Build Hotfix Release #17
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build Hotfix Release | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| asana-task-url: | |
| description: "Asana release task URL" | |
| required: true | |
| type: string | |
| base-branch: | |
| description: "Base branch (defaults to main, only override for testing)" | |
| required: false | |
| type: string | |
| current-internal-release-branch: | |
| description: "Current internal release branch (to merge hotfix branch to - hotfix branch is merged to main if this is not provided)" | |
| required: false | |
| type: string | |
| jobs: | |
| assert_release_branch: | |
| name: Assert Hotfix Branch | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Assert hotfix release branch | |
| run: | | |
| case "${{ github.ref }}" in | |
| refs/heads/hotfix/*) ;; | |
| *) echo "👎 Not a hotfix release branch"; exit 1 ;; | |
| esac | |
| run_tests: | |
| name: Run Tests | |
| needs: assert_release_branch | |
| uses: ./.github/workflows/pr.yml | |
| secrets: | |
| ASANA_ACCESS_TOKEN: ${{ secrets.ASANA_ACCESS_TOKEN }} | |
| update_asana: | |
| name: Update Asana tasks | |
| needs: run_tests | |
| runs-on: macos-13-xlarge | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Check out the code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # Fetch all history and tags in order to extract Asana task URLs from git log | |
| ref: ${{ github.ref_name }} | |
| submodules: recursive | |
| - name: Extract Asana Task ID | |
| id: task-id | |
| uses: ./.github/actions/asana-extract-task-id | |
| with: | |
| task-url: ${{ github.event.inputs.asana-task-url }} | |
| - name: Update Asana tasks for the release | |
| env: | |
| ASANA_ACCESS_TOKEN: ${{ secrets.ASANA_ACCESS_TOKEN }} | |
| GH_TOKEN: ${{ github.token }} | |
| BRANCH: ${{ github.ref_name }} | |
| run: | | |
| version="$(cut -d '/' -f 2 <<< "$BRANCH")" | |
| # 'internal', because we start with making a build that still needs to be tested before being published | |
| # and we want Asana tasks to be moved to "Validation" and not already to "Done" | |
| ./scripts/update_asana_for_release.sh internal ${{ steps.task-id.outputs.task-id }} ${{ vars.MACOS_APP_BOARD_VALIDATION_SECTION_ID }} "${version}" | |
| prepare_release: | |
| name: Prepare Release | |
| needs: run_tests | |
| uses: ./.github/workflows/release.yml | |
| with: | |
| asana-task-url: ${{ github.event.inputs.asana-task-url }} | |
| secrets: | |
| BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }} | |
| P12_PASSWORD: ${{ secrets.P12_PASSWORD }} | |
| KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} | |
| REVIEW_PROVISION_PROFILE_BASE64: ${{ secrets.REVIEW_PROVISION_PROFILE_BASE64 }} | |
| RELEASE_PROVISION_PROFILE_BASE64: ${{ secrets.RELEASE_PROVISION_PROFILE_BASE64 }} | |
| DBP_AGENT_RELEASE_PROVISION_PROFILE_BASE64: ${{ secrets.DBP_AGENT_RELEASE_PROVISION_PROFILE_BASE64 }} | |
| DBP_AGENT_REVIEW_PROVISION_PROFILE_BASE64: ${{ secrets.DBP_AGENT_REVIEW_PROVISION_PROFILE_BASE64 }} | |
| NETP_SYSEX_RELEASE_PROVISION_PROFILE_BASE64_V2: ${{ secrets.NETP_SYSEX_RELEASE_PROVISION_PROFILE_BASE64_V2 }} | |
| NETP_SYSEX_REVIEW_PROVISION_PROFILE_BASE64_V2: ${{ secrets.NETP_SYSEX_REVIEW_PROVISION_PROFILE_BASE64_V2 }} | |
| NETP_AGENT_RELEASE_PROVISION_PROFILE_BASE64_V2: ${{ secrets.NETP_AGENT_RELEASE_PROVISION_PROFILE_BASE64_V2 }} | |
| NETP_AGENT_REVIEW_PROVISION_PROFILE_BASE64_V2: ${{ secrets.NETP_AGENT_REVIEW_PROVISION_PROFILE_BASE64_V2 }} | |
| NETP_NOTIFICATIONS_RELEASE_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_NOTIFICATIONS_RELEASE_PROVISION_PROFILE_BASE64 }} | |
| NETP_NOTIFICATIONS_REVIEW_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_NOTIFICATIONS_REVIEW_PROVISION_PROFILE_BASE64 }} | |
| APPLE_API_KEY_BASE64: ${{ secrets.APPLE_API_KEY_BASE64 }} | |
| APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} | |
| APPLE_API_KEY_ISSUER: ${{ secrets.APPLE_API_KEY_ISSUER }} | |
| ASANA_ACCESS_TOKEN: ${{ secrets.ASANA_ACCESS_TOKEN }} | |
| MM_HANDLES_BASE64: ${{ secrets.MM_HANDLES_BASE64 }} | |
| MM_WEBHOOK_URL: ${{ secrets.MM_WEBHOOK_URL }} | |
| AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| AWS_ACCESS_KEY_ID_RELEASE_S3: ${{ secrets.AWS_ACCESS_KEY_ID_RELEASE_S3 }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| AWS_SECRET_ACCESS_KEY_RELEASE_S3: ${{ secrets.AWS_SECRET_ACCESS_KEY_RELEASE_S3 }} | |
| MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }} | |
| SSH_PRIVATE_KEY_FASTLANE_MATCH: ${{ secrets.SSH_PRIVATE_KEY_FASTLANE_MATCH }} | |
| tag_and_merge: | |
| name: Tag and Merge Branch | |
| needs: [ prepare_release, update_asana ] | |
| uses: ./.github/workflows/tag_release.yml | |
| with: | |
| asana-task-url: ${{ github.event.inputs.asana-task-url }} | |
| branch: ${{ github.ref_name }} | |
| base-branch: ${{ github.event.inputs.current-internal-release-branch || 'main' }} | |
| prerelease: true # Pre-release for now, and the actual release will be done as part of publish_dmg_release that's called later | |
| secrets: | |
| ASANA_ACCESS_TOKEN: ${{ secrets.ASANA_ACCESS_TOKEN }} | |
| GHA_ELEVATED_PERMISSIONS_TOKEN: ${{ secrets.GHA_ELEVATED_PERMISSIONS_TOKEN }} |