Skip to content

Commit 967d5ec

Browse files
marionbarkermarionbarker
committed
update using Trio (PR 453) to automate new certificates, credit @bjornoleh 
1 parent 7e4fba1 commit 967d5ec

File tree

5 files changed

+186
-48
lines changed

5 files changed

+186
-48
lines changed

‎.github/workflows/build_loop.yml

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,15 +18,17 @@ env:
1818
ALIVE_BRANCH_DEV: alive-dev
1919

2020
jobs:
21-
validate:
22-
name: Validate
23-
uses: ./.github/workflows/validate_secrets.yml
21+
# Checks if Distribution certificate is present and valid, optionally nukes and
22+
# creates new certs if the repository variable ENABLE_NUKE_CERTS == 'true'
23+
check_certs:
24+
name: Check certificates
25+
uses: ./.github/workflows/create_certs.yml
2426
secrets: inherit
2527

2628
# Checks if GH_PAT holds workflow permissions
2729
# Checks for existence of alive branch; if non-existent creates it
2830
check_alive_and_permissions:
29-
needs: validate
31+
needs: check_certs
3032
runs-on: ubuntu-latest
3133
name: Check alive branch and permissions
3234
permissions:
@@ -96,7 +98,7 @@ jobs:
9698
# Checks for changes in upstream repository; if changes exist prompts sync for build
9799
# Performs keepalive to avoid stale fork
98100
check_latest_from_upstream:
99-
needs: [validate, check_alive_and_permissions]
101+
needs: [check_certs, check_alive_and_permissions]
100102
runs-on: ubuntu-latest
101103
name: Check upstream and keep alive
102104
outputs:
@@ -185,7 +187,7 @@ jobs:
185187
# Builds Loop
186188
build:
187189
name: Build
188-
needs: [validate, check_alive_and_permissions, check_latest_from_upstream]
190+
needs: [check_certs, check_alive_and_permissions, check_latest_from_upstream]
189191
runs-on: macos-14
190192
permissions:
191193
contents: write

‎.github/workflows/create_certs.yml

Lines changed: 85 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,32 @@
11
name: 3. Create Certificates
22
run-name: Create Certificates (${{ github.ref_name }})
3-
on:
4-
workflow_dispatch:
3+
4+
on: [workflow_call, workflow_dispatch]
5+
6+
env:
7+
TEAMID: ${{ secrets.TEAMID }}
8+
GH_PAT: ${{ secrets.GH_PAT }}
9+
GH_TOKEN: ${{ secrets.GH_PAT }}
10+
MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
11+
FASTLANE_KEY_ID: ${{ secrets.FASTLANE_KEY_ID }}
12+
FASTLANE_ISSUER_ID: ${{ secrets.FASTLANE_ISSUER_ID }}
13+
FASTLANE_KEY: ${{ secrets.FASTLANE_KEY }}
514

615
jobs:
716
validate:
817
name: Validate
918
uses: ./.github/workflows/validate_secrets.yml
1019
secrets: inherit
11-
12-
certificates:
13-
name: Create Certificates
20+
21+
22+
create_certs:
23+
name: Certificates
1424
needs: validate
15-
runs-on: macos-14
25+
runs-on: macos-15
26+
outputs:
27+
new_certificate_needed: ${{ steps.set_output.outputs.new_certificate_needed }}
28+
1629
steps:
17-
# Uncomment to manually select latest Xcode if needed
18-
#- name: Select Latest Xcode
19-
# run: "sudo xcode-select --switch /Applications/Xcode_13.0.app/Contents/Developer"
20-
2130
# Checks-out the repo
2231
- name: Checkout Repo
2332
uses: actions/checkout@v4
@@ -41,13 +50,69 @@ jobs:
4150
- name: Sync clock
4251
run: sudo sntp -sS time.windows.com
4352

44-
# Create or update certificates for app
45-
- name: Create Certificates
46-
run: bundle exec fastlane certs
47-
env:
48-
TEAMID: ${{ secrets.TEAMID }}
49-
GH_PAT: ${{ secrets.GH_PAT }}
50-
MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
51-
FASTLANE_KEY_ID: ${{ secrets.FASTLANE_KEY_ID }}
52-
FASTLANE_ISSUER_ID: ${{ secrets.FASTLANE_ISSUER_ID }}
53-
FASTLANE_KEY: ${{ secrets.FASTLANE_KEY }}
53+
# Create or update Distribution certificate and provisioning profiles
54+
- name: Check and create or update Distribution certificate and profiles if needed
55+
run: |
56+
echo "Running Fastlane certs lane..."
57+
bundle exec fastlane certs || true # ignore and continue on errors without annotating an exit code
58+
- name: Check Distribution certificate and launch Nuke certificates if needed
59+
run: bundle exec fastlane check_and_renew_certificates
60+
id: check_certs
61+
62+
- name: Set output and annotations based on Fastlane result
63+
id: set_output
64+
run: |
65+
CERT_STATUS_FILE="${{ github.workspace }}/fastlane/new_certificate_needed.txt"
66+
ENABLE_NUKE_CERTS=${{ vars.ENABLE_NUKE_CERTS }}
67+
68+
if [ -f "$CERT_STATUS_FILE" ]; then
69+
CERT_STATUS=$(cat "$CERT_STATUS_FILE" | tr -d '\n' | tr -d '\r') # Read file content and strip newlines
70+
echo "new_certificate_needed: $CERT_STATUS"
71+
echo "new_certificate_needed=$CERT_STATUS" >> $GITHUB_OUTPUT
72+
else
73+
echo "Certificate status file not found. Defaulting to false."
74+
echo "new_certificate_needed=false" >> $GITHUB_OUTPUT
75+
fi
76+
# Check if ENABLE_NUKE_CERTS is not set to true when certs are valid
77+
if [ "$CERT_STATUS" != "true" ] && [ "$ENABLE_NUKE_CERTS" != "true" ]; then
78+
echo "::notice::🔔 Automated renewal of certificates is disabled because the repository variable ENABLE_NUKE_CERTS is not set to 'true'."
79+
fi
80+
# Check if ENABLE_NUKE_CERTS is not set to true when certs are not valid
81+
if [ "$CERT_STATUS" = "true" ] && [ "$ENABLE_NUKE_CERTS" != "true" ]; then
82+
echo "::error::❌ No valid distribution certificate found. Automated renewal of certificates was skipped because the repository variable ENABLE_NUKE_CERTS is not set to 'true'."
83+
exit 1
84+
fi
85+
# Check if vars.FORCE_NUKE_CERTS is not set to true
86+
if [ vars.FORCE_NUKE_CERTS = "true" ]; then
87+
echo "::warning::‼️ Nuking of certificates was forced because the repository variable FORCE_NUKE_CERTS is set to 'true'."
88+
fi
89+
# Nuke Certs if needed, and if the repository variable ENABLE_NUKE_CERTS is set to 'true', or if FORCE_NUKE_CERTS is set to 'true', which will always force certs to be nuked
90+
nuke_certs:
91+
name: Nuke certificates
92+
needs: [validate, create_certs]
93+
runs-on: macos-14
94+
if: ${{ (needs.create_certs.outputs.new_certificate_needed == 'true' && vars.ENABLE_NUKE_CERTS == 'true') || vars.FORCE_NUKE_CERTS == 'true' }}
95+
steps:
96+
- name: Output from step id 'check_certs'
97+
run: echo "new_certificate_needed=${{ needs.create_certs.outputs.new_certificate_needed }}"
98+
99+
- name: Checkout repository
100+
uses: actions/checkout@v4
101+
102+
- name: Install dependencies
103+
run: bundle install
104+
105+
- name: Run Fastlane nuke_certs
106+
run: |
107+
set -e # Set error immediately after this step if error occurs
108+
bundle exec fastlane nuke_certs
109+
- name: Recreate Distribution certificate after nuking
110+
run: |
111+
set -e # Set error immediately after this step if error occurs
112+
bundle exec fastlane certs
113+
- name: Add success annotations for nuke and certificate recreation
114+
if: ${{ success() }}
115+
run: |
116+
echo "::warning::⚠️ All Distribution certificates and TestFlight profiles have been revoked and recreated."
117+
echo "::warning::❗️ If you have other apps being distributed by GitHub Actions / Fastlane / TestFlight that does not renew certificates automatically, please run the '3. Create Certificates' workflow for each of these apps to allow these apps to be built."
118+
echo "::warning::✅ But don't worry about your existing TestFlight builds, they will keep working!"

‎.github/workflows/validate_secrets.yml

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -178,16 +178,15 @@ jobs:
178178
elif ! echo "$FASTLANE_KEY" | openssl pkcs8 -nocrypt >/dev/null; then
179179
failed=true
180180
echo "::error::The FASTLANE_KEY secret is set but invalid. Verify that you copied it correctly from the API Key file (*.p8) you downloaded and try again."
181-
elif ! bundle exec fastlane validate_secrets 2>&1 | tee fastlane.log; then
181+
elif ! (bundle exec fastlane validate_secrets 2>&1 || true) | tee fastlane.log; then # ignore "fastlane validate_secrets" errors and continue on errors without annotating an exit code
182182
if grep -q "bad decrypt" fastlane.log; then
183183
failed=true
184184
echo "::error::Unable to decrypt the Match-Secrets repository using the MATCH_PASSWORD secret. Verify that it is set correctly and try again."
185185
elif grep -q -e "required agreement" -e "license agreement" fastlane.log; then
186186
failed=true
187-
echo "::error::Unable to create a valid authorization token for the App Store Connect API. Verify that the latest developer program license agreement has been accepted at https://developer.apple.com/account (review and accept any updated agreement), then wait a few minutes for changes to propagate and try again."
188-
elif ! grep -q -e "No code signing identity found" -e "Could not install WWDR certificate" fastlane.log; then
189-
failed=true
190-
echo "::error::Unable to create a valid authorization token for the App Store Connect API. Verify that the FASTLANE_ISSUER_ID, FASTLANE_KEY_ID, and FASTLANE_KEY secrets are set correctly and try again."
187+
echo "::error::❗️ Verify that the latest developer program license agreement has been accepted at https://developer.apple.com/account (review and accept any updated agreement), then wait a few minutes for changes to take effect and try again."
188+
elif grep -q "Your certificate .* is not valid" fastlane.log; then
189+
echo "::notice::Your Distribution certificate is invalid or expired. Automated renewal of the certificate will be attempted."
191190
fi
192191
fi
193192

‎fastlane/Fastfile

Lines changed: 55 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -220,7 +220,8 @@ platform :ios do
220220

221221
match(
222222
type: "appstore",
223-
force: true,
223+
force: false,
224+
verbose: true,
224225
git_basic_authorization: Base64.strict_encode64("#{GITHUB_REPOSITORY_OWNER}:#{GH_PAT}"),
225226
app_identifier: [
226227
"com.#{TEAMID}.loopkit.Loop",
@@ -276,4 +277,56 @@ platform :ios do
276277
git_basic_authorization: Base64.strict_encode64("#{GITHUB_REPOSITORY_OWNER}:#{GH_PAT}")
277278
)
278279
end
279-
end
280+
281+
desc "Check Certificates and Trigger Workflow for Expired or Missing Certificates"
282+
lane :check_and_renew_certificates do
283+
setup_ci if ENV['CI']
284+
ENV["MATCH_READONLY"] = false.to_s
285+
286+
# Authenticate using App Store Connect API Key
287+
api_key = app_store_connect_api_key(
288+
key_id: ENV["FASTLANE_KEY_ID"],
289+
issuer_id: ENV["FASTLANE_ISSUER_ID"],
290+
key_content: ENV["FASTLANE_KEY"] # Ensure valid key content
291+
)
292+
293+
# Initialize flag to track if renewal of certificates is needed
294+
new_certificate_needed = false
295+
296+
# Fetch all certificates
297+
certificates = Spaceship::ConnectAPI::Certificate.all
298+
299+
# Filter for Distribution Certificates
300+
distribution_certs = certificates.select { |cert| cert.certificate_type == "DISTRIBUTION" }
301+
302+
# Handle case where no distribution certificates are found
303+
if distribution_certs.empty?
304+
puts "No Distribution certificates found! Triggering action to create certificate."
305+
new_certificate_needed = true
306+
else
307+
# Check for expiration
308+
distribution_certs.each do |cert|
309+
expiration_date = Time.parse(cert.expiration_date)
310+
311+
puts "Current Distribution Certificate: #{cert.id}, Expiration date: #{expiration_date}"
312+
313+
if expiration_date < Time.now
314+
puts "Distribution Certificate #{cert.id} is expired! Triggering action to renew certificate."
315+
new_certificate_needed = true
316+
else
317+
puts "Distribution certificate #{cert.id} is valid. No action required."
318+
end
319+
end
320+
end
321+
322+
# Write result to new_certificate_needed.txt
323+
file_path = File.expand_path('new_certificate_needed.txt')
324+
File.write(file_path, new_certificate_needed ? 'true' : 'false')
325+
326+
# Log the absolute path and contents of the new_certificate_needed.txt file
327+
puts ""
328+
puts "Absolute path of new_certificate_needed.txt: #{file_path}"
329+
new_certificate_needed_content = File.read(file_path)
330+
puts "Certificate creation or renewal needed: #{new_certificate_needed_content}"
331+
end
332+
end

0 commit comments

Comments
 (0)