From b29bd27475e9771c18443c8bb945eb4243205a1a Mon Sep 17 00:00:00 2001
From: Johannes Schindelin <johannes.schindelin@gmx.de>
Date: Fri, 10 Apr 2020 23:39:40 +0200
Subject: [PATCH 01/11] Add a GitHub workflow to generate Git for Windows'
 Pacman package

Git for Windows uses MSYS2 as base system, and therefore the Git
binaries are bundled as Pacman package.

This workflow allows building the 64-bit version of this package (which
is called `mingw-w64-x86_64-git`).

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
---
 .github/workflows/git-artifacts.yml | 141 ++++++++++++++++++++++++++++
 1 file changed, 141 insertions(+)
 create mode 100644 .github/workflows/git-artifacts.yml

diff --git a/.github/workflows/git-artifacts.yml b/.github/workflows/git-artifacts.yml
new file mode 100644
index 00000000000000..14af08ad95ed12
--- /dev/null
+++ b/.github/workflows/git-artifacts.yml
@@ -0,0 +1,141 @@
+name: mingw-w64-x86_64-git
+
+on:
+  # This workflow can be triggered manually in the Actions tab, see
+  # https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/
+  - workflow_dispatch
+
+env:
+  HOME: "${{github.workspace}}\\home"
+  MSYSTEM: MINGW64
+  USERPROFILE: "${{github.workspace}}\\home"
+
+jobs:
+  bundle-artifacts:
+    runs-on: windows-latest
+    steps:
+      - name: Configure user
+        shell: bash
+        run:
+          USER_NAME="${{github.actor}}" &&
+          USER_EMAIL="${{github.actor}}@users.noreply.github.com" &&
+          mkdir "$HOME" &&
+          git config --global user.name "$USER_NAME" &&
+          git config --global user.email "$USER_EMAIL" &&
+          echo "PACKAGER=$USER_NAME <$USER_EMAIL>" >>$GITHUB_ENV
+      - name: Download git-sdk-64-build-installers
+        shell: bash
+        run: |
+          # Use Git Bash to download and unpack the artifact
+
+          ## Get artifact
+          urlbase=https://dev.azure.com/git-for-windows/git/_apis/build/builds
+          id=$(curl "$urlbase?definitions=29&statusFilter=completed&resultFilter=succeeded&\$top=1" |
+            jq -r '.value[0].id')
+          download_url=$(curl "$urlbase/$id/artifacts" |
+            jq -r '.value[] | select(.name == "git-sdk-64-build-installers").resource.downloadUrl')
+
+          curl -o artifacts.zip "$download_url"
+
+          ## Unpack artifact
+          unzip artifacts.zip
+      - name: Clone build-extra
+        shell: bash
+        run: |
+          d=git-sdk-64-build-installers/usr/src/build-extra &&
+          git clone --single-branch -b main https://github.com/git-for-windows/build-extra $d
+      - name: Generate bundle artifacts
+        shell: powershell
+        run: |
+          & .\git-sdk-64-build-installers\git-cmd.exe --command=usr\bin\bash.exe -lc @"
+            printf '#!/bin/sh\n\nexec /mingw64/bin/git.exe "`$@"\n' >/usr/bin/git &&
+            mkdir -p bundle-artifacts &&
+
+            git -c init.defaultBranch=main init --bare &&
+            git remote add -f origin https://github.com/git-for-windows/git &&
+            git fetch https://github.com/${{github.repository}} ${{github.ref}}:${{github.ref}} &&
+
+            tag_name=\"`$(git describe --match 'v[0-9]*' FETCH_HEAD)-`$(date +%Y%m%d%H%M%S)\" &&
+            echo \"prerelease-`${tag_name#v}\" >bundle-artifacts/ver &&
+            echo \"`${tag_name#v}\" >bundle-artifacts/display_version &&
+            echo \"`$tag_name\" >bundle-artifacts/next_version &&
+            git tag -m \"Snapshot build\" \"`$tag_name\" FETCH_HEAD &&
+            git bundle create bundle-artifacts/git.bundle origin/main..\"`$tag_name\" &&
+
+            sh -x /usr/src/build-extra/please.sh mention feature \"Snapshot of `$(git show -s  --pretty='tformat:%h (%s, %ad)' --date=short FETCH_HEAD)\" &&
+            git -C /usr/src/build-extra bundle create \"`$PWD/bundle-artifacts/build-extra.bundle\" origin/main..main
+          "@
+      - name: 'Publish Pipeline Artifact: bundle-artifacts'
+        uses: actions/upload-artifact@v1
+        with:
+          name: bundle-artifacts
+          path: bundle-artifacts
+  pkg-x86_64:
+    runs-on: windows-latest
+    needs: bundle-artifacts
+    steps:
+      - name: Configure user
+        shell: bash
+        run:
+          USER_NAME="${{github.actor}}" &&
+          USER_EMAIL="${{github.actor}}@users.noreply.github.com" &&
+          mkdir "$HOME" &&
+          git config --global user.name "$USER_NAME" &&
+          git config --global user.email "$USER_EMAIL" &&
+          echo "PACKAGER=$USER_NAME <$USER_EMAIL>" >>$GITHUB_ENV
+      - name: Download git-sdk-64-makepkg-git
+        shell: bash
+        run: |
+          # Use Git Bash to download and unpack the artifact
+
+          ## Get artifact
+          urlbase=https://dev.azure.com/git-for-windows/git/_apis/build/builds
+          id=${{ needs.bundle-artifacts.outputs.latest-sdk64-extra-build-id }}
+          download_url="$(curl "$urlbase/$id/artifacts" |
+            jq -r '.value[] | select(.name == "git-sdk-64-makepkg-git").resource.downloadUrl')"
+
+          curl -o artifacts.zip "$download_url"
+
+          ## Unpack artifact
+          unzip artifacts.zip
+      - name: Download bundle-artifacts
+        uses: actions/download-artifact@v1
+        with:
+          name: bundle-artifacts
+          path: bundle-artifacts
+      - name: Clone and update build-extra
+        shell: bash
+        run: |
+          d=git-sdk-64-makepkg-git/usr/src/build-extra &&
+          git clone --single-branch -b main https://github.com/git-for-windows/build-extra $d &&
+          git -C $d pull "$PWD"/bundle-artifacts/build-extra.bundle main
+      - name: Check out git/git
+        shell: bash
+        run: |
+          git -c init.defaultBranch=main init &&
+          git remote add -f origin https://github.com/git-for-windows/git &&
+          git fetch --tags bundle-artifacts/git.bundle $(cat bundle-artifacts/next_version) &&
+          git reset --hard $(cat bundle-artifacts/next_version)
+      - name: Build mingw-w64-x86_64-git
+        shell: powershell
+        run: |
+          & git-sdk-64-makepkg-git\usr\bin\sh.exe -lc @"
+            set -x
+            # Let `cv2pdb` find the DLLs
+            PATH=\"`$PATH:/C/Program Files (x86)/Microsoft Visual Studio 14.0/VC/bin/amd64\"
+            type -p mspdb140.dll || exit 1
+            sh -x /usr/src/build-extra/please.sh build-mingw-w64-git --only-64-bit --build-src-pkg -o artifacts HEAD &&
+            cp bundle-artifacts/ver artifacts/ &&
+
+            b=`$PWD/artifacts &&
+            version=`$(cat bundle-artifacts/next_version) &&
+            (cd /usr/src/MINGW-packages/mingw-w64-git &&
+            cp PKGBUILD.`$version PKGBUILD &&
+            git commit -s -m \"mingw-w64-git: new version (`$version)\" PKGBUILD &&
+            git bundle create \"`$b\"/MINGW-packages.bundle origin/main..main)
+          "@
+      - name: Publish mingw-w64-x86_64-git
+        uses: actions/upload-artifact@v1
+        with:
+          name: pkg-x86_64
+          path: artifacts

From 19450c3d50619ac729798c61bbdc22ba0a3e4c00 Mon Sep 17 00:00:00 2001
From: Johannes Schindelin <johannes.schindelin@gmx.de>
Date: Sun, 12 Apr 2020 00:24:49 +0200
Subject: [PATCH 02/11] git-artifacts: if GPG secrets are available, use them

This expects the `GPGKEY` and `PRIVGPGKEY` secrets to be set in the
respective GitHub repository.

The `GPGKEY` value should be of the form

	<short-key> --passphrase <pass> --yes --batch --no-tty --pinentry-mode loopback --digest-algo SHA256

and the `PRIVGPGKEY` should be generated via

	gpg --export-secret-keys | base64 | tr '\n' %

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
---
 .github/workflows/git-artifacts.yml | 44 ++++++++++++++++++++++++++++-
 1 file changed, 43 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/git-artifacts.yml b/.github/workflows/git-artifacts.yml
index 14af08ad95ed12..7272b082216fbb 100644
--- a/.github/workflows/git-artifacts.yml
+++ b/.github/workflows/git-artifacts.yml
@@ -6,6 +6,7 @@ on:
   - workflow_dispatch
 
 env:
+  GPG_OPTIONS: "--batch --yes --no-tty --list-options no-show-photos --verify-options no-show-photos --pinentry-mode loopback"
   HOME: "${{github.workspace}}\\home"
   MSYSTEM: MINGW64
   USERPROFILE: "${{github.workspace}}\\home"
@@ -44,7 +45,21 @@ jobs:
         run: |
           d=git-sdk-64-build-installers/usr/src/build-extra &&
           git clone --single-branch -b main https://github.com/git-for-windows/build-extra $d
+      - name: Prepare home directory for GPG signing
+        if: env.GPGKEY != ''
+        shell: bash
+        run: |
+          echo '${{secrets.PRIVGPGKEY}}' | tr % '\n' | gpg $GPG_OPTIONS --import &&
+          mkdir -p home &&
+          git config --global gpg.program "$PWD/git-sdk-64-build-installers/usr/src/build-extra/gnupg-with-gpgkey.sh" &&
+          info="$(gpg --list-keys --with-colons "${GPGKEY%% *}" | cut -d : -f 1,10 | sed -n '/^uid/{s|uid:||p;q}')" &&
+          git config --global user.name "${info% <*}" &&
+          git config --global user.email "<${info#*<}"
+        env:
+          GPGKEY: ${{secrets.GPGKEY}}
       - name: Generate bundle artifacts
+        env:
+          GPGKEY: ${{secrets.GPGKEY}}
         shell: powershell
         run: |
           & .\git-sdk-64-build-installers\git-cmd.exe --command=usr\bin\bash.exe -lc @"
@@ -59,12 +74,16 @@ jobs:
             echo \"prerelease-`${tag_name#v}\" >bundle-artifacts/ver &&
             echo \"`${tag_name#v}\" >bundle-artifacts/display_version &&
             echo \"`$tag_name\" >bundle-artifacts/next_version &&
-            git tag -m \"Snapshot build\" \"`$tag_name\" FETCH_HEAD &&
+            git tag `$(test -z \"`$GPGKEY\" || echo \" -s\") -m \"Snapshot build\" \"`$tag_name\" FETCH_HEAD &&
             git bundle create bundle-artifacts/git.bundle origin/main..\"`$tag_name\" &&
 
             sh -x /usr/src/build-extra/please.sh mention feature \"Snapshot of `$(git show -s  --pretty='tformat:%h (%s, %ad)' --date=short FETCH_HEAD)\" &&
             git -C /usr/src/build-extra bundle create \"`$PWD/bundle-artifacts/build-extra.bundle\" origin/main..main
           "@
+      - name: Clean up temporary files
+        if: always()
+        shell: bash
+        run: rm -rf home
       - name: 'Publish Pipeline Artifact: bundle-artifacts'
         uses: actions/upload-artifact@v1
         with:
@@ -116,7 +135,19 @@ jobs:
           git remote add -f origin https://github.com/git-for-windows/git &&
           git fetch --tags bundle-artifacts/git.bundle $(cat bundle-artifacts/next_version) &&
           git reset --hard $(cat bundle-artifacts/next_version)
+      - name: Prepare home directory for GPG signing
+        if: env.GPGKEY != ''
+        shell: bash
+        run: |
+          echo '${{secrets.PRIVGPGKEY}}' | tr % '\n' | gpg $GPG_OPTIONS --import &&
+          info="$(gpg --list-keys --with-colons "${GPGKEY%% *}" | cut -d : -f 1,10 | sed -n '/^uid/{s|uid:||p;q}')" &&
+          git config --global user.name "${info% <*}" &&
+          git config --global user.email "<${info#*<}"
+        env:
+          GPGKEY: ${{secrets.GPGKEY}}
       - name: Build mingw-w64-x86_64-git
+        env:
+          GPGKEY: "${{secrets.GPGKEY}}"
         shell: powershell
         run: |
           & git-sdk-64-makepkg-git\usr\bin\sh.exe -lc @"
@@ -126,6 +157,13 @@ jobs:
             type -p mspdb140.dll || exit 1
             sh -x /usr/src/build-extra/please.sh build-mingw-w64-git --only-64-bit --build-src-pkg -o artifacts HEAD &&
             cp bundle-artifacts/ver artifacts/ &&
+            if test -n \"`$GPGKEY\"
+            then
+              for tar in artifacts/*.tar*
+              do
+                /usr/src/build-extra/gnupg-with-gpgkey.sh --detach-sign --no-armor `$tar
+              done
+            fi &&
 
             b=`$PWD/artifacts &&
             version=`$(cat bundle-artifacts/next_version) &&
@@ -134,6 +172,10 @@ jobs:
             git commit -s -m \"mingw-w64-git: new version (`$version)\" PKGBUILD &&
             git bundle create \"`$b\"/MINGW-packages.bundle origin/main..main)
           "@
+      - name: Clean up temporary files
+        if: always()
+        shell: bash
+        run: rm -rf home
       - name: Publish mingw-w64-x86_64-git
         uses: actions/upload-artifact@v1
         with:

From b63840218e3b2ed2f27c66be5bb31105e586c2d7 Mon Sep 17 00:00:00 2001
From: Johannes Schindelin <johannes.schindelin@gmx.de>
Date: Sun, 12 Apr 2020 00:34:56 +0200
Subject: [PATCH 03/11] git-artifacts: also code-sign, if configured via the
 secrets

When the secrets `CODESIGN_P12` and `CODESIGN_PASS` are set, the
workflow will now code-sign the `.exe` files contained in the package.

This should help with a few anti-malware programs, at least when the
certificate saw some action and gained trust.

Note: `CODESIGN_P12` needs to be generated via

	cat <certificate>.p12 | base64 | tr '\n' %

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
---
 .github/workflows/git-artifacts.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.github/workflows/git-artifacts.yml b/.github/workflows/git-artifacts.yml
index 7272b082216fbb..7e86de31ac927e 100644
--- a/.github/workflows/git-artifacts.yml
+++ b/.github/workflows/git-artifacts.yml
@@ -135,6 +135,18 @@ jobs:
           git remote add -f origin https://github.com/git-for-windows/git &&
           git fetch --tags bundle-artifacts/git.bundle $(cat bundle-artifacts/next_version) &&
           git reset --hard $(cat bundle-artifacts/next_version)
+      - name: Prepare home directory for code-signing
+        env:
+          CODESIGN_P12: ${{secrets.CODESIGN_P12}}
+          CODESIGN_PASS: ${{secrets.CODESIGN_PASS}}
+        if: env.CODESIGN_P12 != '' && env.CODESIGN_PASS != ''
+        shell: bash
+        run: |
+          cd home &&
+          mkdir -p .sig &&
+          echo -n "$CODESIGN_P12" | tr % '\n' | base64 -d >.sig/codesign.p12 &&
+          echo -n "$CODESIGN_PASS" >.sig/codesign.pass
+          git config --global alias.signtool '!sh "/usr/src/build-extra/signtool.sh"'
       - name: Prepare home directory for GPG signing
         if: env.GPGKEY != ''
         shell: bash

From 79dff75fc8a8b023ace9bec1c764042927c296ad Mon Sep 17 00:00:00 2001
From: Johannes Schindelin <johannes.schindelin@gmx.de>
Date: Sun, 12 Apr 2020 00:43:19 +0200
Subject: [PATCH 04/11] git-artifacts: also build the installer

While at it, we might just as well build the Git for Windows installer
;-)

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
---
 .github/workflows/git-artifacts.yml | 75 ++++++++++++++++++++++++++++-
 1 file changed, 74 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/git-artifacts.yml b/.github/workflows/git-artifacts.yml
index 7e86de31ac927e..2b23485acce880 100644
--- a/.github/workflows/git-artifacts.yml
+++ b/.github/workflows/git-artifacts.yml
@@ -1,4 +1,4 @@
-name: mingw-w64-x86_64-git
+name: git-artifacts
 
 on:
   # This workflow can be triggered manually in the Actions tab, see
@@ -193,3 +193,76 @@ jobs:
         with:
           name: pkg-x86_64
           path: artifacts
+  installer-x86_64:
+    runs-on: windows-latest
+    needs: pkg-x86_64
+    env:
+      MSYSTEM: MINGW64
+    steps:
+      - name: Download pkg-x86_64
+        uses: actions/download-artifact@v1
+        with:
+          name: pkg-x86_64
+          path: pkg-x86_64
+      - name: Download bundle-artifacts
+        uses: actions/download-artifact@v1
+        with:
+          name: bundle-artifacts
+          path: bundle-artifacts
+      - name: Download git-sdk-64-build-installers
+        shell: bash
+        run: |
+          # Use Git Bash to download and unpack the artifact
+
+          ## Get artifact
+          urlbase=https://dev.azure.com/git-for-windows/git/_apis/build/builds
+          id=${{ needs.pkg.outputs.latest-sdk64-extra-build-id }}
+          download_url="$(curl "$urlbase/$id/artifacts" |
+            jq -r '.value[] | select(.name == "git-sdk-64-build-installers").resource.downloadUrl')"
+
+          curl -o artifacts.zip "$download_url"
+
+          ## Unpack artifact
+          unzip artifacts.zip
+      - name: Clone and update build-extra
+        shell: bash
+        run: |
+          d=git-sdk-64-build-installers/usr/src/build-extra &&
+          git clone --single-branch -b main https://github.com/git-for-windows/build-extra $d &&
+          git -C $d pull "$PWD"/bundle-artifacts/build-extra.bundle main
+      - name: Prepare home directory for code-signing
+        env:
+          CODESIGN_P12: ${{secrets.CODESIGN_P12}}
+          CODESIGN_PASS: ${{secrets.CODESIGN_PASS}}
+        if: (matrix.artifact.name == 'installer' || matrix.artifact.name == 'portable') && env.CODESIGN_P12 != '' && env.CODESIGN_PASS != ''
+        shell: bash
+        run: |
+          mkdir -p home/.sig &&
+          echo -n "$CODESIGN_P12" | tr % '\n' | base64 -d >home/.sig/codesign.p12 &&
+          echo -n "$CODESIGN_PASS" >home/.sig/codesign.pass &&
+          git config --global alias.signtool '!sh "/usr/src/build-extra/signtool.sh"'
+      - name: Build 64-bit installer
+        shell: powershell
+        run: |
+          & .\git-sdk-64-build-installers\usr\bin\bash.exe -lc @"
+            set -x
+            /usr/src/build-extra/please.sh make_installers_from_mingw_w64_git --version=`$(cat pkg-x86_64/ver) -o artifacts --installer --pkg=pkg-x86_64/mingw-w64-x86_64-git-[0-9]*.tar.xz --pkg=pkg-x86_64/mingw-w64-x86_64-git-doc-html-[0-9]*.tar.xz &&
+            openssl dgst -sha256 artifacts/Git-*.exe | sed \"s/.* //\" >artifacts/sha-256.txt &&
+            cp /usr/src/build-extra/installer/package-versions.txt artifacts/ &&
+
+            a=`$PWD/artifacts &&
+            p=`$PWD/pkg-x86_64 &&
+            (cd /usr/src/build-extra &&
+            mkdir -p cached-source-packages &&
+            cp \"`$p\"/*-pdb* cached-source-packages/ &&
+            GIT_CONFIG_PARAMETERS=\"'windows.sdk64.path='\" ./please.sh bundle_pdbs --arch=x86_64 --directory=\"`$a\" installer/package-versions.txt)
+          "@
+      - name: Clean up temporary files
+        if: always()
+        shell: bash
+        run: rm -rf home
+      - name: Publish installer-x86_64
+        uses: actions/upload-artifact@v1
+        with:
+          name: installer-x86_64
+          path: artifacts

From e596d75ca4037e5cced5454d2a96ced44a0d02ea Mon Sep 17 00:00:00 2001
From: Johannes Schindelin <johannes.schindelin@gmx.de>
Date: Sun, 12 Apr 2020 00:51:00 +0200
Subject: [PATCH 05/11] git-artifacts: also build portable, mingit and
 mingit-busybox

... because we can.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
---
 .github/workflows/git-artifacts.yml | 43 ++++++++++++++++++++++++-----
 1 file changed, 36 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/git-artifacts.yml b/.github/workflows/git-artifacts.yml
index 2b23485acce880..8868ad86bb3e99 100644
--- a/.github/workflows/git-artifacts.yml
+++ b/.github/workflows/git-artifacts.yml
@@ -193,9 +193,28 @@ jobs:
         with:
           name: pkg-x86_64
           path: artifacts
-  installer-x86_64:
+  artifacts:
     runs-on: windows-latest
-    needs: pkg-x86_64
+    needs: pkg
+    strategy:
+      matrix:
+        artifact:
+          - name: installer
+            fileprefix: Git
+            fileextension: exe
+          - name: portable
+            fileprefix: PortableGit
+            fileextension: exe
+          - name: archive
+            fileprefix: Git
+            fileextension: tar.bz2
+          - name: mingit
+            fileprefix: MinGit
+            fileextension: zip
+          - name: mingit-busybox
+            fileprefix: MinGit
+            fileextension: zip
+      fail-fast: false
     env:
       MSYSTEM: MINGW64
     steps:
@@ -241,13 +260,23 @@ jobs:
           echo -n "$CODESIGN_P12" | tr % '\n' | base64 -d >home/.sig/codesign.p12 &&
           echo -n "$CODESIGN_PASS" >home/.sig/codesign.pass &&
           git config --global alias.signtool '!sh "/usr/src/build-extra/signtool.sh"'
-      - name: Build 64-bit installer
+      - name: Build 64-bit ${{matrix.artifact.name}}
         shell: powershell
         run: |
           & .\git-sdk-64-build-installers\usr\bin\bash.exe -lc @"
             set -x
-            /usr/src/build-extra/please.sh make_installers_from_mingw_w64_git --version=`$(cat pkg-x86_64/ver) -o artifacts --installer --pkg=pkg-x86_64/mingw-w64-x86_64-git-[0-9]*.tar.xz --pkg=pkg-x86_64/mingw-w64-x86_64-git-doc-html-[0-9]*.tar.xz &&
-            openssl dgst -sha256 artifacts/Git-*.exe | sed \"s/.* //\" >artifacts/sha-256.txt &&
+            /usr/src/build-extra/please.sh make_installers_from_mingw_w64_git --version=`$(cat pkg-x86_64/ver) -o artifacts --${{matrix.artifact.name}} --pkg=pkg-x86_64/mingw-w64-x86_64-git-[0-9]*.tar.xz --pkg=pkg-x86_64/mingw-w64-x86_64-git-doc-html-[0-9]*.tar.xz &&
+            if test portable = '${{matrix.artifact.name}}' && test -n \"`$(git config alias.signtool)\"
+            then
+              git signtool artifacts/PortableGit-*.exe
+            fi &&
+            openssl dgst -sha256 artifacts/${{matrix.artifact.fileprefix}}-*.${{matrix.artifact.fileextension}} | sed \"s/.* //\" >artifacts/sha-256.txt
+          "@
+      - name: Copy package-versions and pdbs
+        if: matrix.artifact.name == 'installer'
+        shell: powershell
+        run: |
+          & .\git-sdk-64-build-installers\usr\bin\bash.exe -lc @"
             cp /usr/src/build-extra/installer/package-versions.txt artifacts/ &&
 
             a=`$PWD/artifacts &&
@@ -261,8 +290,8 @@ jobs:
         if: always()
         shell: bash
         run: rm -rf home
-      - name: Publish installer-x86_64
+      - name: Publish ${{matrix.artifact.name}}-x86_64
         uses: actions/upload-artifact@v1
         with:
-          name: installer-x86_64
+          name: ${{matrix.artifact.name}}-x86_64
           path: artifacts

From acac55c798a753d898fb3ad7a3d04405c5fde4d9 Mon Sep 17 00:00:00 2001
From: Johannes Schindelin <johannes.schindelin@gmx.de>
Date: Sun, 12 Apr 2020 00:57:23 +0200
Subject: [PATCH 06/11] git-artifacts: also build 32-bit versions

Just in case that we need to generate those real quick.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
---
 .github/workflows/git-artifacts.yml | 70 +++++++++++++++++++++--------
 1 file changed, 51 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/git-artifacts.yml b/.github/workflows/git-artifacts.yml
index 8868ad86bb3e99..dee6feeb672de5 100644
--- a/.github/workflows/git-artifacts.yml
+++ b/.github/workflows/git-artifacts.yml
@@ -89,9 +89,18 @@ jobs:
         with:
           name: bundle-artifacts
           path: bundle-artifacts
-  pkg-x86_64:
+  pkg:
     runs-on: windows-latest
     needs: bundle-artifacts
+    strategy:
+      matrix:
+        arch:
+          - name: x86_64
+            bitness: 64
+            bin: /amd64
+          - name: i686
+            bitness: 32
+            bin: ''
     steps:
       - name: Configure user
         shell: bash
@@ -157,7 +166,7 @@ jobs:
           git config --global user.email "<${info#*<}"
         env:
           GPGKEY: ${{secrets.GPGKEY}}
-      - name: Build mingw-w64-x86_64-git
+      - name: Build mingw-w64-${{matrix.arch.name}}-git
         env:
           GPGKEY: "${{secrets.GPGKEY}}"
         shell: powershell
@@ -165,9 +174,9 @@ jobs:
           & git-sdk-64-makepkg-git\usr\bin\sh.exe -lc @"
             set -x
             # Let `cv2pdb` find the DLLs
-            PATH=\"`$PATH:/C/Program Files (x86)/Microsoft Visual Studio 14.0/VC/bin/amd64\"
+            PATH=\"`$PATH:/C/Program Files (x86)/Microsoft Visual Studio 14.0/VC/bin${{matrix.arch.bin}}\"
             type -p mspdb140.dll || exit 1
-            sh -x /usr/src/build-extra/please.sh build-mingw-w64-git --only-64-bit --build-src-pkg -o artifacts HEAD &&
+            sh -x /usr/src/build-extra/please.sh build-mingw-w64-git --only-${{matrix.arch.bitness}}-bit --build-src-pkg -o artifacts HEAD &&
             cp bundle-artifacts/ver artifacts/ &&
             if test -n \"`$GPGKEY\"
             then
@@ -188,10 +197,10 @@ jobs:
         if: always()
         shell: bash
         run: rm -rf home
-      - name: Publish mingw-w64-x86_64-git
+      - name: Publish mingw-w64-${{matrix.arch.name}}-git
         uses: actions/upload-artifact@v1
         with:
-          name: pkg-x86_64
+          name: pkg-${{matrix.arch.name}}
           path: artifacts
   artifacts:
     runs-on: windows-latest
@@ -214,21 +223,27 @@ jobs:
           - name: mingit-busybox
             fileprefix: MinGit
             fileextension: zip
+        arch:
+          - name: x86_64
+            bitness: 64
+          - name: i686
+            bitness: 32
       fail-fast: false
     env:
-      MSYSTEM: MINGW64
+      MSYSTEM: MINGW${{matrix.arch.bitness}}
     steps:
-      - name: Download pkg-x86_64
+      - name: Download pkg-${{matrix.arch.name}}
         uses: actions/download-artifact@v1
         with:
-          name: pkg-x86_64
-          path: pkg-x86_64
+          name: pkg-${{matrix.arch.name}}
+          path: pkg-${{matrix.arch.name}}
       - name: Download bundle-artifacts
         uses: actions/download-artifact@v1
         with:
           name: bundle-artifacts
           path: bundle-artifacts
       - name: Download git-sdk-64-build-installers
+        if: matrix.arch.bitness == '64'
         shell: bash
         run: |
           # Use Git Bash to download and unpack the artifact
@@ -241,12 +256,29 @@ jobs:
 
           curl -o artifacts.zip "$download_url"
 
+          ## Unpack artifact
+          unzip artifacts.zip
+      - name: Download git-sdk-32-build-installers
+        if: matrix.arch.bitness == '32'
+        shell: bash
+        run: |
+          # Use Git Bash to download and unpack the artifact
+
+          ## Get artifact
+          urlbase=https://dev.azure.com/git-for-windows/git/_apis/build/builds
+          id=$(curl "$urlbase?definitions=30&statusFilter=completed&resultFilter=succeeded&\$top=1" |
+            jq -r '.value[0].id')
+          download_url=$(curl "$urlbase/$id/artifacts" |
+            jq -r '.value[] | select(.name == "git-sdk-32-build-installers").resource.downloadUrl')
+
+          curl -o artifacts.zip "$download_url"
+
           ## Unpack artifact
           unzip artifacts.zip
       - name: Clone and update build-extra
         shell: bash
         run: |
-          d=git-sdk-64-build-installers/usr/src/build-extra &&
+          d=git-sdk-${{matrix.arch.bitness}}-build-installers/usr/src/build-extra &&
           git clone --single-branch -b main https://github.com/git-for-windows/build-extra $d &&
           git -C $d pull "$PWD"/bundle-artifacts/build-extra.bundle main
       - name: Prepare home directory for code-signing
@@ -260,12 +292,12 @@ jobs:
           echo -n "$CODESIGN_P12" | tr % '\n' | base64 -d >home/.sig/codesign.p12 &&
           echo -n "$CODESIGN_PASS" >home/.sig/codesign.pass &&
           git config --global alias.signtool '!sh "/usr/src/build-extra/signtool.sh"'
-      - name: Build 64-bit ${{matrix.artifact.name}}
+      - name: Build ${{matrix.arch.bitness}}-bit ${{matrix.artifact.name}}
         shell: powershell
         run: |
-          & .\git-sdk-64-build-installers\usr\bin\bash.exe -lc @"
+          & .\git-sdk-${{matrix.arch.bitness}}-build-installers\usr\bin\bash.exe -lc @"
             set -x
-            /usr/src/build-extra/please.sh make_installers_from_mingw_w64_git --version=`$(cat pkg-x86_64/ver) -o artifacts --${{matrix.artifact.name}} --pkg=pkg-x86_64/mingw-w64-x86_64-git-[0-9]*.tar.xz --pkg=pkg-x86_64/mingw-w64-x86_64-git-doc-html-[0-9]*.tar.xz &&
+            /usr/src/build-extra/please.sh make_installers_from_mingw_w64_git --version=`$(cat pkg-${{matrix.arch.name}}/ver) -o artifacts --${{matrix.artifact.name}} --pkg=pkg-${{matrix.arch.name}}/mingw-w64-${{matrix.arch.name}}-git-[0-9]*.tar.xz --pkg=pkg-${{matrix.arch.name}}/mingw-w64-${{matrix.arch.name}}-git-doc-html-[0-9]*.tar.xz &&
             if test portable = '${{matrix.artifact.name}}' && test -n \"`$(git config alias.signtool)\"
             then
               git signtool artifacts/PortableGit-*.exe
@@ -276,22 +308,22 @@ jobs:
         if: matrix.artifact.name == 'installer'
         shell: powershell
         run: |
-          & .\git-sdk-64-build-installers\usr\bin\bash.exe -lc @"
+          & .\git-sdk-${{matrix.arch.bitness}}-build-installers\usr\bin\bash.exe -lc @"
             cp /usr/src/build-extra/installer/package-versions.txt artifacts/ &&
 
             a=`$PWD/artifacts &&
-            p=`$PWD/pkg-x86_64 &&
+            p=`$PWD/pkg-${{matrix.arch.name}} &&
             (cd /usr/src/build-extra &&
             mkdir -p cached-source-packages &&
             cp \"`$p\"/*-pdb* cached-source-packages/ &&
-            GIT_CONFIG_PARAMETERS=\"'windows.sdk64.path='\" ./please.sh bundle_pdbs --arch=x86_64 --directory=\"`$a\" installer/package-versions.txt)
+            GIT_CONFIG_PARAMETERS=\"'windows.sdk${{matrix.arch.bitness}}.path='\" ./please.sh bundle_pdbs --arch=${{matrix.arch.name}} --directory=\"`$a\" installer/package-versions.txt)
           "@
       - name: Clean up temporary files
         if: always()
         shell: bash
         run: rm -rf home
-      - name: Publish ${{matrix.artifact.name}}-x86_64
+      - name: Publish ${{matrix.artifact.name}}-${{matrix.arch.name}}
         uses: actions/upload-artifact@v1
         with:
-          name: ${{matrix.artifact.name}}-x86_64
+          name: ${{matrix.artifact.name}}-${{matrix.arch.name}}
           path: artifacts

From 9ba38bb548f0d9d330785419f7721e23534b6ce0 Mon Sep 17 00:00:00 2001
From: Johannes Schindelin <johannes.schindelin@gmx.de>
Date: Sun, 12 Apr 2020 00:52:22 +0200
Subject: [PATCH 07/11] git-artifacts: also build the nuget package

The two NuGet artifact exists only in the 64-bit version. So let's make
them in a separate, non-matrix job.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
---
 .github/workflows/git-artifacts.yml | 49 +++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)

diff --git a/.github/workflows/git-artifacts.yml b/.github/workflows/git-artifacts.yml
index dee6feeb672de5..66ae8c7f14eb77 100644
--- a/.github/workflows/git-artifacts.yml
+++ b/.github/workflows/git-artifacts.yml
@@ -327,3 +327,52 @@ jobs:
         with:
           name: ${{matrix.artifact.name}}-${{matrix.arch.name}}
           path: artifacts
+  nuget:
+    runs-on: windows-latest
+    needs: pkg
+    steps:
+      - name: Download pkg-x86_64
+        uses: actions/download-artifact@v1
+        with:
+          name: pkg-x86_64
+          path: pkg-x86_64
+      - name: Download bundle-artifacts
+        uses: actions/download-artifact@v1
+        with:
+          name: bundle-artifacts
+          path: bundle-artifacts
+      - name: Download git-sdk-64-build-installers
+        shell: bash
+        run: |
+          # Use Git Bash to download and unpack the artifact
+
+          ## Get artifact
+          urlbase=https://dev.azure.com/git-for-windows/git/_apis/build/builds
+          id=${{ needs.pkg.outputs.latest-sdk64-extra-build-id }}
+          download_url=$(curl "$urlbase/$id/artifacts" |
+            jq -r '.value[] | select(.name == "git-sdk-64-build-installers").resource.downloadUrl')
+
+          curl -o artifacts.zip "$download_url"
+
+          ## Unpack artifact
+          unzip artifacts.zip
+      - name: Clone and update build-extra
+        shell: bash
+        run: |
+          d=git-sdk-64-build-installers/usr/src/build-extra &&
+          git clone --single-branch -b main https://github.com/git-for-windows/build-extra $d &&
+          git -C $d pull "$PWD"/bundle-artifacts/build-extra.bundle main
+      - uses: nuget/setup-nuget@v1
+      - name: Build 64-bit NuGet packages
+        shell: powershell
+        run: |
+          & .\git-sdk-64-build-installers\usr\bin\bash.exe -lc @"
+            /usr/src/build-extra/please.sh make_installers_from_mingw_w64_git --version=`$(cat pkg-x86_64/ver) -o artifacts --nuget --pkg=pkg-x86_64/mingw-w64-x86_64-git-[0-9]*.tar.xz --pkg=pkg-x86_64/mingw-w64-x86_64-git-doc-html-[0-9]*.tar.xz &&
+            /usr/src/build-extra/please.sh make_installers_from_mingw_w64_git --version=`$(cat pkg-x86_64/ver) -o artifacts --nuget-mingit &&
+            openssl dgst -sha256 artifacts/Git*.nupkg | sed \"s/.* //\" >artifacts/sha-256.txt
+          "@
+      - name: Publish nuget-x86_64
+        uses: actions/upload-artifact@v1
+        with:
+          name: nuget-x86_64
+          path: artifacts

From 6f7d2314e0f474f5c370eff95b6ad94b0cd37cad Mon Sep 17 00:00:00 2001
From: Johannes Schindelin <johannes.schindelin@gmx.de>
Date: Sat, 11 Apr 2020 23:43:55 +0200
Subject: [PATCH 08/11] git-artifacts: allow restricting which artifacts are
 built

Users can now specify which artifacts they want to build, via the
`build_only` input, which is a space-separated list of artifacts. For
example, `installer portable` will build `installer-x86_64`,
`installer-i686`, `portable-x86_64` and `portable-i686`, and an empty or
unset value will build all artifacts.

Please note that the `mingw-w64-git` packages are built always, as it
would be tricky to figure out when they need to be built (for example,
`build_only=portable-x86_64` technically does not need `pkg-i686` to be
built, while `build_only=portable` does).

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
---
 .github/workflows/git-artifacts.yml | 44 +++++++++++++++++++++++++----
 1 file changed, 38 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/git-artifacts.yml b/.github/workflows/git-artifacts.yml
index 66ae8c7f14eb77..a5eda845659375 100644
--- a/.github/workflows/git-artifacts.yml
+++ b/.github/workflows/git-artifacts.yml
@@ -3,13 +3,17 @@ name: git-artifacts
 on:
   # This workflow can be triggered manually in the Actions tab, see
   # https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/
-  - workflow_dispatch
+  workflow_dispatch:
+    inputs:
+      build_only:
+        description: 'Optionally restrict what artifacts to build'
 
 env:
   GPG_OPTIONS: "--batch --yes --no-tty --list-options no-show-photos --verify-options no-show-photos --pinentry-mode loopback"
   HOME: "${{github.workspace}}\\home"
   MSYSTEM: MINGW64
   USERPROFILE: "${{github.workspace}}\\home"
+  BUILD_ONLY: "${{github.event.inputs.build_only}}"
 
 jobs:
   bundle-artifacts:
@@ -232,18 +236,28 @@ jobs:
     env:
       MSYSTEM: MINGW${{matrix.arch.bitness}}
     steps:
+      - name: Determine whether this job should be skipped
+        shell: bash
+        run: |
+          case " $BUILD_ONLY " in
+          '  ') ;; # not set; build all
+          *" ${{matrix.artifact.name}} "*|*" ${{matrix.artifact.name}}-${{matrix.arch.name}} "*) ;; # build this artifact
+          *) echo "SKIP=true" >>$GITHUB_ENV;;
+          esac
       - name: Download pkg-${{matrix.arch.name}}
+        if: env.SKIP != 'true'
         uses: actions/download-artifact@v1
         with:
           name: pkg-${{matrix.arch.name}}
           path: pkg-${{matrix.arch.name}}
       - name: Download bundle-artifacts
+        if: env.SKIP != 'true'
         uses: actions/download-artifact@v1
         with:
           name: bundle-artifacts
           path: bundle-artifacts
       - name: Download git-sdk-64-build-installers
-        if: matrix.arch.bitness == '64'
+        if: env.SKIP != 'true' && matrix.arch.bitness == '64'
         shell: bash
         run: |
           # Use Git Bash to download and unpack the artifact
@@ -259,7 +273,7 @@ jobs:
           ## Unpack artifact
           unzip artifacts.zip
       - name: Download git-sdk-32-build-installers
-        if: matrix.arch.bitness == '32'
+        if: env.SKIP != 'true' && matrix.arch.bitness == '32'
         shell: bash
         run: |
           # Use Git Bash to download and unpack the artifact
@@ -276,6 +290,7 @@ jobs:
           ## Unpack artifact
           unzip artifacts.zip
       - name: Clone and update build-extra
+        if: env.SKIP != 'true'
         shell: bash
         run: |
           d=git-sdk-${{matrix.arch.bitness}}-build-installers/usr/src/build-extra &&
@@ -285,7 +300,7 @@ jobs:
         env:
           CODESIGN_P12: ${{secrets.CODESIGN_P12}}
           CODESIGN_PASS: ${{secrets.CODESIGN_PASS}}
-        if: (matrix.artifact.name == 'installer' || matrix.artifact.name == 'portable') && env.CODESIGN_P12 != '' && env.CODESIGN_PASS != ''
+        if: env.SKIP != 'true' && (matrix.artifact.name == 'installer' || matrix.artifact.name == 'portable') && env.CODESIGN_P12 != '' && env.CODESIGN_PASS != ''
         shell: bash
         run: |
           mkdir -p home/.sig &&
@@ -293,6 +308,7 @@ jobs:
           echo -n "$CODESIGN_PASS" >home/.sig/codesign.pass &&
           git config --global alias.signtool '!sh "/usr/src/build-extra/signtool.sh"'
       - name: Build ${{matrix.arch.bitness}}-bit ${{matrix.artifact.name}}
+        if: env.SKIP != 'true'
         shell: powershell
         run: |
           & .\git-sdk-${{matrix.arch.bitness}}-build-installers\usr\bin\bash.exe -lc @"
@@ -305,7 +321,7 @@ jobs:
             openssl dgst -sha256 artifacts/${{matrix.artifact.fileprefix}}-*.${{matrix.artifact.fileextension}} | sed \"s/.* //\" >artifacts/sha-256.txt
           "@
       - name: Copy package-versions and pdbs
-        if: matrix.artifact.name == 'installer'
+        if: env.SKIP != 'true' && matrix.artifact.name == 'installer'
         shell: powershell
         run: |
           & .\git-sdk-${{matrix.arch.bitness}}-build-installers\usr\bin\bash.exe -lc @"
@@ -319,10 +335,11 @@ jobs:
             GIT_CONFIG_PARAMETERS=\"'windows.sdk${{matrix.arch.bitness}}.path='\" ./please.sh bundle_pdbs --arch=${{matrix.arch.name}} --directory=\"`$a\" installer/package-versions.txt)
           "@
       - name: Clean up temporary files
-        if: always()
+        if: always() && env.SKIP != 'true'
         shell: bash
         run: rm -rf home
       - name: Publish ${{matrix.artifact.name}}-${{matrix.arch.name}}
+        if: env.SKIP != 'true'
         uses: actions/upload-artifact@v1
         with:
           name: ${{matrix.artifact.name}}-${{matrix.arch.name}}
@@ -331,17 +348,28 @@ jobs:
     runs-on: windows-latest
     needs: pkg
     steps:
+      - name: Determine whether this job should be skipped
+        shell: bash
+        run: |
+          case " $BUILD_ONLY " in
+          '  ') ;; # not set; build all
+          *" nuget "*) ;; # build this artifact
+          *) echo "SKIP=true" >>$GITHUB_ENV;;
+          esac
       - name: Download pkg-x86_64
+        if: env.SKIP != 'true'
         uses: actions/download-artifact@v1
         with:
           name: pkg-x86_64
           path: pkg-x86_64
       - name: Download bundle-artifacts
+        if: env.SKIP != 'true'
         uses: actions/download-artifact@v1
         with:
           name: bundle-artifacts
           path: bundle-artifacts
       - name: Download git-sdk-64-build-installers
+        if: env.SKIP != 'true'
         shell: bash
         run: |
           # Use Git Bash to download and unpack the artifact
@@ -357,13 +385,16 @@ jobs:
           ## Unpack artifact
           unzip artifacts.zip
       - name: Clone and update build-extra
+        if: env.SKIP != 'true'
         shell: bash
         run: |
           d=git-sdk-64-build-installers/usr/src/build-extra &&
           git clone --single-branch -b main https://github.com/git-for-windows/build-extra $d &&
           git -C $d pull "$PWD"/bundle-artifacts/build-extra.bundle main
       - uses: nuget/setup-nuget@v1
+        if: env.SKIP != 'true'
       - name: Build 64-bit NuGet packages
+        if: env.SKIP != 'true'
         shell: powershell
         run: |
           & .\git-sdk-64-build-installers\usr\bin\bash.exe -lc @"
@@ -372,6 +403,7 @@ jobs:
             openssl dgst -sha256 artifacts/Git*.nupkg | sed \"s/.* //\" >artifacts/sha-256.txt
           "@
       - name: Publish nuget-x86_64
+        if: env.SKIP != 'true'
         uses: actions/upload-artifact@v1
         with:
           name: nuget-x86_64

From 56d105e8d9bb3ad8e14f9726599f5646bb5e35f4 Mon Sep 17 00:00:00 2001
From: Johannes Schindelin <johannes.schindelin@gmx.de>
Date: Sat, 11 Apr 2020 23:58:47 +0200
Subject: [PATCH 09/11] git-artifacts: allow specifying repo/ref via
 workflow_dispatch

With this change, users can specify the branch and repository from which
they want to build Git for Windows' artifacts, via the `ref` and
`repository` inputs.

This allows e.g. building `refs/heads/seen` of `git/git` (even if no
`git-artifacts` workflow is configured in that repository), or
`refs/pull/<number>/merge` for a given Pull Request.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
---
 .github/workflows/git-artifacts.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/git-artifacts.yml b/.github/workflows/git-artifacts.yml
index a5eda845659375..73c8002fc76a32 100644
--- a/.github/workflows/git-artifacts.yml
+++ b/.github/workflows/git-artifacts.yml
@@ -7,6 +7,10 @@ on:
     inputs:
       build_only:
         description: 'Optionally restrict what artifacts to build'
+      ref:
+        description: 'Optionally override which branch to build'
+      repository:
+        description: 'Optionally override from where to fetch the specified ref'
 
 env:
   GPG_OPTIONS: "--batch --yes --no-tty --list-options no-show-photos --verify-options no-show-photos --pinentry-mode loopback"
@@ -14,6 +18,8 @@ env:
   MSYSTEM: MINGW64
   USERPROFILE: "${{github.workspace}}\\home"
   BUILD_ONLY: "${{github.event.inputs.build_only}}"
+  REPOSITORY: "${{github.event.inputs.repository}}"
+  REF: "${{github.event.inputs.ref}}"
 
 jobs:
   bundle-artifacts:
@@ -70,9 +76,11 @@ jobs:
             printf '#!/bin/sh\n\nexec /mingw64/bin/git.exe "`$@"\n' >/usr/bin/git &&
             mkdir -p bundle-artifacts &&
 
+            { test -n \"`$REPOSITORY\" || REPOSITORY='${{github.repository}}'; } &&
+            { test -n \"`$REF\" || REF='${{github.ref}}'; } &&
             git -c init.defaultBranch=main init --bare &&
             git remote add -f origin https://github.com/git-for-windows/git &&
-            git fetch https://github.com/${{github.repository}} ${{github.ref}}:${{github.ref}} &&
+            git fetch \"https://github.com/`$REPOSITORY\" \"`$REF:`$REF\" &&
 
             tag_name=\"`$(git describe --match 'v[0-9]*' FETCH_HEAD)-`$(date +%Y%m%d%H%M%S)\" &&
             echo \"prerelease-`${tag_name#v}\" >bundle-artifacts/ver &&

From 95d82300ac06e8a48e6239881dcd34005b10ddb8 Mon Sep 17 00:00:00 2001
From: Dennis Ameling <dennis@dennisameling.com>
Date: Thu, 28 Jan 2021 21:31:05 +0100
Subject: [PATCH 10/11] git-artifacts: cache the build-installers artifact

It is a bit expensive to fetch just the git-sdk-64-build-installers
artifact from Azure Pipelines and then to unpack it (takes some 6-7
minutes, typically). Let's cache it if possible.

Signed-off-by: Dennis Ameling <dennis@dennisameling.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
---
 .github/workflows/git-artifacts.yml | 89 +++++++++++++++++++++++++----
 1 file changed, 79 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/git-artifacts.yml b/.github/workflows/git-artifacts.yml
index 73c8002fc76a32..f2f6e4ef1c800d 100644
--- a/.github/workflows/git-artifacts.yml
+++ b/.github/workflows/git-artifacts.yml
@@ -24,6 +24,8 @@ env:
 jobs:
   bundle-artifacts:
     runs-on: windows-latest
+    outputs:
+      latest-sdk64-extra-build-id: ${{ steps.determine-latest-sdk64-extra-build-id.outputs.id }}
     steps:
       - name: Configure user
         shell: bash
@@ -34,15 +36,31 @@ jobs:
           git config --global user.name "$USER_NAME" &&
           git config --global user.email "$USER_EMAIL" &&
           echo "PACKAGER=$USER_NAME <$USER_EMAIL>" >>$GITHUB_ENV
+      - name: Determine latest git-sdk-64-extra-artifacts build ID
+        id: determine-latest-sdk64-extra-build-id
+        shell: bash
+        run: |
+          urlbase=https://dev.azure.com/git-for-windows/git/_apis/build/builds
+          id=$(curl "$urlbase?definitions=29&statusFilter=completed&resultFilter=succeeded&\$top=1" |
+            jq -r '.value[0].id')
+
+          echo "Latest ID is ${id}"
+          echo "::set-output name=id::$id"
+      - name: Cache git-sdk-64-build-installers
+        id: cache-sdk-build-installers
+        uses: actions/cache@v2
+        with:
+          path: git-sdk-64-build-installers
+          key: build-installers-64-${{ steps.determine-latest-sdk64-extra-build-id.outputs.id }}
       - name: Download git-sdk-64-build-installers
+        if: steps.cache-sdk-build-installers.outputs.cache-hit != 'true'
         shell: bash
         run: |
           # Use Git Bash to download and unpack the artifact
 
           ## Get artifact
           urlbase=https://dev.azure.com/git-for-windows/git/_apis/build/builds
-          id=$(curl "$urlbase?definitions=29&statusFilter=completed&resultFilter=succeeded&\$top=1" |
-            jq -r '.value[0].id')
+          id=${{ steps.determine-latest-sdk64-extra-build-id.outputs.id }}
           download_url=$(curl "$urlbase/$id/artifacts" |
             jq -r '.value[] | select(.name == "git-sdk-64-build-installers").resource.downloadUrl')
 
@@ -54,7 +72,13 @@ jobs:
         shell: bash
         run: |
           d=git-sdk-64-build-installers/usr/src/build-extra &&
-          git clone --single-branch -b main https://github.com/git-for-windows/build-extra $d
+          if test ! -d $d/.git
+          then
+            git clone --single-branch -b main https://github.com/git-for-windows/build-extra $d
+          else
+            git -C $d fetch https://github.com/git-for-windows/build-extra main &&
+            git -C $d switch -C main FETCH_HEAD
+          fi
       - name: Prepare home directory for GPG signing
         if: env.GPGKEY != ''
         shell: bash
@@ -104,6 +128,8 @@ jobs:
   pkg:
     runs-on: windows-latest
     needs: bundle-artifacts
+    outputs:
+      latest-sdk64-extra-build-id: ${{ needs.bundle-artifacts.outputs.latest-sdk64-extra-build-id }}
     strategy:
       matrix:
         arch:
@@ -264,8 +290,15 @@ jobs:
         with:
           name: bundle-artifacts
           path: bundle-artifacts
-      - name: Download git-sdk-64-build-installers
+      - name: Cache git-sdk-64-build-installers
         if: env.SKIP != 'true' && matrix.arch.bitness == '64'
+        id: cache-sdk64-build-installers
+        uses: actions/cache@v2
+        with:
+          path: git-sdk-64-build-installers
+          key: build-installers-64-${{ needs.pkg.outputs.latest-sdk64-extra-build-id }}
+      - name: Download git-sdk-64-build-installers
+        if: env.SKIP != 'true' && matrix.arch.bitness == '64' && steps.cache-sdk64-build-installers.outputs.cache-hit != 'true'
         shell: bash
         run: |
           # Use Git Bash to download and unpack the artifact
@@ -280,16 +313,33 @@ jobs:
 
           ## Unpack artifact
           unzip artifacts.zip
-      - name: Download git-sdk-32-build-installers
+      - name: Determine latest git-sdk-32-extra-artifacts build ID
         if: env.SKIP != 'true' && matrix.arch.bitness == '32'
+        id: determine-latest-sdk32-extra-build-id
+        shell: bash
+        run: |
+          urlbase=https://dev.azure.com/git-for-windows/git/_apis/build/builds
+          id=$(curl "$urlbase?definitions=30&statusFilter=completed&resultFilter=succeeded&\$top=1" |
+            jq -r '.value[0].id')
+
+          echo "Latest ID is ${id}"
+          echo "::set-output name=id::$id"
+      - name: Cache git-sdk-32-build-installers
+        if: env.SKIP != 'true' && matrix.arch.bitness == '32'
+        id: cache-sdk32-build-installers
+        uses: actions/cache@v2
+        with:
+          path: git-sdk-32-build-installers
+          key: build-installers-32-${{ steps.determine-latest-sdk32-extra-build-id.outputs.id }}
+      - name: Download git-sdk-32-build-installers
+        if: env.SKIP != 'true' && matrix.arch.bitness == '32' && steps.cache-sdk32-build-installers.outputs.cache-hit != 'true'
         shell: bash
         run: |
           # Use Git Bash to download and unpack the artifact
 
           ## Get artifact
           urlbase=https://dev.azure.com/git-for-windows/git/_apis/build/builds
-          id=$(curl "$urlbase?definitions=30&statusFilter=completed&resultFilter=succeeded&\$top=1" |
-            jq -r '.value[0].id')
+          id=${{ steps.determine-latest-sdk32-extra-build-id.outputs.id }}
           download_url=$(curl "$urlbase/$id/artifacts" |
             jq -r '.value[] | select(.name == "git-sdk-32-build-installers").resource.downloadUrl')
 
@@ -302,7 +352,13 @@ jobs:
         shell: bash
         run: |
           d=git-sdk-${{matrix.arch.bitness}}-build-installers/usr/src/build-extra &&
-          git clone --single-branch -b main https://github.com/git-for-windows/build-extra $d &&
+          if test ! -d $d/.git
+          then
+            git clone --single-branch -b main https://github.com/git-for-windows/build-extra $d
+          else
+            git -C $d fetch https://github.com/git-for-windows/build-extra main &&
+            git -C $d switch -C main FETCH_HEAD
+          fi &&
           git -C $d pull "$PWD"/bundle-artifacts/build-extra.bundle main
       - name: Prepare home directory for code-signing
         env:
@@ -376,8 +432,15 @@ jobs:
         with:
           name: bundle-artifacts
           path: bundle-artifacts
-      - name: Download git-sdk-64-build-installers
+      - name: Cache git-sdk-64-build-installers
         if: env.SKIP != 'true'
+        id: cache-sdk-build-installers
+        uses: actions/cache@v2
+        with:
+          path: git-sdk-64-build-installers
+          key: build-installers-64-${{ needs.pkg.outputs.latest-sdk64-extra-build-id }}
+      - name: Download git-sdk-64-build-installers
+        if: env.SKIP != 'true' && steps.cache-sdk-build-installers.outputs.cache-hit != 'true'
         shell: bash
         run: |
           # Use Git Bash to download and unpack the artifact
@@ -397,7 +460,13 @@ jobs:
         shell: bash
         run: |
           d=git-sdk-64-build-installers/usr/src/build-extra &&
-          git clone --single-branch -b main https://github.com/git-for-windows/build-extra $d &&
+          if test ! -d $d/.git
+          then
+            git clone --single-branch -b main https://github.com/git-for-windows/build-extra $d
+          else
+            git -C $d fetch https://github.com/git-for-windows/build-extra main &&
+            git -C $d switch -C main FETCH_HEAD
+          fi &&
           git -C $d pull "$PWD"/bundle-artifacts/build-extra.bundle main
       - uses: nuget/setup-nuget@v1
         if: env.SKIP != 'true'

From 7db4d3cb0bcedfdf91d4b9fbf7fe9a688b5fafa5 Mon Sep 17 00:00:00 2001
From: Johannes Schindelin <johannes.schindelin@gmx.de>
Date: Wed, 3 Feb 2021 15:52:58 +0100
Subject: [PATCH 11/11] git-artifacts: use the cached build-installers instead
 of makepkg-git

When building the Pacman packages, we technically do not need the full
`build-installers` artifact (which is substantially larger than the
`makepkg-git` artifact). However, the former is already cached and
includes the latter's files. And it is _so_ much faster to download the
cached (larger) artifact than to download the smaller `makepkg-git`
artifact from Azure Pipelines.

Suggested-by: Dennis Ameling <dennis@dennisameling.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
---
 .github/workflows/git-artifacts.yml | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/git-artifacts.yml b/.github/workflows/git-artifacts.yml
index f2f6e4ef1c800d..b2c4eecf0f79a7 100644
--- a/.github/workflows/git-artifacts.yml
+++ b/.github/workflows/git-artifacts.yml
@@ -149,16 +149,23 @@ jobs:
           git config --global user.name "$USER_NAME" &&
           git config --global user.email "$USER_EMAIL" &&
           echo "PACKAGER=$USER_NAME <$USER_EMAIL>" >>$GITHUB_ENV
-      - name: Download git-sdk-64-makepkg-git
+      - name: Cache git-sdk-64-build-installers
+        id: cache-sdk-build-installers
+        uses: actions/cache@v2
+        with:
+          path: git-sdk-64-build-installers
+          key: build-installers-64-${{ needs.bundle-artifacts.outputs.latest-sdk64-extra-build-id }}
+      - name: Download git-sdk-64-build-installers
+        if: steps.cache-sdk-build-installers.outputs.cache-hit != 'true'
         shell: bash
         run: |
           # Use Git Bash to download and unpack the artifact
 
           ## Get artifact
           urlbase=https://dev.azure.com/git-for-windows/git/_apis/build/builds
-          id=${{ needs.bundle-artifacts.outputs.latest-sdk64-extra-build-id }}
-          download_url="$(curl "$urlbase/$id/artifacts" |
-            jq -r '.value[] | select(.name == "git-sdk-64-makepkg-git").resource.downloadUrl')"
+          id=${{ needs.pkg.outputs.latest-sdk64-extra-build-id }}
+          download_url=$(curl "$urlbase/$id/artifacts" |
+            jq -r '.value[] | select(.name == "git-sdk-64-build-installers").resource.downloadUrl')
 
           curl -o artifacts.zip "$download_url"
 
@@ -172,8 +179,14 @@ jobs:
       - name: Clone and update build-extra
         shell: bash
         run: |
-          d=git-sdk-64-makepkg-git/usr/src/build-extra &&
-          git clone --single-branch -b main https://github.com/git-for-windows/build-extra $d &&
+          d=git-sdk-64-build-installers/usr/src/build-extra &&
+          if test ! -d $d/.git
+          then
+            git clone --single-branch -b main https://github.com/git-for-windows/build-extra $d
+          else
+            git -C $d fetch https://github.com/git-for-windows/build-extra main &&
+            git -C $d switch -C main FETCH_HEAD
+          fi &&
           git -C $d pull "$PWD"/bundle-artifacts/build-extra.bundle main
       - name: Check out git/git
         shell: bash
@@ -209,7 +222,7 @@ jobs:
           GPGKEY: "${{secrets.GPGKEY}}"
         shell: powershell
         run: |
-          & git-sdk-64-makepkg-git\usr\bin\sh.exe -lc @"
+          & git-sdk-64-build-installers\usr\bin\sh.exe -lc @"
             set -x
             # Let `cv2pdb` find the DLLs
             PATH=\"`$PATH:/C/Program Files (x86)/Microsoft Visual Studio 14.0/VC/bin${{matrix.arch.bin}}\"