- Remove validate job from check_certs

- Simplify nuke_certs and recreation of certs - refine annotations build: remove validate, needs check_certs instead
bjornoleh · Jan 12, 2025 · 59f66b4 · 59f66b4
1 parent 5f5ec7e
commit 59f66b4
Show file tree

Hide file tree

Showing 2 changed files with 42 additions and 46 deletions.
diff --git a/.github/workflows/build_loop.yml b/.github/workflows/build_loop.yml
@@ -17,23 +17,17 @@ env:
   ALIVE_BRANCH: alive
 
 jobs:
-  validate:
-    name: Validate
-    uses: ./.github/workflows/validate_secrets.yml
-    secrets: inherit
-
   # Checks if Distribution certificate is present and valid, optionally nukes and
   # creates new certs if the repository variable ENABLE_NUKE_CERTS == 'true'
   check_certs: 
       name: Check certificates
-      needs: validate
       uses: ./.github/workflows/check_certs.yml
       secrets: inherit
 
   # Checks if GH_PAT holds workflow permissions
   # Checks for existence of alive branch; if non-existent creates it
   check_alive_and_permissions:
-    needs: validate
+    needs: check_certs
     runs-on: ubuntu-latest
     name: Check alive branch and permissions
     permissions:
@@ -94,7 +88,7 @@ jobs:
   # Checks for changes in upstream repository; if changes exist prompts sync for build
   # Performs keepalive to avoid stale fork
   check_latest_from_upstream:
-    needs: [validate, check_alive_and_permissions]
+    needs: [check_certs, check_alive_and_permissions]
     runs-on: ubuntu-latest
     name: Check upstream and keep alive
     outputs: 
@@ -163,7 +157,7 @@ jobs:
   # Builds Loop
   build:
     name: Build
-    needs: [validate, check_alive_and_permissions, check_latest_from_upstream, check_certs]
+    needs: [check_alive_and_permissions, check_latest_from_upstream, check_certs]
     runs-on: macos-14
     permissions:
       contents: write

diff --git a/.github/workflows/check_certs.yml b/.github/workflows/check_certs.yml
@@ -14,6 +14,11 @@ env:
   FASTLANE_KEY: ${{ secrets.FASTLANE_KEY }}
 
 jobs:
+  validate:
+    name: Validate
+    uses: ./.github/workflows/validate_secrets.yml
+    secrets: inherit
+
   check_certs:
     runs-on: macos-14
     outputs:
@@ -95,40 +100,37 @@ jobs:
 
   # Nuke Certs if needed, and if the repository variable ENABLE_NUKE_CERTS is set to 'true', or if FORCE_NUKE_CERTS is set to 'true', which will always force certs to be nuked
   nuke_certs:
-    needs: check_certs
-    runs-on: macos-14
-    if: ${{ (needs.check_certs.outputs.new_certificate_needed == 'true' && vars.ENABLE_NUKE_CERTS == 'true') || vars.FORCE_NUKE_CERTS == 'true' }}
-    steps:
-      - name: Debug check_certs output
-        run: echo "new_certificate_needed=${{ needs.check_certs.outputs.new_certificate_needed }}"
-
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install dependencies
-        run: bundle install
-
-      - name: Run Fastlane nuke_certs
-        run: bundle exec fastlane nuke_certs
-
-      - name: Annotate Summary after Nuke
-        run: |
-          echo "::warning::⚠️⚠️⚠️   All Distribution certificates and TestFlight profiles have been revoked."
-    
-
-  # Trigger create_certs.yml if nuke_certs ran
-  trigger_create_certs:
-    needs: [check_certs, nuke_certs]
-    uses: ./.github/workflows/create_certs.yml
-    secrets: inherit
-
-  # Annotate Summary after Certificate Creation
-  annotate_summary:
-    needs: trigger_create_certs
-    runs-on: ubuntu-latest
-    steps:
-      - name: Annotate Summary
-        run: |
-          echo "::warning::⚠️⚠️⚠️   Certificates have been recreated successfully."
-          echo "::warning::⚠️⚠️⚠️   If you have other apps being distributed by GitHub Actions / Fastlane / TestFlight, please run the '3. Create Certificates' workflow for each of these apps to allow these apps to be built."
-          echo "::warning::✅✅✅   But don't worry about your existing TestFlight builds, they will keep working!"
+      needs: check_certs
+      runs-on: macos-14
+      if: ${{ (needs.check_certs.outputs.new_certificate_needed == 'true' && vars.ENABLE_NUKE_CERTS == 'true') || vars.FORCE_NUKE_CERTS == 'true' }}
+      steps:
+        - name: Output from Check_certs
+          run: echo "new_certificate_needed=${{ needs.check_certs.outputs.new_certificate_needed }}"
+
+        - name: Checkout repository
+          uses: actions/checkout@v4
+
+        - name: Install dependencies
+          run: bundle install
+
+        - name: Run Fastlane nuke_certs
+          run: |
+            set -e
+            bundle exec fastlane nuke_certs
+
+        - name: Add warning annotations for nuke_certs
+          if: ${{ success() }}
+          run: |
+            echo "::warning::⚠️⚠️⚠️ All Distribution certificates and TestFlight profiles have been revoked."
+
+        - name: Recreate Distribution certificate after nuking
+          run: |
+            set -e
+            bundle exec fastlane certs
+
+        - name: Add success annotations for certificate recreation
+          if: ${{ success() }}
+          run: |
+            echo "::warning::⚠️⚠️⚠️ Certificates have been recreated successfully."
+            echo "::warning::❗️❗️❗️ If you have other apps being distributed by GitHub Actions / Fastlane / TestFlight that does not renew certificates automatically, please run the '3. Create Certificates' workflow for each of these apps to allow these apps to be built."
+            echo "::warning::✅✅✅ But don't worry about your existing TestFlight builds, they will keep working!"