publish-go-nightly-task.yml

# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/publish-go-nightly-task.md
name: Publish Nightly Build

env:
  # As defined by the Taskfile's PROJECT_NAME variable
  PROJECT_NAME: TODO
  # As defined by the Taskfile's DIST_DIR variable
  DIST_DIR: dist
  # The project's folder on Arduino's download server for uploading builds
  AWS_PLUGIN_TARGET: TODO
  ARTIFACT_NAME: dist

# See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows
on:
  schedule:
    # run every day at 1AM
    - cron: "0 1 * * *"
  workflow_dispatch:
  repository_dispatch:

jobs:
  create-nightly-artifacts:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Install Task
        uses: arduino/setup-task@v1
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          version: 3.x

      - name: Build
        env:
          NIGHTLY: true
        run: task dist:all

      - name: Upload artifacts
        uses: actions/upload-artifact@v3
        with:
          if-no-files-found: error
          name: ${{ env.ARTIFACT_NAME }}
          path: ${{ env.DIST_DIR }}

  notarize-macos:
    runs-on: macos-latest
    needs: create-nightly-artifacts

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Download artifacts
        uses: actions/download-artifact@v3
        with:
          name: ${{ env.ARTIFACT_NAME }}
          path: ${{ env.DIST_DIR }}

      - name: Import Code-Signing Certificates
        env:
          KEYCHAIN: "sign.keychain"
          INSTALLER_CERT_MAC_PATH: "/tmp/ArduinoCerts2020.p12"
          KEYCHAIN_PASSWORD: keychainpassword # Arbitrary password for a keychain that exists only for the duration of the job, so not secret
        run: |
          echo "${{ secrets.INSTALLER_CERT_MAC_P12 }}" | base64 --decode > "${{ env.INSTALLER_CERT_MAC_PATH }}"
          security create-keychain -p "${{ env.KEYCHAIN_PASSWORD }}" "${{ env.KEYCHAIN }}"
          security default-keychain -s "${{ env.KEYCHAIN }}"
          security unlock-keychain -p "${{ env.KEYCHAIN_PASSWORD }}" "${{ env.KEYCHAIN }}"
          security import \
            "${{ env.INSTALLER_CERT_MAC_PATH }}" \
            -k "${{ env.KEYCHAIN }}" \
            -f pkcs12 \
            -A \
            -T /usr/bin/codesign \
            -P "${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}"
          security set-key-partition-list \
            -S apple-tool:,apple: \
            -s \
            -k "${{ env.KEYCHAIN_PASSWORD }}" \
            "${{ env.KEYCHAIN }}"

      - name: Install gon for code signing and app notarization
        run: |
          wget -q https://github.com/mitchellh/gon/releases/download/v0.2.3/gon_macos.zip
          unzip gon_macos.zip -d /usr/local/bin

      - name: Sign and notarize binary
        env:
          AC_USERNAME: ${{ secrets.AC_USERNAME }}
          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
        run: |
          gon gon.config.hcl

      - name: Re-package binary and update checksum
        # This step performs the following:
        # 1. Repackage the signed binary replaced in place by Gon (ignoring the output zip file)
        # 2. Recalculate package checksum and replace it in the nnnnnn-checksums.txt file
        run: |
          # GitHub's upload/download-artifact@v2 actions don't preserve file permissions,
          # so we need to add execution permission back until the action is made to do this.
          chmod +x "${{ env.DIST_DIR }}/${{ env.PROJECT_NAME }}_osx_darwin_amd64/${{ env.PROJECT_NAME }}"
          PACKAGE_FILENAME="$(basename ${{ env.DIST_DIR }}/${{ env.PROJECT_NAME }}_nightly-*_macOS_64bit.tar.gz)"
          tar -czvf "${{ env.DIST_DIR }}/$PACKAGE_FILENAME" \
            -C "${{ env.DIST_DIR }}/${{ env.PROJECT_NAME }}_osx_darwin_amd64/" "${{ env.PROJECT_NAME }}" \
            -C ../../ LICENSE.txt
          CHECKSUM="$(shasum -a 256 ${{ env.DIST_DIR }}/$PACKAGE_FILENAME | cut -d " " -f 1)"
          perl \
            -pi \
            -w \
            -e "s/.*${PACKAGE_FILENAME}/${CHECKSUM} ${PACKAGE_FILENAME}/g;" \
            ${{ env.DIST_DIR }}/*-checksums.txt

      - name: Upload artifacts
        uses: actions/upload-artifact@v3
        with:
          if-no-files-found: error
          name: ${{ env.ARTIFACT_NAME }}
          path: ${{ env.DIST_DIR }}

  publish-nightly:
    runs-on: ubuntu-latest
    needs: notarize-macos

    steps:
      - name: Download artifact
        uses: actions/download-artifact@v3
        with:
          name: ${{ env.ARTIFACT_NAME }}
          path: ${{ env.DIST_DIR }}

      - name: Upload release files on Arduino downloads servers
        uses: docker://plugins/s3
        env:
          PLUGIN_SOURCE: "${{ env.DIST_DIR }}/*"
          PLUGIN_TARGET: "${{ env.AWS_PLUGIN_TARGET }}nightly"
          PLUGIN_STRIP_PREFIX: "${{ env.DIST_DIR }}/"
          PLUGIN_BUCKET: ${{ secrets.DOWNLOADS_BUCKET }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

  report:
    runs-on: ubuntu-latest
    needs: publish-nightly
    if: failure() # Run if publish-nightly or any of its job dependencies failed

    steps:
      - name: Report failure
        uses: masci/datadog@v1
        with:
          api-key: ${{ secrets.DD_API_KEY }}
          events: |
            - title: "${{ env.PROJECT_NAME }} nightly build failed"
              text: "Nightly build workflow has failed"
              alert_type: "error"
              host: ${{ github.repository }}
              tags:
                - "project:${{ env.PROJECT_NAME }}"
                - "workflow:${{ github.workflow }}"