Cura/.github/workflows/cura-installer.yml

name: Cura Installer
run-name: ${{ inputs.cura_conan_version }} for ${{ inputs.platform }} by @${{ github.actor }}

on:
    workflow_call:
        inputs:
            platform:
                description: 'Selected Installer OS'
                default: 'ubuntu-20.04'
                required: true
                type: string
            os_name:
                description: 'OS Friendly Name'
                default: 'linux'
                required: true
                type: string
            cura_conan_version:
                description: 'Cura Conan Version'
                default: 'cura/latest@ultimaker/testing'
                required: true
                type: string
            conan_args:
                description: 'Conan args: eq.: --require-override'
                default: ''
                required: false
                type: string
            conan_config:
                description: 'Conan config branch to use'
                default: ''
                required: false
                type: string
            enterprise:
                description: 'Build Cura as an Enterprise edition'
                default: false
                required: true
                type: boolean
            staging:
                description: 'Use staging API'
                default: false
                required: true
                type: boolean
            installer:
                description: 'Create the installer'
                default: true
                required: true
                type: boolean
            msi_installer:
                description: 'Create the msi'
                default: false
                required: true
                type: boolean

env:
    CONAN_LOGIN_USERNAME_CURA: ${{ secrets.CONAN_USER }}
    CONAN_PASSWORD_CURA: ${{ secrets.CONAN_PASS }}
    CONAN_LOGIN_USERNAME_CURA_CE: ${{ secrets.CONAN_USER }}
    CONAN_PASSWORD_CURA_CE: ${{ secrets.CONAN_PASS }}
    CONAN_LOG_RUN_TO_OUTPUT: 1
    CONAN_LOGGING_LEVEL: ${{ inputs.conan_logging_level }}
    CONAN_NON_INTERACTIVE: 1
    CODESIGN_IDENTITY: ${{ secrets.CODESIGN_IDENTITY }}
    MAC_NOTARIZE_USER: ${{ secrets.MAC_NOTARIZE_USER }}
    MAC_NOTARIZE_PASS: ${{ secrets.MAC_NOTARIZE_PASS }}
    MACOS_CERT_P12: ${{ secrets.MACOS_CERT_P12 }}
    MACOS_CERT_INSTALLER_P12: ${{ secrets.MACOS_CERT_INSTALLER_P12 }}
    MACOS_CERT_USER: ${{ secrets.MACOS_CERT_USER }}
    GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
    MACOS_CERT_PASSPHRASE: ${{ secrets.MACOS_CERT_PASSPHRASE }}
    WIN_CERT_INSTALLER_CER: ${{ secrets.WIN_CERT_INSTALLER_CER }}
    WIN_CERT_INSTALLER_CER_PASS: ${{ secrets.WIN_CERT_INSTALLER_CER_PASS }}
    CURA_CONAN_VERSION: ${{ inputs.cura_conan_version }}
    ENTERPRISE: ${{ inputs.enterprise }}
    STAGING: ${{ inputs.staging }}

jobs:
    cura-installer-create:
        runs-on: ${{ inputs.platform }}

        steps:
            -   name: Checkout
                uses: actions/checkout@v3

            -   name: Setup Python and pip
                uses: actions/setup-python@v4
                with:
                    python-version: '3.10.x'
                    cache: 'pip'
                    cache-dependency-path: .github/workflows/requirements-conan-package.txt

            -   name: Install Python requirements for runner
                run: pip install -r https://raw.githubusercontent.com/Ultimaker/Cura/main/.github/workflows/requirements-conan-package.txt
                #  Note the runner requirements are always installed from the main branch in the Ultimaker/Cura repo

            -   name: Use Conan download cache (Bash)
                if: ${{ runner.os != 'Windows' }}
                run: conan config set storage.download_cache="$HOME/.conan/conan_download_cache"

            -   name: Use Conan download cache (Powershell)
                if: ${{ runner.os == 'Windows' }}
                run: conan config set storage.download_cache="C:\Users\runneradmin\.conan\conan_download_cache"

            -   name: Cache Conan local repository packages (Bash)
                uses: actions/cache@v3
                if: ${{ runner.os != 'Windows' }}
                with:
                    path: |
                        $HOME/.conan/data
                        $HOME/.conan/conan_download_cache
                    key: conan-${{ runner.os }}-${{ runner.arch }}-installer-cache

            -   name: Cache Conan local repository packages (Powershell)
                uses: actions/cache@v3
                if: ${{ runner.os == 'Windows' }}
                with:
                    path: |
                        C:\Users\runneradmin\.conan\data
                        C:\.conan
                        C:\Users\runneradmin\.conan\conan_download_cache
                    key: conan-${{ runner.os }}-${{ runner.arch }}-installer-cache

            -   name: Install MacOS system requirements
                if:  ${{ runner.os == 'Macos' }}
                run: brew install autoconf automake ninja create-dmg # Delete create-dmg when deprecating dmg

            -   name: Install Linux system requirements
                if: ${{ runner.os == 'Linux' }}
                run: |
                    sudo add-apt-repository ppa:ubuntu-toolchain-r/test -y
                    sudo apt update
                    sudo apt upgrade
                    sudo apt install build-essential checkinstall libegl-dev zlib1g-dev libssl-dev ninja-build autoconf libx11-dev libx11-xcb-dev libfontenc-dev libice-dev libsm-dev libxau-dev libxaw7-dev libxcomposite-dev libxcursor-dev libxdamage-dev libxdmcp-dev libxext-dev libxfixes-dev libxi-dev libxinerama-dev libxkbfile-dev libxmu-dev libxmuu-dev libxpm-dev libxrandr-dev libxrender-dev libxres-dev libxss-dev libxt-dev libxtst-dev libxv-dev libxvmc-dev libxxf86vm-dev xtrans-dev libxcb-render0-dev libxcb-render-util0-dev libxcb-xkb-dev libxcb-icccm4-dev libxcb-image0-dev libxcb-keysyms1-dev libxcb-randr0-dev libxcb-shape0-dev libxcb-sync-dev libxcb-xfixes0-dev libxcb-xinerama0-dev xkb-data libxcb-dri3-dev uuid-dev libxcb-util-dev libxkbcommon-x11-dev pkg-config -y
                    wget --no-check-certificate --quiet https://github.com/AppImage/AppImageKit/releases/download/continuous/appimagetool-x86_64.AppImage -O $GITHUB_WORKSPACE/appimagetool
                    chmod +x $GITHUB_WORKSPACE/appimagetool
                    echo "APPIMAGETOOL_LOCATION=$GITHUB_WORKSPACE/appimagetool" >> $GITHUB_ENV

            -   name: Install GCC-12 on ubuntu-22.04
                if: ${{ startsWith(inputs.platform, 'ubuntu-22.04') }}
                run: |
                    sudo apt install g++-12 gcc-12 -y
                    sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-12 12
                    sudo update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-12 12

            -   name: Use GCC-10 on ubuntu-20.04
                if: ${{ startsWith(inputs.platform, 'ubuntu-20.04') }}
                run: |
                    sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-10 10
                    sudo update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-10 10

            -   name: Create the default Conan profile
                run:  conan profile new default --detect

            -   name: Configure GPG Key Linux (Bash)
                if: ${{ runner.os == 'Linux' }}
                run: echo -n "$GPG_PRIVATE_KEY" | base64 --decode | gpg --import

            -   name: Configure Macos keychain Developer Cert(Bash)
                id: macos-keychain-developer-cert
                if: ${{ runner.os == 'Macos' }}
                uses: apple-actions/import-codesign-certs@v1
                with:
                    keychain-password: ${{ secrets.MACOS_KEYCHAIN_PASSWORD }}
                    p12-file-base64: ${{ secrets.MACOS_CERT_P12 }}
                    p12-password: ${{ secrets.MACOS_CERT_PASSPHRASE }}

            -   name: Configure Macos keychain Installer Cert (Bash)
                id: macos-keychain-installer-cert
                if: ${{ runner.os == 'Macos' }}
                uses: apple-actions/import-codesign-certs@v1
                with:
                    keychain-password: ${{ secrets.MACOS_KEYCHAIN_PASSWORD }}
                    create-keychain: false # keychain is created in previous use of action.
                    p12-file-base64: ${{ secrets.MACOS_CERT_INSTALLER_P12 }}
                    p12-password: ${{ secrets.MACOS_CERT_PASSPHRASE }}

            -   name: Create PFX certificate from BASE64_PFX_CONTENT secret
                if: ${{ runner.os == 'Windows' }}
                id: create-pfx
                env:
                    PFX_CONTENT: ${{ secrets.WIN_CERT_INSTALLER_CER }}
                run: |
                    $pfxPath = Join-Path -Path $env:RUNNER_TEMP -ChildPath "cert.pfx"; 
                    $encodedBytes = [System.Convert]::FromBase64String($env:PFX_CONTENT); 
                    Set-Content $pfxPath -Value $encodedBytes -AsByteStream;
                    echo "PFX_PATH=$pfxPath" >> $env:GITHUB_OUTPUT;

            -   name: Get Conan configuration from branch
                if: ${{ inputs.conan_config != '' }}
                run: conan config install https://github.com/Ultimaker/conan-config.git -a "-b ${{ inputs.conan_config }}"

            -   name: Get Conan configuration
                if: ${{ inputs.conan_config == '' }}
                run: conan config install https://github.com/Ultimaker/conan-config.git

            -   name: Create the Packages (Bash)
                if: ${{ runner.os != 'Windows' }}
                run: conan install $CURA_CONAN_VERSION ${{ inputs.conan_args }} --build=missing --update -if cura_inst -g VirtualPythonEnv -o cura:enterprise=$ENTERPRISE -o cura:staging=$STAGING --json "cura_inst/conan_install_info.json"

            -   name: Create the Packages (Powershell)
                if: ${{ runner.os == 'Windows' }}
                run: conan install $Env:CURA_CONAN_VERSION ${{ inputs.conan_args }} --build=missing --update -if cura_inst -g VirtualPythonEnv -o cura:enterprise=$Env:ENTERPRISE -o cura:staging=$Env:STAGING --json "cura_inst/conan_install_info.json"

            -   name: Set Environment variables for Cura (bash)
                if: ${{ runner.os != 'Windows' }}
                run: |
                    . ./cura_inst/bin/activate_github_actions_env.sh
                    . ./cura_inst/bin/activate_github_actions_version_env.sh

            -   name: Set Environment variables for Cura (Powershell)
                if: ${{ runner.os == 'Windows' }}
                run: |
                    echo "${Env:WIX}\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
                    .\cura_inst\Scripts\activate_github_actions_env.ps1
                    .\cura_inst\Scripts\activate_github_actions_version_env.ps1

            -   name: Unlock Macos keychain (Bash)
                if: ${{ runner.os == 'Macos' }}
                run: security unlock -p $TEMP_KEYCHAIN_PASSWORD signing_temp.keychain
                env:
                    TEMP_KEYCHAIN_PASSWORD: ${{  steps.macos-keychain-developer-cert.outputs.keychain-password }}

                # FIXME: This is a workaround to ensure that we use and pack a shared library for OpenSSL 1.1.1l. We currently compile
                #  OpenSSL statically for CPython, but our Python Dependenies (such as PyQt6) require a shared library.
                #  Because Conan won't allow for building the same library with two different options (easily) we need to install it explicitly
                #  and do a manual copy to the VirtualEnv, such that Pyinstaller can find it.

            -   name: Install OpenSSL shared
                run: conan install openssl/1.1.1l@_/_ --build=missing --update -o openssl:shared=True -g deploy

            -   name: Copy OpenSSL shared (Bash)
                if: ${{ runner.os != 'Windows' }}
                run: |
                    cp ./openssl/lib/*.so* ./cura_inst/bin/ || true
                    cp ./openssl/lib/*.dylib* ./cura_inst/bin/ || true                    

            -   name: Copy OpenSSL shared (Powershell)
                if: ${{ runner.os == 'Windows' }}
                run: |
                    cp openssl/bin/*.dll ./cura_inst/Scripts/
                    cp openssl/lib/*.lib ./cura_inst/Lib/

            -   name: Create the Cura dist
                run: pyinstaller ./cura_inst/UltiMaker-Cura.spec

            -   name: Output the name file name and extension
                id: filename
                shell: python
                run: |
                    import os
                    enterprise = "-Enterprise" if "${{ inputs.enterprise }}" == "true" else ""
                    installer_filename = f"UltiMaker-Cura-{os.getenv('CURA_VERSION_FULL')}{enterprise}-${{ inputs.os_name }}"
                    if "${{ runner.os }}" == "Windows":
                        installer_ext = "msi" if "${{ inputs.msi_installer }}" == "true" else "exe"
                    elif "${{ runner.os }}" == "macOS":
                        installer_ext = "pkg" if "${{ inputs.msi_installer }}" == "true" else "dmg"
                    else:
                        installer_ext = "AppImage"
                    output_env = os.environ["GITHUB_OUTPUT"]
                    content = ""
                    if os.path.exists(output_env):
                        with open(output_env, "r") as f:
                            content = f.read()
                    with open(output_env, "w") as f:
                        f.write(content)
                        f.writelines(f"INSTALLER_FILENAME={installer_filename}\n")
                        f.writelines(f"INSTALLER_EXT={installer_ext}\n")
                        f.writelines(f"FULL_INSTALLER_FILENAME={installer_filename}.{installer_ext}\n")

            -   name: Archive the artifacts (bash)
                if: ${{ !inputs.installer && runner.os != 'Windows' }}
                run: tar -zcf "./${{ steps.filename.outputs.INSTALLER_FILENAME }}.tar.gz" "./UltiMaker-Cura/"
                working-directory: dist

            -   name: Archive the artifacts (Powershell)
                if: ${{ !inputs.installer && runner.os == 'Windows' }}
                run: Compress-Archive -Path ".\UltiMaker-Cura" -DestinationPath ".\${{ steps.filename.outputs.INSTALLER_FILENAME }}.zip"
                working-directory: dist

            -   name: Create the Windows exe installer (Powershell)
                if: ${{ inputs.installer && runner.os == 'Windows' && !inputs.msi_installer }}
                run: |
                    python ..\cura_inst\packaging\NSIS\create_windows_installer.py ../cura_inst . "${{ steps.filename.outputs.FULL_INSTALLER_FILENAME }}"
                working-directory: dist

            -   name: Create the Windows msi installer (Powershell)
                if: ${{ inputs.installer && runner.os == 'Windows' && inputs.msi_installer }}
                run: |
                    python ..\cura_inst\packaging\msi\create_windows_msi.py ..\cura_inst .\UltiMaker-Cura "${{ steps.filename.outputs.FULL_INSTALLER_FILENAME }}" "$Env:CURA_APP_NAME"
                working-directory: dist

            -   name: Sign the Windows exe installer (Powershell)
                if: ${{ inputs.installer && runner.os == 'Windows' && !inputs.msi_installer }}
                env:
                    PFX_PATH: ${{ steps.create-pfx.outputs.PFX_PATH }}
                run: |
                    & "C:/Program Files (x86)/Windows Kits/10/bin/10.0.17763.0/x86/signtool.exe" sign /f $Env:PFX_PATH /p "$Env:WIN_CERT_INSTALLER_CER_PASS" /fd SHA256 /t http://timestamp.digicert.com "${{ steps.filename.outputs.FULL_INSTALLER_FILENAME }}"
                working-directory: dist

            -   name: Sign the Windows msi installer (Powershell)
                if: ${{ inputs.installer && runner.os == 'Windows' && inputs.msi_installer }}
                env:
                    PFX_PATH: ${{ steps.create-pfx.outputs.PFX_PATH }}
                run: |
                    & "C:/Program Files (x86)/Windows Kits/10/bin/10.0.17763.0/x86/signtool.exe" sign /f $Env:PFX_PATH /p "$Env:WIN_CERT_INSTALLER_CER_PASS" /fd SHA256 /t http://timestamp.digicert.com "${{ steps.filename.outputs.FULL_INSTALLER_FILENAME }}"
                working-directory: dist

            -   name: Create the Linux AppImage (Bash)
                if: ${{ inputs.installer && runner.os == 'Linux' }}
                run: python ../cura_inst/packaging/AppImage/create_appimage.py ./UltiMaker-Cura $CURA_VERSION_FULL "${{ steps.filename.outputs.FULL_INSTALLER_FILENAME }}"
                working-directory: dist

            -   name: Create the MacOS dmg and/or pkg (Bash)
                if: ${{ github.event.inputs.installer == 'true' && runner.os == 'Macos' }}
                run: python ../cura_inst/packaging/MacOS/build_macos.py ../cura_inst . $CURA_CONAN_VERSION "${{ steps.filename.outputs.FULL_INSTALLER_FILENAME }}" "$CURA_APP_NAME"
                working-directory: dist

            -   name: Upload the artifacts
                uses: actions/upload-artifact@v3
                with:
                    name: ${{ steps.filename.outputs.INSTALLER_FILENAME }}-${{ steps.filename.outputs.INSTALLER_EXT }}
                    path: |
                        dist/*.tar.gz
                        dist/*.zip
                        dist/${{ steps.filename.outputs.FULL_INSTALLER_FILENAME }}
                        dist/*.asc
                    retention-days: 5

    notify-export:
        if: ${{ always() }}
        needs: [ cura-installer-create ]

        uses: ultimaker/cura/.github/workflows/notify.yml@main
        with:
            success: ${{ contains(join(needs.*.result, ','), 'success') }}
            success_title: "Create the Cura distributions"
            success_body: "Installers for ${{ inputs.cura_conan_version }}"
            failure_title: "Failed to create the Cura distributions"
            failure_body: "Failed to create at least 1 installer for ${{ inputs.cura_conan_version }}"
        secrets: inherit