{ inputs.gcpWorkloadIdentityProvider }}
        service_account: ${{ inputs.gcpServiceAccountName }}

    - name: 'Set up Cloud SDK'
      uses: 'google-github-actions/setup-gcloud@98ddc00a17442e89a24bbf282954a3b65ce6d200'

    - name: Download Old Builds
      shell: pwsh
      env:
        RCLONE_GCS_ENV_AUTH: 'true'
      run: |
        rclone copy --transfers 100 :gcs:obs-builds "${{ github.workspace }}/old_builds"

    - name: Run bouf
      shell: pwsh
      run: |
        . ${env:GITHUB_ACTION_PATH}\Invoke-External.ps1
        $boufArgs = @(
           "--config",     "${env:GITHUB_ACTION_PATH}/config.toml",
           "--version",    "${{ inputs.version }}"
           "--branch",     "${{ inputs.channel }}"
           "--notes-file", "${{ github.workspace }}/notes.rst"
           "-i",           "${{ github.workspace }}/build"
           "-p",           "${{ github.workspace }}/old_builds"
           "-o",           "${{ github.workspace }}/output"
        )
        Invoke-External "${{ github.workspace }}\bouf\bin\bouf.exe" @boufArgs

    - name: Sign Updater Manifest
      shell: pwsh
      if: inputs.gcpManifestSigningKeyName != ''
      run: |
        $gcloudArgs = @(
           "--input-file",       "${{ github.workspace }}/output/manifest.json"
           "--signature-file",   "${{ github.workspace }}/output/manifest.json.sig"
           "--digest-algorithm", "sha512"
           "--location",         "global"
           "--keyring",          "production"
           "--key",              "${{ inputs.gcpManifestSigningKeyName }}"
           "--version",          "1"
        )
        gcloud kms asymmetric-sign @gcloudArgs