diff --git a/.github/workflows/build_loop.yml b/.github/workflows/build_loop.yml index 7e02d0f29..115dd1f7b 100644 --- a/.github/workflows/build_loop.yml +++ b/.github/workflows/build_loop.yml @@ -17,23 +17,17 @@ env: ALIVE_BRANCH: alive jobs: - validate: - name: Validate - uses: ./.github/workflows/validate_secrets.yml - secrets: inherit - # Checks if Distribution certificate is present and valid, optionally nukes and # creates new certs if the repository variable ENABLE_NUKE_CERTS == 'true' check_certs: name: Check certificates - needs: validate uses: ./.github/workflows/check_certs.yml secrets: inherit # Checks if GH_PAT holds workflow permissions # Checks for existence of alive branch; if non-existent creates it check_alive_and_permissions: - needs: validate + needs: check_certs runs-on: ubuntu-latest name: Check alive branch and permissions permissions: @@ -94,7 +88,7 @@ jobs: # Checks for changes in upstream repository; if changes exist prompts sync for build # Performs keepalive to avoid stale fork check_latest_from_upstream: - needs: [validate, check_alive_and_permissions] + needs: [check_certs, check_alive_and_permissions] runs-on: ubuntu-latest name: Check upstream and keep alive outputs: @@ -163,7 +157,7 @@ jobs: # Builds Loop build: name: Build - needs: [validate, check_alive_and_permissions, check_latest_from_upstream, check_certs] + needs: [check_alive_and_permissions, check_latest_from_upstream, check_certs] runs-on: macos-14 permissions: contents: write diff --git a/.github/workflows/check_certs.yml b/.github/workflows/check_certs.yml index db915ff3e..4bee5634f 100644 --- a/.github/workflows/check_certs.yml +++ b/.github/workflows/check_certs.yml @@ -14,6 +14,11 @@ env: FASTLANE_KEY: ${{ secrets.FASTLANE_KEY }} jobs: + validate: + name: Validate + uses: ./.github/workflows/validate_secrets.yml + secrets: inherit + check_certs: runs-on: macos-14 outputs: @@ -95,40 +100,37 @@ jobs: # Nuke Certs if needed, and if the repository variable ENABLE_NUKE_CERTS is set to 'true', or if FORCE_NUKE_CERTS is set to 'true', which will always force certs to be nuked nuke_certs: - needs: check_certs - runs-on: macos-14 - if: ${{ (needs.check_certs.outputs.new_certificate_needed == 'true' && vars.ENABLE_NUKE_CERTS == 'true') || vars.FORCE_NUKE_CERTS == 'true' }} - steps: - - name: Debug check_certs output - run: echo "new_certificate_needed=${{ needs.check_certs.outputs.new_certificate_needed }}" - - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Install dependencies - run: bundle install - - - name: Run Fastlane nuke_certs - run: bundle exec fastlane nuke_certs - - - name: Annotate Summary after Nuke - run: | - echo "::warning::⚠️⚠️⚠️ All Distribution certificates and TestFlight profiles have been revoked." - - - # Trigger create_certs.yml if nuke_certs ran - trigger_create_certs: - needs: [check_certs, nuke_certs] - uses: ./.github/workflows/create_certs.yml - secrets: inherit - - # Annotate Summary after Certificate Creation - annotate_summary: - needs: trigger_create_certs - runs-on: ubuntu-latest - steps: - - name: Annotate Summary - run: | - echo "::warning::⚠️⚠️⚠️ Certificates have been recreated successfully." - echo "::warning::⚠️⚠️⚠️ If you have other apps being distributed by GitHub Actions / Fastlane / TestFlight, please run the '3. Create Certificates' workflow for each of these apps to allow these apps to be built." - echo "::warning::✅✅✅ But don't worry about your existing TestFlight builds, they will keep working!" \ No newline at end of file + needs: check_certs + runs-on: macos-14 + if: ${{ (needs.check_certs.outputs.new_certificate_needed == 'true' && vars.ENABLE_NUKE_CERTS == 'true') || vars.FORCE_NUKE_CERTS == 'true' }} + steps: + - name: Output from Check_certs + run: echo "new_certificate_needed=${{ needs.check_certs.outputs.new_certificate_needed }}" + + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Install dependencies + run: bundle install + + - name: Run Fastlane nuke_certs + run: | + set -e + bundle exec fastlane nuke_certs + + - name: Add warning annotations for nuke_certs + if: ${{ success() }} + run: | + echo "::warning::⚠️⚠️⚠️ All Distribution certificates and TestFlight profiles have been revoked." + + - name: Recreate Distribution certificate after nuking + run: | + set -e + bundle exec fastlane certs + + - name: Add success annotations for certificate recreation + if: ${{ success() }} + run: | + echo "::warning::⚠️⚠️⚠️ Certificates have been recreated successfully." + echo "::warning::❗️❗️❗️ If you have other apps being distributed by GitHub Actions / Fastlane / TestFlight that does not renew certificates automatically, please run the '3. Create Certificates' workflow for each of these apps to allow these apps to be built." + echo "::warning::✅✅✅ But don't worry about your existing TestFlight builds, they will keep working!"