|
1 | 1 | name: 1. Validate Secrets |
2 | | -run-name: Validate Secrets |
| 2 | +run-name: Validate Secrets (${{ github.ref_name }}) |
3 | 3 | on: [workflow_call, workflow_dispatch] |
4 | | - |
| 4 | + |
5 | 5 | jobs: |
6 | | - validate: |
7 | | - runs-on: macos-12 |
| 6 | + validate-access-token: |
| 7 | + name: Access |
| 8 | + runs-on: macos-13 |
| 9 | + env: |
| 10 | + GH_PAT: ${{ secrets.GH_PAT }} |
| 11 | + GH_TOKEN: ${{ secrets.GH_PAT }} |
| 12 | + steps: |
| 13 | + - name: Validate Access Token |
| 14 | + run: | |
| 15 | + # Validate Fastlane Access Token (GH_PAT) |
| 16 | + if [ -z "$GH_PAT" ]; then |
| 17 | + failed=true |
| 18 | + echo "::error::The GH_PAT secret is unset or empty. Set it and try again." |
| 19 | + elif [ "$(gh api -H "Accept: application/vnd.github+json" /repos/${{ github.repository_owner }}/LoopWorkspace | jq --raw-output '.permissions.push')" != "true" ]; then |
| 20 | + failed=true |
| 21 | + echo "::error::The GH_PAT secret is set but invalid or lacking at least 'repo' permission scope ('repo, workflow' is okay too).\ |
| 22 | + Verify that token permissions are set correctly (or update them) at https://github.com/settings/tokens and try again." |
| 23 | + fi |
| 24 | + |
| 25 | + # Exit unsuccessfully if secret validation failed. |
| 26 | + if [ $failed ]; then |
| 27 | + exit 2 |
| 28 | + fi |
| 29 | + |
| 30 | + validate-match-secrets: |
| 31 | + name: Match-Secrets |
| 32 | + needs: validate-access-token |
| 33 | + runs-on: macos-13 |
| 34 | + env: |
| 35 | + GH_TOKEN: ${{ secrets.GH_PAT }} |
| 36 | + steps: |
| 37 | + - name: Validate Match-Secrets |
| 38 | + run: | |
| 39 | + # Validate Match-Secrets |
| 40 | + if [ "$(gh repo list --json name | jq --raw-output 'any(.name=="Match-Secrets")')" != "true" ]; then |
| 41 | + echo "A 'Match-Secrets' repository could not be found. Attempting to create one..."; |
| 42 | + |
| 43 | + if gh repo create Match-Secrets --private >/dev/null && [ "$(gh repo list --json name,visibility | jq --raw-output '.[] | select(.name=="Match-Secrets") | .visibility == "PRIVATE"')" == "true" ]; then |
| 44 | + echo "Created a private 'Match-Secrets' repository." |
| 45 | + else |
| 46 | + failed=true |
| 47 | + echo "::error::Cannot access or create a private 'Match-Secrets' repository. The GH_PAT secret is lacking at least the 'repo' permission scope required to access or create the repository.\ |
| 48 | + Verify that token permissions are set correctly (or update them) at https://github.com/settings/tokens and try again." |
| 49 | + fi |
| 50 | + elif [ "$(gh repo list --json name,visibility | jq --raw-output '.[] | select(.name=="Match-Secrets") | .visibility == "PUBLIC"')" == "true" ]; then |
| 51 | + failed=true |
| 52 | + echo "::error::A 'Match-Secrets' repository was found, but it is is public. Delete it and try again (a private repository will be created for you)." |
| 53 | + fi |
| 54 | + |
| 55 | + # Exit unsuccessfully if secret validation failed. |
| 56 | + if [ $failed ]; then |
| 57 | + exit 2 |
| 58 | + fi |
| 59 | + |
| 60 | + validate-fastlane-secrets: |
| 61 | + name: Fastlane |
| 62 | + needs: validate-match-secrets |
| 63 | + runs-on: macos-13 |
| 64 | + env: |
| 65 | + GH_PAT: ${{ secrets.GH_PAT }} |
| 66 | + GH_TOKEN: ${{ secrets.GH_PAT }} |
| 67 | + FASTLANE_ISSUER_ID: ${{ secrets.FASTLANE_ISSUER_ID }} |
| 68 | + FASTLANE_KEY_ID: ${{ secrets.FASTLANE_KEY_ID }} |
| 69 | + FASTLANE_KEY: ${{ secrets.FASTLANE_KEY }} |
| 70 | + MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }} |
| 71 | + TEAMID: ${{ secrets.TEAMID }} |
8 | 72 | steps: |
9 | | - # Checks-out the repo |
10 | 73 | - name: Checkout Repo |
11 | 74 | uses: actions/checkout@v3 |
12 | | - |
13 | | - # Validates the repo secrets |
14 | | - - name: Validate Secrets |
| 75 | + |
| 76 | + - name: Validate Fastlane Secrets |
15 | 77 | run: | |
16 | | - # Validate Secrets |
17 | | - echo Validating Repository Secrets... |
| 78 | + # Validate Fastlane Secrets |
18 | 79 | |
19 | 80 | # Validate TEAMID |
20 | 81 | if [ -z "$TEAMID" ]; then |
21 | 82 | failed=true |
22 | | - echo "::error::TEAMID secret is unset or empty. Set it and try again." |
| 83 | + echo "::error::The TEAMID secret is unset or empty. Set it and try again." |
23 | 84 | elif [ ${#TEAMID} -ne 10 ]; then |
24 | 85 | failed=true |
25 | | - echo "::error::TEAMID secret is set but has wrong length. Verify that it is set correctly and try again." |
| 86 | + echo "::error::The TEAMID secret is set but has wrong length. Verify that it is set correctly and try again." |
| 87 | + elif ! [[ $TEAMID =~ ^[A-Z0-9]+$ ]]; then |
| 88 | + failed=true |
| 89 | + echo "::error::The TEAMID secret is set but invalid. Verify that it is set correctly (only uppercase letters and numbers) and try again." |
26 | 90 | fi |
27 | 91 | |
28 | | - # Validate GH_PAT |
29 | | - if [ -z "$GH_PAT" ]; then |
30 | | - failed=true |
31 | | - echo "::error::GH_PAT secret is unset or empty. Set it and try again." |
32 | | - elif [ "$(gh api -H "Accept: application/vnd.github+json" /repos/${{ github.repository_owner }}/Match-Secrets | jq --raw-output '.permissions.push')" != "true" ]; then |
| 92 | + # Validate MATCH_PASSWORD |
| 93 | + if [ -z "$MATCH_PASSWORD" ]; then |
33 | 94 | failed=true |
34 | | - echo "::error::GH_PAT secret is set but invalid or lacking appropriate privileges on the ${{ github.repository_owner }}/Match-Secrets repository. Verify that it is set correctly and try again." |
| 95 | + echo "::error::The MATCH_PASSWORD secret is unset or empty. Set it and try again." |
35 | 96 | fi |
36 | 97 | |
| 98 | + # Ensure that fastlane exit codes are handled when output is piped. |
| 99 | + set -o pipefail |
| 100 | + |
37 | 101 | # Validate FASTLANE_ISSUER_ID, FASTLANE_KEY_ID, and FASTLANE_KEY |
| 102 | + FASTLANE_KEY_ID_PATTERN='^[A-Z0-9]+$' |
| 103 | + FASTLANE_ISSUER_ID_PATTERN='^\{?[A-F0-9a-f]{8}-[A-F0-9a-f]{4}-[A-F0-9a-f]{4}-[A-F0-9a-f]{4}-[A-F0-9a-f]{12}\}?$' |
| 104 | + |
38 | 105 | if [ -z "$FASTLANE_ISSUER_ID" ] || [ -z "$FASTLANE_KEY_ID" ] || [ -z "$FASTLANE_KEY" ]; then |
39 | 106 | failed=true |
40 | 107 | [ -z "$FASTLANE_ISSUER_ID" ] && echo "::error::The FASTLANE_ISSUER_ID secret is unset or empty. Set it and try again." |
41 | 108 | [ -z "$FASTLANE_KEY_ID" ] && echo "::error::The FASTLANE_KEY_ID secret is unset or empty. Set it and try again." |
42 | 109 | [ -z "$FASTLANE_KEY" ] && echo "::error::The FASTLANE_KEY secret is unset or empty. Set it and try again." |
43 | | - elif ! echo "$FASTLANE_KEY" | openssl pkcs8 -nocrypt >/dev/null; then |
| 110 | + elif [ ${#FASTLANE_KEY_ID} -ne 10 ]; then |
44 | 111 | failed=true |
45 | | - echo "::error::The FASTLANE_KEY secret is set but invalid. Verify that it is set correctly and try again." |
46 | | - elif ! fastlane validate_secrets; then |
| 112 | + echo "::error::The FASTLANE_KEY_ID secret is set but has wrong length. Verify that you copied it correctly from the 'Keys' tab at https://appstoreconnect.apple.com/access/api and try again." |
| 113 | + elif ! [[ $FASTLANE_KEY_ID =~ $FASTLANE_KEY_ID_PATTERN ]]; then |
47 | 114 | failed=true |
48 | | - echo "::error::Unable to create a valid authorization token for the App Store Connect API.\ |
49 | | - Verify that the FASTLANE_ISSUER_ID, FASTLANE_KEY_ID, and FASTLANE_KEY secrets are set correctly and try again." |
50 | | - fi |
51 | | - |
52 | | - # Validate MATCH_PASSWORD |
53 | | - if [ -z "$MATCH_PASSWORD" ]; then |
| 115 | + echo "::error::The FASTLANE_KEY_ID secret is set but invalid. Verify that you copied it correctly from the 'Keys' tab at https://appstoreconnect.apple.com/access/api and try again." |
| 116 | + elif ! [[ $FASTLANE_ISSUER_ID =~ $FASTLANE_ISSUER_ID_PATTERN ]]; then |
54 | 117 | failed=true |
55 | | - echo "::error::The MATCH_PASSWORD secret is unset or empty. Set it and try again." |
| 118 | + echo "::error::The FASTLANE_ISSUER_ID secret is set but invalid. Verify that you copied it correctly from the 'Keys' tab at https://appstoreconnect.apple.com/access/api and try again." |
| 119 | + elif ! echo "$FASTLANE_KEY" | openssl pkcs8 -nocrypt >/dev/null; then |
| 120 | + failed=true |
| 121 | + echo "::error::The FASTLANE_KEY secret is set but invalid. Verify that you copied it correctly from the API Key file (*.p8) you downloaded and try again." |
| 122 | + elif ! fastlane validate_secrets 2>&1 | tee fastlane.log; then |
| 123 | + if grep -q "bad decrypt" fastlane.log; then |
| 124 | + failed=true |
| 125 | + echo "::error::Unable to decrypt the Match-Secrets repository using the MATCH_PASSWORD secret. Verify that it is set correctly and try again." |
| 126 | + elif ! grep -q "No code signing identity found" fastlane.log; then |
| 127 | + failed=true |
| 128 | + echo "::error::Unable to create a valid authorization token for the App Store Connect API.\ |
| 129 | + Verify that the FASTLANE_ISSUER_ID, FASTLANE_KEY_ID, and FASTLANE_KEY secrets are set correctly and try again." |
| 130 | + fi |
56 | 131 | fi |
57 | 132 | |
58 | 133 | # Exit unsuccessfully if secret validation failed. |
59 | 134 | if [ $failed ]; then |
60 | 135 | exit 2 |
61 | 136 | fi |
62 | | - shell: bash |
63 | | - env: |
64 | | - TEAMID: ${{ secrets.TEAMID }} |
65 | | - GH_PAT: ${{ secrets.GH_PAT }} |
66 | | - FASTLANE_ISSUER_ID: ${{ secrets.FASTLANE_ISSUER_ID }} |
67 | | - FASTLANE_KEY_ID: ${{ secrets.FASTLANE_KEY_ID }} |
68 | | - FASTLANE_KEY: ${{ secrets.FASTLANE_KEY }} |
69 | | - MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }} |
70 | | - GH_TOKEN: ${{ secrets.GH_PAT }} |
|
0 commit comments