Skip to content

Commit e07ef08

Browse files
umbynosumbynos
authored
Merge branch 'devel' into certificate-error
2 parents 31b4a98 + 5e21da8 commit e07ef08

File tree

946 files changed

+16292
-200285
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

946 files changed

+16292
-200285
lines changed

‎.github/ISSUE_TEMPLATE/bug_report.md

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
name: 🐛 Bug report
3+
about: Create a report to help us improve
4+
---
5+
6+
## Bug Report
7+
8+
### Describe the bug
9+
<!-- A clear and concise description of what the bug is.-->
10+
11+
### To Reproduce
12+
<!--Steps to reproduce the behavior:-->
13+
14+
### Expected behavior
15+
<!--A clear and concise description of what you expected to happen.-->
16+
17+
## Environment (please complete the following information):
18+
- OS [e.g. Windows]:
19+
- OS version
20+
- Browser [e.g. chrome, safari]:
21+
- Browser Version:
22+
- Agent Version [e.g. 1.0.0]:
23+
24+
## Additional context
25+
<!--Add any other context about the problem here.-->

‎.github/pull_request_template.md

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
**Please check if the PR fulfills these requirements**
2+
3+
- [ ] The PR has no duplicates (please search among the [Pull Requests](https://github.com/arduino/arduino-create-agent/pulls)
4+
before creating one)
5+
- [ ] Tests for the changes have been added (for bug fixes / features)
6+
7+
* **What kind of change does this PR introduce?**
8+
<!-- Bug fix, feature, ... -->
9+
10+
- **What is the current behavior?**
11+
<!-- You can also link to an open issue here -->
12+
13+
* **What is the new behavior?**
14+
<!-- if this is a feature change -->
15+
16+
- **Does this PR introduce a breaking change?**
17+
<!-- What changes might users need to make in their workflow or application due to this PR? -->
18+
19+
* **Other information**:
20+
<!-- Any additional information that could help the review process -->

‎.github/workflows/check-certificates.yml

+114
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
name: Check for issues with signing certificates
2+
3+
on:
4+
schedule:
5+
# run every 10 hours
6+
- cron: "0 */10 * * *"
7+
# workflow_dispatch event allows the workflow to be triggered manually.
8+
# This could be used to run an immediate check after updating certificate secrets.
9+
# See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows#workflow_dispatch
10+
workflow_dispatch:
11+
12+
env:
13+
# Begin notifications when there are less than this many days remaining before expiration
14+
EXPIRATION_WARNING_PERIOD: 30
15+
16+
jobs:
17+
check-certificates:
18+
runs-on: ubuntu-18.04
19+
20+
strategy:
21+
fail-fast: false
22+
23+
matrix:
24+
certificate:
25+
- identifier: macOS signing certificate # Text used to identify the certificate in notifications
26+
certificate-secret: INSTALLER_CERT_MAC_P12 # The name of the secret that contains the certificate
27+
password-secret: INSTALLER_CERT_MAC_PASSWORD # The name of the secret that contains the certificate password
28+
- identifier: Windows signing certificate
29+
certificate-secret: INSTALLER_CERT_WINDOWS_PFX
30+
password-secret: INSTALLER_CERT_WINDOWS_PASSWORD
31+
32+
steps:
33+
- name: Set certificate path environment variable
34+
run: |
35+
# See: https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-commands-for-github-actions#setting-an-environment-variable
36+
echo "CERTIFICATE_PATH=${{ runner.temp }}/certificate.p12" >> "$GITHUB_ENV"
37+
- name: Decode certificate
38+
env:
39+
CERTIFICATE: ${{ secrets[matrix.certificate.certificate-secret] }}
40+
run: |
41+
echo "${{ env.CERTIFICATE }}" | base64 --decode > "${{ env.CERTIFICATE_PATH }}"
42+
- name: Verify certificate
43+
env:
44+
CERTIFICATE_PASSWORD: ${{ secrets[matrix.certificate.password-secret] }}
45+
run: |
46+
(
47+
openssl pkcs12 \
48+
-in "${{ env.CERTIFICATE_PATH }}" \
49+
-noout -passin env:CERTIFICATE_PASSWORD
50+
) || (
51+
echo "::error::Verification of ${{ matrix.certificate.identifier }} failed!!!"
52+
exit 1
53+
)
54+
# See: https://github.com/rtCamp/action-slack-notify
55+
- name: Slack notification of certificate verification failure
56+
if: failure()
57+
uses: rtCamp/[email protected]
58+
env:
59+
SLACK_WEBHOOK: ${{ secrets.TEAM_CREATE_CHANNEL_SLACK_WEBHOOK }}
60+
SLACK_MESSAGE: |
61+
:warning::warning::warning::warning:
62+
WARNING: ${{ github.repository }} ${{ matrix.certificate.identifier }} verification failed!!!
63+
:warning::warning::warning::warning:
64+
SLACK_COLOR: danger
65+
MSG_MINIMAL: true
66+
67+
- name: Get days remaining before certificate expiration date
68+
env:
69+
CERTIFICATE_PASSWORD: ${{ secrets[matrix.certificate.password-secret] }}
70+
id: get-days-before-expiration
71+
run: |
72+
EXPIRATION_DATE="$(
73+
(
74+
openssl pkcs12 \
75+
-in "${{ env.CERTIFICATE_PATH }}" \
76+
-clcerts \
77+
-nodes \
78+
-passin env:CERTIFICATE_PASSWORD
79+
) | (
80+
openssl x509 \
81+
-noout \
82+
-enddate
83+
) | (
84+
grep \
85+
--max-count=1 \
86+
--only-matching \
87+
--perl-regexp \
88+
'notAfter=(\K.*)'
89+
)
90+
)"
91+
DAYS_BEFORE_EXPIRATION="$((($(date --utc --date="$EXPIRATION_DATE" +%s) - $(date --utc +%s)) / 60 / 60 / 24))"
92+
# Display the expiration information in the log
93+
echo "Certificate expiration date: $EXPIRATION_DATE"
94+
echo "Days remaining before expiration: $DAYS_BEFORE_EXPIRATION"
95+
echo "::set-output name=days::$DAYS_BEFORE_EXPIRATION"
96+
- name: Check if expiration notification period has been reached
97+
id: check-expiration
98+
run: |
99+
if [[ ${{ steps.get-days-before-expiration.outputs.days }} -lt ${{ env.EXPIRATION_WARNING_PERIOD }} ]]; then
100+
echo "::error::${{ matrix.certificate.identifier }} will expire in ${{ steps.get-days-before-expiration.outputs.days }} days!!!"
101+
exit 1
102+
fi
103+
- name: Slack notification of pending certificate expiration
104+
# Don't send spurious expiration notification if verification fails
105+
if: failure() && steps.check-expiration.outcome == 'failure'
106+
uses: rtCamp/[email protected]
107+
env:
108+
SLACK_WEBHOOK: ${{ secrets.TEAM_CREATE_CHANNEL_SLACK_WEBHOOK }}
109+
SLACK_MESSAGE: |
110+
:warning::warning::warning::warning:
111+
WARNING: ${{ github.repository }} ${{ matrix.certificate.identifier }} will expire in ${{ steps.get-days-before-expiration.outputs.days }} days!!!
112+
:warning::warning::warning::warning:
113+
SLACK_COLOR: danger
114+
MSG_MINIMAL: true

0 commit comments

Comments
 (0)