Skip to content

Commit 5a37bc1

Browse files
silvanocerzasilvanocerza
authored
Standardize repository structure (#17)
* Update README and add LICENSE file * Add issue template * Add workflow to check for certificates validity * Add .gitignore * Updated go lint dependency * Add Taskfile * Update test workflow * Add DistTasks.yml to generate file for distribution * Add release workflow * Add .prettierrc and .prettierignore * Add verify formatting workflow * Add stale issues workflow * Add link validation workflow * Add check notarization certificates workflow * Fix README.md formatting * Fix certificates workflows * Fix notarization in release workflow * Fix actions casing * Fix stale issues workflow * Fix test workflow * Fix LICENSE file * Update markdown link check config * Update README.md * Fix certificates workflow * Fix link validation workflow * Fix release workflow * Add gon config file for OS X notarization * Fix release workflow * Fix certificates workflows
1 parent 2737cb3 commit 5a37bc1

20 files changed

+1413
-185
lines changed

Diff for: ‎.github/ISSUE_TEMPLATE/bug_report.md

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
name: 🐛 Bug Report
3+
about: If something isn't working as expected 🤔.
4+
---
5+
6+
## Bug Report
7+
8+
### Current behavior
9+
10+
<!-- Paste the full command you run -->
11+
12+
<!-- Add a clear and concise description of the behavior. -->
13+
14+
### Expected behavior
15+
16+
<!-- Add a clear and concise description of what you expected to happen. -->
17+
18+
### Environment
19+
20+
- Updater version:
21+
- OS and platform:
22+
23+
### Additional context
24+
25+
<!-- (Optional) Add any other context about the problem here. -->

Diff for: ‎.github/workflows/check-certificates.yml

+99
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
name: Check for issues with signing certificates
2+
3+
on:
4+
schedule:
5+
# run every 10 hours
6+
- cron: "0 */10 * * *"
7+
# workflow_dispatch event allows the workflow to be triggered manually.
8+
# This could be used to run an immediate check after updating certificate secrets.
9+
# See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows#workflow_dispatch
10+
workflow_dispatch:
11+
12+
env:
13+
# Begin notifications when there are less than this many days remaining before expiration
14+
EXPIRATION_WARNING_PERIOD: 30
15+
16+
jobs:
17+
get-certificates-list:
18+
# This workflow would fail in forks that don't have the certificate secrets defined
19+
if: github.repository == 'arduino/FirmwareUpdater'
20+
runs-on: ubuntu-latest
21+
outputs:
22+
certificates: ${{ steps.get-files.outputs.certificates }}
23+
24+
steps:
25+
- name: checkout
26+
uses: actions/checkout@v2
27+
28+
- name: Set certificates path environment variable
29+
run: |
30+
# See: https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-commands-for-github-actions#setting-an-environment-variable
31+
echo "FILES=\"$(ls ${{ github.workspace }}/certs/* | xargs | sed 's/ /","/g')\"" >> $GITHUB_ENV
32+
33+
- name: Get files list
34+
id: get-files
35+
run: |
36+
JSON=$(echo '[${{ join(env.FILES) }}]' | jq -c '{"cert_file": .}')
37+
echo "::set-output name=certificates::$JSON"
38+
39+
check-certificates:
40+
# This workflow would fail in forks that don't have the certificate secrets defined
41+
if: github.repository == 'arduino/FirmwareUpdater'
42+
runs-on: ubuntu-latest
43+
needs: get-certificates-list
44+
45+
strategy:
46+
fail-fast: false
47+
matrix: ${{fromJSON(needs.get-certificates-list.outputs.certificates)}}
48+
49+
steps:
50+
- name: checkout
51+
uses: actions/checkout@v2
52+
53+
- name: Get days remaining before certificate expiration date
54+
id: get-days-before-expiration
55+
run: |
56+
EXPIRATION_DATE="$(
57+
(
58+
openssl x509 \
59+
-inform der \
60+
-in ${{ matrix.cert_file }} \
61+
-enddate -noout
62+
) | (
63+
grep \
64+
--max-count=1 \
65+
--only-matching \
66+
--perl-regexp \
67+
'notAfter=(\K.*)'
68+
)
69+
)"
70+
71+
DAYS_BEFORE_EXPIRATION="$((($(date --utc --date="$EXPIRATION_DATE" +%s) - $(date --utc +%s)) / 60 / 60 / 24))"
72+
73+
# Display the expiration information in the log
74+
echo "Certificate expiration date: $EXPIRATION_DATE"
75+
echo "Days remaining before expiration: $DAYS_BEFORE_EXPIRATION"
76+
77+
echo "::set-output name=days::$DAYS_BEFORE_EXPIRATION"
78+
79+
- name: Check if expiration notification period has been reached
80+
id: check-expiration
81+
run: |
82+
DAYS=${{ steps.get-days-before-expiration.outputs.days }}
83+
if [[ $DAYS -lt ${{ env.EXPIRATION_WARNING_PERIOD }} ]]; then
84+
echo "::error::${{ matrix.cert_file }} will expire in $DAYS days!!!"
85+
exit 1
86+
fi
87+
88+
- name: Slack notification of pending certificate expiration
89+
# Don't send spurious expiration notification if verification fails
90+
if: failure() && steps.check-expiration.outcome == 'failure'
91+
uses: rtCamp/[email protected]
92+
env:
93+
SLACK_WEBHOOK: ${{ secrets.TEAM_TOOLING_CHANNEL_SLACK_WEBHOOK }}
94+
SLACK_MESSAGE: |
95+
:warning::warning::warning::warning:
96+
WARNING: ${{ github.repository }} ${{ matrix.cert_file }} will expire in ${{ steps.get-days-before-expiration.outputs.days }} days!!!
97+
:warning::warning::warning::warning:
98+
SLACK_COLOR: danger
99+
MSG_MINIMAL: true

Diff for: ‎.github/workflows/check-notarization-certificates.yml

+121
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
name: Check for issues with notarization certificates
2+
3+
on:
4+
schedule:
5+
# run every 10 hours
6+
- cron: "0 */10 * * *"
7+
# workflow_dispatch event allows the workflow to be triggered manually.
8+
# This could be used to run an immediate check after updating certificate secrets.
9+
# See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows#workflow_dispatch
10+
workflow_dispatch:
11+
12+
env:
13+
# Begin notifications when there are less than this many days remaining before expiration
14+
EXPIRATION_WARNING_PERIOD: 30
15+
16+
jobs:
17+
check-certificates:
18+
# This workflow would fail in forks that don't have the certificate secrets defined
19+
if: github.repository == 'arduino/FirmwareUpdater'
20+
runs-on: ubuntu-latest
21+
22+
strategy:
23+
fail-fast: false
24+
25+
matrix:
26+
certificate:
27+
- identifier: macOS signing certificate # Text used to identify the certificate in notifications
28+
certificate-secret: INSTALLER_CERT_MAC_P12 # The name of the secret that contains the certificate
29+
password-secret: INSTALLER_CERT_MAC_PASSWORD # The name of the secret that contains the certificate password
30+
31+
steps:
32+
- name: Set certificate path environment variable
33+
run: |
34+
# See: https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-commands-for-github-actions#setting-an-environment-variable
35+
echo "CERTIFICATE_PATH=${{ runner.temp }}/certificate.p12" >> "$GITHUB_ENV"
36+
37+
- name: Decode certificate
38+
env:
39+
CERTIFICATE: ${{ secrets[matrix.certificate.certificate-secret] }}
40+
run: |
41+
echo "${{ env.CERTIFICATE }}" | base64 --decode > "${{ env.CERTIFICATE_PATH }}"
42+
43+
- name: Verify certificate
44+
env:
45+
CERTIFICATE_PASSWORD: ${{ secrets[matrix.certificate.password-secret] }}
46+
run: |
47+
(
48+
openssl pkcs12 \
49+
-in "${{ env.CERTIFICATE_PATH }}" \
50+
-noout -passin env:CERTIFICATE_PASSWORD
51+
) || (
52+
echo "::error::Verification of ${{ matrix.certificate.identifier }} failed!!!"
53+
exit 1
54+
)
55+
56+
# See: https://github.com/rtCamp/action-slack-notify
57+
- name: Slack notification of certificate verification failure
58+
if: failure()
59+
uses: rtCamp/[email protected]
60+
env:
61+
SLACK_WEBHOOK: ${{ secrets.TEAM_TOOLING_CHANNEL_SLACK_WEBHOOK }}
62+
SLACK_MESSAGE: |
63+
:warning::warning::warning::warning:
64+
WARNING: ${{ github.repository }} ${{ matrix.certificate.identifier }} verification failed!!!
65+
:warning::warning::warning::warning:
66+
SLACK_COLOR: danger
67+
MSG_MINIMAL: true
68+
69+
- name: Get days remaining before certificate expiration date
70+
env:
71+
CERTIFICATE_PASSWORD: ${{ secrets[matrix.certificate.password-secret] }}
72+
id: get-days-before-expiration
73+
run: |
74+
EXPIRATION_DATE="$(
75+
(
76+
openssl pkcs12 \
77+
-in "${{ env.CERTIFICATE_PATH }}" \
78+
-clcerts \
79+
-nodes \
80+
-passin env:CERTIFICATE_PASSWORD
81+
) | (
82+
openssl x509 \
83+
-noout \
84+
-enddate
85+
) | (
86+
grep \
87+
--max-count=1 \
88+
--only-matching \
89+
--perl-regexp \
90+
'notAfter=(\K.*)'
91+
)
92+
)"
93+
94+
DAYS_BEFORE_EXPIRATION="$((($(date --utc --date="$EXPIRATION_DATE" +%s) - $(date --utc +%s)) / 60 / 60 / 24))"
95+
96+
# Display the expiration information in the log
97+
echo "Certificate expiration date: $EXPIRATION_DATE"
98+
echo "Days remaining before expiration: $DAYS_BEFORE_EXPIRATION"
99+
100+
echo "::set-output name=days::$DAYS_BEFORE_EXPIRATION"
101+
102+
- name: Check if expiration notification period has been reached
103+
id: check-expiration
104+
run: |
105+
if [[ ${{ steps.get-days-before-expiration.outputs.days }} -lt ${{ env.EXPIRATION_WARNING_PERIOD }} ]]; then
106+
echo "::error::${{ matrix.certificate.identifier }} will expire in ${{ steps.get-days-before-expiration.outputs.days }} days!!!"
107+
exit 1
108+
fi
109+
110+
- name: Slack notification of pending certificate expiration
111+
# Don't send spurious expiration notification if verification fails
112+
if: failure() && steps.check-expiration.outcome == 'failure'
113+
uses: rtCamp/[email protected]
114+
env:
115+
SLACK_WEBHOOK: ${{ secrets.TEAM_TOOLING_CHANNEL_SLACK_WEBHOOK }}
116+
SLACK_MESSAGE: |
117+
:warning::warning::warning::warning:
118+
WARNING: ${{ github.repository }} ${{ matrix.certificate.identifier }} will expire in ${{ steps.get-days-before-expiration.outputs.days }} days!!!
119+
:warning::warning::warning::warning:
120+
SLACK_COLOR: danger
121+
MSG_MINIMAL: true

Diff for: ‎.github/workflows/link-validation.yml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: Verifies documentation links
2+
3+
on:
4+
push:
5+
pull_request:
6+
schedule:
7+
- cron: "0 3 * * 1" # Every Monday at 03:00
8+
9+
jobs:
10+
verify-links:
11+
# Don't trigger on schedule event when in a fork
12+
if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository == 'arduino/FirmwareUpdater')
13+
runs-on: ubuntu-latest
14+
steps:
15+
- uses: actions/checkout@v2
16+
17+
- name: Install Taskfile
18+
uses: arduino/actions/setup-taskfile@master
19+
with:
20+
repo-token: ${{ secrets.GITHUB_TOKEN }}
21+
version: 3.x
22+
23+
- name: Verify links
24+
run: task docs:check-links

0 commit comments

Comments
 (0)