add windows support and sdk distribution support#21
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| include: | ||
| - os: ubuntu-latest | ||
| name: linux-x86_64 | ||
| generator: Ninja | ||
| - os: windows-latest | ||
| name: windows-x86_64 | ||
| generator: "Visual Studio 17 2022" | ||
| - os: macos-latest | ||
| name: macos-arm64 | ||
| generator: Ninja | ||
| macos_arch: "arm64" | ||
| # optionally add x86_64 mac build if you need it: | ||
| # - os: macos-latest | ||
| # name: macos-x86_64 | ||
| # generator: Ninja | ||
| # macos_arch: "x86_64" | ||
|
|
||
| name: Build (${{ matrix.name }}) | ||
| runs-on: ${{ matrix.os }} | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| submodules: true | ||
|
|
||
| - name: Install Rust toolchain | ||
| uses: dtolnay/rust-toolchain@stable | ||
|
|
||
| - name: Install Protoc | ||
| uses: arduino/setup-protoc@v2 | ||
| with: | ||
| version: "25.2" | ||
| repo-token: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Install deps (Ubuntu) | ||
| if: startsWith(matrix.os, 'ubuntu') | ||
| run: | | ||
| sudo apt-get update | ||
| sudo apt-get install -y ninja-build cmake pkg-config libprotobuf-dev libssl-dev | ||
|
|
||
| - name: Install deps (macOS) | ||
| if: startsWith(matrix.os, 'macos') | ||
| run: | | ||
| brew update | ||
| brew install ninja cmake protobuf openssl abseil | ||
|
|
||
| - name: Install deps (Windows) | ||
| if: startsWith(matrix.os, 'windows') | ||
| shell: pwsh | ||
| run: | | ||
| choco install ninja cmake -y | ||
|
|
||
| - name: Build + bundle | ||
| shell: bash | ||
| run: | | ||
| chmod +x ./build.sh | ||
| args=(release -G "${{ matrix.generator }}" \ | ||
| --version "${{ steps.ver.outputs.version }}" \ | ||
| --bundle --prefix "sdk-out/livekit-sdk-${{ matrix.name }}") | ||
| if [[ "${{ runner.os }}" == "macOS" && -n "${{ matrix.macos_arch }}" ]]; then | ||
| args+=(--macos-arch "${{ matrix.macos_arch }}") | ||
| fi | ||
| ./build.sh "${args[@]}" | ||
|
|
||
| - name: Archive (Unix) | ||
| if: ${{ !startsWith(matrix.os, 'windows') }} | ||
| shell: bash | ||
| run: | | ||
| tar -czf "livekit-sdk-${{ matrix.name }}.tar.gz" -C sdk-out "livekit-sdk-${{ matrix.name }}" | ||
|
|
||
| - name: Archive (Windows) | ||
| if: startsWith(matrix.os, 'windows') | ||
| shell: pwsh | ||
| run: | | ||
| Compress-Archive -Path "sdk-out/livekit-sdk-${{ matrix.name }}/*" -DestinationPath "livekit-sdk-${{ matrix.name }}.zip" | ||
|
|
||
| - name: Upload build artifact | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: sdk-builds-${{ matrix.name }} | ||
| path: | | ||
| livekit-sdk-${{ matrix.name }}.tar.gz | ||
| livekit-sdk-${{ matrix.name }}.zip | ||
|
|
||
| release: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 months ago
In general, the problem is fixed by explicitly defining a permissions: block so that the GITHUB_TOKEN is granted only the scopes needed by the workflow/job. For this workflow, the build job needs only read access to the repository contents (for actions/checkout and any token-based access used by other actions), while the release job already declares contents: write because it creates and uploads a GitHub Release.
The least intrusive fix that preserves existing behavior is to add a top-level permissions: block after the on: section, setting contents: read. This establishes a minimal default for all jobs. The release job already overrides this with its own permissions: block, so it will remain unchanged. No other functionality, steps, or actions need to be modified.
Concretely:
- Edit
.github/workflows/make-release.yml. - After the
on:block (after line 13 in the snippet), add:
permissions:
contents: read- Leave the
releasejob’s existingpermissions:block as-is, since it correctly grantscontents: writefor release creation and uploading assets.
No new imports, methods, or additional definitions are required.
| @@ -11,6 +11,9 @@ | ||
| required: false | ||
| type: string | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| env: | ||
| BUILD_TYPE: Release | ||
| TAG_NAME: ${{ inputs.tag || github.ref_name }} |
xianshijing-lk
deleted the
sxian/CLT-2385/CLT-2386/add_windows_support_and_sdk_dist
branch
2 participants
No description provided.