Skip to content

Commit 9af3dbd

Browse files
bjorkertbjorkert
committed
Auto build and nuke certs
1 parent 9e43be4 commit 9af3dbd

3 files changed

Lines changed: 188 additions & 34 deletions

File tree

‎.github/workflows/build_LoopFollow.yml‎

Lines changed: 58 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,10 @@ name: 4. Build Loop Follow
22
run-name: Build Loop Follow (${{ github.ref_name }})
33
on:
44
workflow_dispatch:
5-
6-
## Remove the "#" sign from the beginning of the line below to get automated builds on push (code changes in your repository)
7-
#push:
8-
9-
## Remove the "#" sign from the beginning of the two lines below to get automated builds every two months
10-
#schedule:
11-
#- cron: '0 17 1 */2 *' # Runs at 17:00 UTC on the 1st in Jan, Mar, May, Jul, Sep and Nov.
12-
5+
push:
6+
schedule:
7+
- cron: "0 9 * * 3" # Weekly trigger: every Wednesday at 09:00 UTC
8+
- cron: "0 7 1 * *" # Monthly trigger: on the 1st of every month at 07:00 UTC
139

1410
jobs:
1511
validate:
@@ -22,25 +18,20 @@ jobs:
2218
needs: validate
2319
runs-on: macos-15
2420
steps:
25-
# Uncomment to manually select latest Xcode if needed
2621
- name: Select Latest Xcode
2722
run: "sudo xcode-select --switch /Applications/Xcode_16.2.app/Contents/Developer"
28-
29-
# Checks-out the repo
23+
3024
- name: Checkout Repo
3125
uses: actions/checkout@v4
3226
with:
3327
submodules: recursive
3428

35-
# Patch Fastlane Match to not print tables
3629
- name: Patch Match Tables
3730
run: find /usr/local/lib/ruby/gems -name table_printer.rb | xargs sed -i "" "/puts(Terminal::Table.new(params))/d"
38-
39-
# Sync the GitHub runner clock with the Windows time server (workaround as suggested in https://github.com/actions/runner/issues/2996)
31+
4032
- name: Sync clock
4133
run: sudo sntp -sS time.windows.com
4234

43-
# Build signed Loop Follow IPA file
4435
- name: Fastlane Build & Archive
4536
run: fastlane build_LoopFollow
4637
env:
@@ -51,7 +42,6 @@ jobs:
5142
FASTLANE_KEY: ${{ secrets.FASTLANE_KEY }}
5243
MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
5344

54-
# Upload to TestFlight
5545
- name: Fastlane upload to TestFlight
5646
run: fastlane release
5747
env:
@@ -61,12 +51,62 @@ jobs:
6151
FASTLANE_ISSUER_ID: ${{ secrets.FASTLANE_ISSUER_ID }}
6252
FASTLANE_KEY: ${{ secrets.FASTLANE_KEY }}
6353
MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
64-
65-
# Upload IPA and Symbols
54+
6655
- name: Upload IPA and Symbol artifacts
6756
uses: actions/upload-artifact@v4
6857
with:
6958
name: build-artifacts
7059
path: |
7160
artifacts
7261
buildlog
62+
63+
check_certs:
64+
name: Check Certificates
65+
uses: ./.github/workflows/create_certs.yml
66+
secrets: inherit
67+
68+
nuke_certs:
69+
name: Nuke Certificates
70+
needs: [validate, check_certs]
71+
runs-on: macos-14
72+
if: ${{ (needs.check_certs.outputs.new_certificate_needed == 'true' && vars.ENABLE_NUKE_CERTS == 'true') || vars.FORCE_NUKE_CERTS == 'true' }}
73+
steps:
74+
- name: Show certificate check output
75+
run: echo "new_certificate_needed=${{ needs.check_certs.outputs.new_certificate_needed }}"
76+
77+
- name: Checkout repository
78+
uses: actions/checkout@v4
79+
80+
- name: Install dependencies
81+
run: bundle install
82+
83+
- name: Run Fastlane nuke_certs
84+
run: |
85+
set -e
86+
bundle exec fastlane nuke_certs
87+
88+
- name: Recreate Distribution certificate after nuking
89+
run: |
90+
set -e
91+
bundle exec fastlane certs
92+
93+
- name: Add success annotations
94+
if: ${{ success() }}
95+
run: |
96+
echo "::warning::⚠️ All Distribution certificates and TestFlight profiles have been revoked and recreated."
97+
echo "::warning::❗️ If you have other apps that do not auto-renew certificates, run their 'Create Certificates' workflow."
98+
echo "::warning::✅ Your existing TestFlight builds will keep working!"
99+
100+
keep_alive:
101+
name: Keep Alive
102+
needs: [validate]
103+
runs-on: ubuntu-latest
104+
if: ${{ github.event_name == 'schedule' }}
105+
steps:
106+
- name: Checkout repository
107+
uses: actions/checkout@v4
108+
- name: Keep alive branch
109+
run: |
110+
git checkout -B alive-main
111+
git commit --allow-empty -m 'Keep alive commit'
112+
git push origin alive-main

‎.github/workflows/create_certs.yml‎

Lines changed: 73 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -13,26 +13,84 @@ jobs:
1313
name: Create Certificates
1414
needs: validate
1515
runs-on: macos-15
16+
outputs:
17+
new_certificate_needed: ${{ steps.set_output.outputs.new_certificate_needed }}
1618
steps:
17-
# Checks-out the repo
1819
- name: Checkout Repo
1920
uses: actions/checkout@v4
2021

21-
# Patch Fastlane Match to not print tables
2222
- name: Patch Match Tables
2323
run: find /usr/local/lib/ruby/gems -name table_printer.rb | xargs sed -i "" "/puts(Terminal::Table.new(params))/d"
24-
25-
# Sync the GitHub runner clock with the Windows time server (workaround as suggested in https://github.com/actions/runner/issues/2996)
24+
2625
- name: Sync clock
2726
run: sudo sntp -sS time.windows.com
28-
29-
# Create or update certificates for app
30-
- name: Create Certificates
31-
run: fastlane certs
32-
env:
33-
TEAMID: ${{ secrets.TEAMID }}
34-
GH_PAT: ${{ secrets.GH_PAT }}
35-
MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
36-
FASTLANE_KEY_ID: ${{ secrets.FASTLANE_KEY_ID }}
37-
FASTLANE_ISSUER_ID: ${{ secrets.FASTLANE_ISSUER_ID }}
38-
FASTLANE_KEY: ${{ secrets.FASTLANE_KEY }}
27+
28+
- name: Run Fastlane certs lane
29+
run: |
30+
echo "Running Fastlane certs lane..."
31+
bundle exec fastlane certs || true # ignore errors to continue with check
32+
33+
- name: Check Distribution certificate and renew if needed
34+
run: bundle exec fastlane check_and_renew_certificates
35+
id: check_certs
36+
37+
- name: Set output based on certificate status
38+
id: set_output
39+
run: |
40+
CERT_STATUS_FILE="${{ github.workspace }}/fastlane/new_certificate_needed.txt"
41+
ENABLE_NUKE_CERTS=${{ vars.ENABLE_NUKE_CERTS }}
42+
43+
if [ -f "$CERT_STATUS_FILE" ]; then
44+
CERT_STATUS=$(cat "$CERT_STATUS_FILE" | tr -d '\n' | tr -d '\r')
45+
echo "new_certificate_needed: $CERT_STATUS"
46+
echo "new_certificate_needed=$CERT_STATUS" >> $GITHUB_OUTPUT
47+
else
48+
echo "Certificate status file not found. Defaulting to false."
49+
echo "new_certificate_needed=false" >> $GITHUB_OUTPUT
50+
fi
51+
52+
# Warn if certificate renewal is disabled in the repo variables
53+
if [ "$CERT_STATUS" != "true" ] && [ "$ENABLE_NUKE_CERTS" != "true" ]; then
54+
echo "::notice::🔔 Automated renewal of certificates is disabled because ENABLE_NUKE_CERTS is not set to 'true'."
55+
fi
56+
57+
if [ "$CERT_STATUS" = "true" ] && [ "$ENABLE_NUKE_CERTS" != "true" ]; then
58+
echo "::error::❌ No valid distribution certificate found. Automated renewal was skipped because ENABLE_NUKE_CERTS is not 'true'."
59+
exit 1
60+
fi
61+
62+
if [ "${{ vars.FORCE_NUKE_CERTS }}" = "true" ]; then
63+
echo "::warning::‼️ Nuking of certificates was forced because FORCE_NUKE_CERTS is set to 'true'."
64+
fi
65+
66+
nuke_certs:
67+
name: Nuke certificates
68+
needs: [validate, certificates]
69+
runs-on: macos-14
70+
if: ${{ (needs.certificates.outputs.new_certificate_needed == 'true' && vars.ENABLE_NUKE_CERTS == 'true') || vars.FORCE_NUKE_CERTS == 'true' }}
71+
steps:
72+
- name: Show certificate check output
73+
run: echo "new_certificate_needed=${{ needs.certificates.outputs.new_certificate_needed }}"
74+
75+
- name: Checkout repository
76+
uses: actions/checkout@v4
77+
78+
- name: Install dependencies
79+
run: bundle install
80+
81+
- name: Run Fastlane nuke_certs
82+
run: |
83+
set -e
84+
bundle exec fastlane nuke_certs
85+
86+
- name: Recreate Distribution certificate after nuking
87+
run: |
88+
set -e
89+
bundle exec fastlane certs
90+
91+
- name: Add success annotations
92+
if: ${{ success() }}
93+
run: |
94+
echo "::warning::⚠️ All Distribution certificates and TestFlight profiles have been revoked and recreated."
95+
echo "::warning::❗️ If you have other apps that do not auto-renew certificates, please run the '3. Create Certificates' workflow for each."
96+
echo "::warning::✅ Your existing TestFlight builds will keep working!"

‎fastlane/Fastfile‎

Lines changed: 57 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -199,4 +199,60 @@ platform :ios do
199199
git_basic_authorization: Base64.strict_encode64("#{GITHUB_REPOSITORY_OWNER}:#{GH_PAT}")
200200
)
201201
end
202-
end
202+
203+
#####################################################################
204+
# Additional lanes to support scheduled building and certificate nuking
205+
#####################################################################
206+
207+
desc "Check Certificates and Trigger Workflow for Expired or Missing Certificates"
208+
lane :check_and_renew_certificates do
209+
setup_ci if ENV['CI']
210+
ENV["MATCH_READONLY"] = false.to_s
211+
212+
api_key = app_store_connect_api_key(
213+
key_id: ENV["FASTLANE_KEY_ID"],
214+
issuer_id: ENV["FASTLANE_ISSUER_ID"],
215+
key_content: ENV["FASTLANE_KEY"] # Ensure valid key content
216+
)
217+
218+
new_certificate_needed = false
219+
220+
require 'time'
221+
certificates = Spaceship::ConnectAPI::Certificate.all
222+
223+
distribution_certs = certificates.select { |cert| cert.certificate_type == "DISTRIBUTION" }
224+
225+
if distribution_certs.empty?
226+
puts "No Distribution certificates found! Triggering action to create certificate."
227+
new_certificate_needed = true
228+
else
229+
distribution_certs.each do |cert|
230+
expiration_date = Time.parse(cert.expiration_date)
231+
232+
puts "Current Distribution Certificate: #{cert.id}, Expiration date: #{expiration_date}"
233+
234+
if expiration_date < Time.now
235+
puts "Distribution Certificate #{cert.id} is expired! Triggering action to renew certificate."
236+
new_certificate_needed = true
237+
else
238+
puts "Distribution certificate #{cert.id} is valid. No action required."
239+
end
240+
end
241+
end
242+
243+
file_path = File.expand_path('new_certificate_needed.txt')
244+
File.write(file_path, new_certificate_needed ? 'true' : 'false')
245+
246+
puts ""
247+
puts "Absolute path of new_certificate_needed.txt: #{file_path}"
248+
new_certificate_needed_content = File.read(file_path)
249+
puts "Certificate creation or renewal needed: #{new_certificate_needed_content}"
250+
end
251+
252+
desc "Keep Alive: Create an empty commit to keep the branch active"
253+
lane :keep_alive do
254+
sh "git checkout -B alive-main"
255+
sh "git commit --allow-empty -m 'Keep alive commit'"
256+
sh "git push origin alive-main"
257+
end
258+
end

0 commit comments

Comments
 (0)