Add CI

Author: ThomasNieto

.github/workflows/ci.yml

@@ -0,0 +1,91 @@
+name: CI
+
+defaults:
+  run:
+    shell: pwsh
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  release:
+    types: [ published ]
+
+jobs:
+  Build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v3
+      - name: Upload module
+        uses: actions/upload-artifact@v3
+        with:
+          name: module
+          path: ./src/
+  Test:
+    needs: Build
+    runs-on: windows-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v3
+      - name: Download module
+        uses: actions/download-artifact@v3
+        with:
+          name: module
+          path: C:\Users\runneradmin\Documents\PowerShell\Modules\LockFile\
+      - name: Test with Pester
+        run: |
+          $ht = Import-PowerShellDataFile PesterSettings.psd1
+          $config = New-PesterConfiguration $ht
+          Invoke-Pester -Configuration $config
+  Sign:
+    needs: Test
+    if: github.event_name == 'release' && github.event.action == 'published'
+    runs-on: windows-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v3
+      - name: Import certificate
+        env:
+          CERTIFICATE_BASE64: ${{ secrets.CERTIFICATE_BASE64 }}
+          CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}
+          CERTIFICATE_PASSWORD_KEY_BASE64: ${{ secrets.CERTIFICATE_PASSWORD_KEY_BASE64 }}
+        run: |
+          [convert]::FromBase64String($env:CERTIFICATE_BASE64) | Set-Content -Path cert.pfx -AsByteStream
+          $key = [convert]::FromBase64String($env:CERTIFICATE_PASSWORD_KEY_BASE64)
+          $password = ConvertTo-SecureString $env:CERTIFICATE_PASSWORD -Key $key
+          Import-PfxCertificate cert.pfx -Password $password -CertStoreLocation Cert:\CurrentUser\My
+      - name: Sign files
+        run: |
+          $config = Import-PowerShellDataFile SignSettings.psd1
+          $config['Certificate'] = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert
+          Set-Location .\src
+          Set-AuthenticodeSignature @config
+      - name: Create and sign catalog file
+        run: |
+          $config = Import-PowerShellDataFile SignSettings.psd1
+          $config['FilePath'] = 'LockFile.cat'
+          $config['Certificate'] = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert
+          Set-Location .\src
+          New-FileCatalog LockFile.cat -CatalogVersion 2
+          Set-AuthenticodeSignature @config
+      - name: Upload module
+        uses: actions/upload-artifact@v3
+        with:
+          name: module-signed
+          path: ./src/
+  Publish:
+    needs: Sign
+    if: github.event_name == 'release' && github.event.action == 'published'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download module
+        uses: actions/download-artifact@v3
+        with:
+          name: module-signed
+          path: '~/.local/share/powershell/Modules/LockFile'
+      - name: Publish Module
+        env:
+          NUGET_KEY: ${{ secrets.NUGET_KEY }}
+        run: Publish-Module -Name LockFile -NuGetApiKey $env:NUGET_KEY

.github/workflows/lint-powershell.yml

@@ -0,0 +1,34 @@
+name: PSScriptAnalyzer
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '22 1 * * 3'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    permissions:
+      contents: read
+      security-events: write
+    name: PSScriptAnalyzer
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Run PSScriptAnalyzer
+        uses: microsoft/[email protected]
+        with:
+          path: .\
+          recurse: true
+          output: results.sarif
+
+      - name: Upload SARIF results file
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: results.sarif

PSScriptAnalyzerSettings.psd1

@@ -0,0 +1,6 @@
+@{
+    ExcludeRules = @(
+        'PSAvoidUsingInvokeExpression',
+        'PSAvoidUsingPositionalParameters'
+    )
+}

PesterSettings.psd1

@@ -0,0 +1,8 @@
+@{
+    Run    = @{
+        Exit = $true
+    }
+    Output = @{
+        Verbosity = 'Detailed'
+    }
+}

SignSettings.psd1

@@ -0,0 +1,5 @@
+@{
+    FilePath = @('LockFile.psd1', 'LockFile.psm1')
+    TimeStampServer = 'http://timestamp.sectigo.com'
+    HashAlgorithm = 'SHA256'
+}