ATL-1119 Disable code signing when workflows run from forks #213
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Skip Mac/Win code signing and Apple notarization only if PR comes from a fork - Disable workflows entirely if the user enabled Github Actions in their fork repo - Add steps to help Mac users to test their forked code in BUILDING.md
rsora
commented
Mar 12, 2021
| @@ -16,6 +16,7 @@ on: | |||
| jobs: | |||
|
|
|||
| build: | |||
| if: github.repository == 'arduino/arduino-ide' | |||
There was a problem hiding this comment.
This condition disables the workflow in the user fork repo if the fork has GitHub Actions enabled.
kittaakos
approved these changes
Mar 15, 2021
There was a problem hiding this comment.
I have verified it, but maybe someone else can also check it on macOS. I checked the followings:
- PR was submitted from a fork,
- Build was green, I could download the artifacts,
- The IDE was not signed, it is expected:
codesign -dv --verbose=4 /Applications/Arduino\ IDE.app
/Applications/Arduino IDE.app: code object is not signed at all
- The CI log shows, it ran on a fork:
Skipping the app signing: building from a fork.
Note: I did not have to disable Gatekeeper. I could start the app without any issues although the IDE was not signed.
Verified:
Version: 2.0.0-beta.3-snapshot.a1d854f
Date: 2021-03-12T17:34:20.565Z
CLI Version: 0.16.1 alpha [76f55490]
|
I tested the unsigned artifact on MacOs thanks to @ubidefeo, I'll proceed to merge and closing #208. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR supersedes #208 and comes from a fork of this repo in order to test the workflow update it contains.
The purpose of this PR is to refactor the CI workflows to be more "fork friendly".
If workflows are run on a PR generated by a fork, where secrets are not available, the CI will run skipping the signing steps, providing unsigned artifacts.
What this PR does:
their fork repo