publish-go-nightly-task.yml

# Source: https://github.com/arduino/.github/blob/master/workflow-templates/publish-go-nightly-task.md
name: Publish Nightly Build

on:
  schedule:
    # run every day at 1AM
    - cron: "0 1 * * *"

jobs:
  create-nightly-artifacts:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v1
        with:
          fetch-depth: 0

      - name: Install Taskfile
        uses: arduino/setup-task@v1
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          version: 3.x

      - name: Build
        env:
          NIGHTLY: true
        run: task dist:all

      - name: Upload artifacts
        uses: actions/upload-artifact@v2
        with:
          name: dist
          path: dist

  notarize-macos:
    runs-on: macos-latest
    needs: create-nightly-artifacts

    steps:
      - name: Checkout repository
        uses: actions/checkout@v2

      - name: Download artifacts
        uses: actions/download-artifact@v2
        with:
          name: dist
          # to ensure compatibility with v1
          path: dist

      - name: Import Code-Signing Certificates
        env:
          KEYCHAIN: "sign.keychain"
          INSTALLER_CERT_MAC_PATH: "/tmp/ArduinoCerts2020.p12"
        run: |
          echo "${{ secrets.INSTALLER_CERT_MAC_P12 }}" | base64 --decode > "${{ env.INSTALLER_CERT_MAC_PATH }}"
          security create-keychain -p "${{ secrets.KEYCHAIN_PASSWORD }}" "${{ env.KEYCHAIN }}"
          security default-keychain -s "${{ env.KEYCHAIN }}"
          security unlock-keychain -p "${{ secrets.KEYCHAIN_PASSWORD }}" "${{ env.KEYCHAIN }}"
          security import "${{ env.INSTALLER_CERT_MAC_PATH }}" -k "${{ env.KEYCHAIN }}" -f pkcs12 -A -T /usr/bin/codesign -P "${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}"
          security set-key-partition-list -S apple-tool:,apple: -s -k "${{ secrets.KEYCHAIN_PASSWORD }}" "${{ env.KEYCHAIN }}"

      - name: Install gon for code signing and app notarization
        run: |
          wget -q https://github.com/mitchellh/gon/releases/download/v0.2.3/gon_macos.zip
          unzip gon_macos.zip -d /usr/local/bin

      - name: Sign and notarize binary
        env:
          AC_USERNAME: ${{ secrets.AC_USERNAME }}
          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
        run: |
          gon gon.config.hcl

      - name: Re-package binary and update checksum
        # This step performs the following:
        # 1. Repackage the signed binary replaced in place by Gon (ignoring the output zip file)
        # 2. Recalculate package checksum and replace it in the nnnnnn-checksums.txt file
        run: |
          # GitHub's upload/download-artifact@v2 actions don't preserve file permissions,
          # so we need to add execution permission back until the action is made to do this.
          chmod +x dist/arduino-cli_osx_darwin_amd64/arduino-cli
          PACKAGE_FILENAME="$(basename dist/arduino-cli_nightly-*_macOS_64bit.tar.gz)"
          tar -czvf "dist/$PACKAGE_FILENAME" \
          -C dist/arduino-cli_osx_darwin_amd64/  arduino-cli   \
          -C ../../ LICENSE.txt
          CLI_CHECKSUM="$(shasum -a 256 "dist/$PACKAGE_FILENAME" | cut -d " " -f 1)"
          perl -pi -w -e "s/.*${PACKAGE_FILENAME}/${CLI_CHECKSUM}  ${PACKAGE_FILENAME}/g;" dist/*-checksums.txt

      - name: Upload artifacts
        uses: actions/upload-artifact@v2
        with:
          name: dist
          path: dist

  publish-nightly:
    runs-on: ubuntu-latest
    needs: notarize-macos

    steps:
      - name: Download artifact
        uses: actions/download-artifact@v2
        with:
          name: dist
          # to ensure compatibility with v1
          path: dist

      - name: Upload release files on Arduino downloads servers
        uses: docker://plugins/s3
        env:
          PLUGIN_SOURCE: "dist/*"
          PLUGIN_TARGET: "/arduino-cli/nightly"
          PLUGIN_STRIP_PREFIX: "dist/"
          PLUGIN_BUCKET: ${{ secrets.DOWNLOADS_BUCKET }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

      - name: Report failure
        if: failure()
        uses: masci/datadog@v1
        with:
          api-key: ${{ secrets.DD_API_KEY }}
          events: |
            - title: "Arduino CLI nightly build failed"
              text: "Nightly build workflow has failed"
              alert_type: "error"
              host: ${{ github.repository }}
              tags:
                - "project:arduino-cli"
                - "workflow:${{ github.workflow }}"