Merge branch 'main' into anh/netp-check-entitlement-while-rekeying

# Conflicts: # DuckDuckGo.xcodeproj/project.pbxproj # DuckDuckGo.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved
duckduckgo · Feb 26, 2024 · fa7c938 · fa7c938
2 parents 7bd30a3 + a06596d
commit fa7c938
Show file tree

Hide file tree

Showing 93 changed files with 2,007 additions and 781 deletions.
diff --git a/.github/actions/asana-add-comment/templates/appcast-failed-hotfix.yml b/.github/actions/asana-add-comment/templates/appcast-failed-hotfix.yml
@@ -0,0 +1,9 @@
+data:
+  html_text: |
+    <body>
+      <h2>[ACTION NEEDED] Publishing ${TAG} hotfix release to Sparkle failed</h2>
+      <a data-asana-gid='${ASSIGNEE_ID}'/>, please proceed with generating appcast2.xml and uploading files to S3 from your local machine, <a data-asana-gid='${TASK_ID}' data-asana-dynamic='false'>according to instructions</a>.
+
+
+      🔗 Workflow URL: <a href='${WORKFLOW_URL}'>${WORKFLOW_URL}</a>.
+    </body>
diff --git a/...-add-comment/templates/appcast-failed.yml → ...ent/templates/appcast-failed-internal.yml b/...-add-comment/templates/appcast-failed.yml → ...ent/templates/appcast-failed-internal.yml
diff --git a/.github/actions/asana-add-comment/templates/appcast-failed-public.yml b/.github/actions/asana-add-comment/templates/appcast-failed-public.yml
@@ -0,0 +1,9 @@
+data:
+  html_text: |
+    <body>
+      <h2>[ACTION NEEDED] Publishing ${TAG} release to Sparkle failed</h2>
+      <a data-asana-gid='${ASSIGNEE_ID}'/>, please proceed with generating appcast2.xml and uploading files to S3 from your local machine, <a data-asana-gid='${TASK_ID}' data-asana-dynamic='false'>according to instructions</a>.
+
+
+      🔗 Workflow URL: <a href='${WORKFLOW_URL}'>${WORKFLOW_URL}</a>.
+    </body>
diff --git a/...tes/internal-release-ready-tag-failed.yml → ...nternal-release-ready-tag-failed copy.yml b/...tes/internal-release-ready-tag-failed.yml → ...nternal-release-ready-tag-failed copy.yml
diff --git a/.github/actions/asana-add-comment/templates/public-release-complete.yml b/.github/actions/asana-add-comment/templates/public-release-complete.yml
@@ -0,0 +1,8 @@
+data:
+  html_text: |
+    <body>
+      Build ${TAG} is now available publicly through Sparkle and TestFlight.
+
+
+      <a href='${DMG_URL}'>📥 DMG download link</a>
+    </body>
diff --git a/.github/actions/asana-add-comment/templates/public-release-tag-failed.yml b/.github/actions/asana-add-comment/templates/public-release-tag-failed.yml
@@ -0,0 +1,15 @@
+data:
+  html_text: |
+    <body>
+      <h2>[ACTION NEEDED] Failed to publish ${TAG} release – tagging failed</h2>
+      <ul>
+        <li><b>❗️ Tagging repository with ${TAG} tag failed.</b></li>
+        <li><b>⚠️ GitHub release creation was skipped.</b></li>
+        <li><b>⚠️ Deleting <code>${BRANCH}</code> was skipped.</b></li>
+      </ul>
+
+      <a data-asana-gid='${ASSIGNEE_ID}'/>, please proceed with the release <a data-asana-gid='${TASK_ID}' data-asana-dynamic='false'>according to instructions</a>.
+
+
+      🔗 Workflow URL: <a href='${WORKFLOW_URL}'>${WORKFLOW_URL}</a>.
+    </body>
diff --git a/.github/actions/asana-add-comment/templates/public-release-tagged-delete-branch-failed.yml b/.github/actions/asana-add-comment/templates/public-release-tagged-delete-branch-failed.yml
@@ -0,0 +1,16 @@
+data:
+  # yq -o=j | sed -E 's/\\n( *)([^\\n])/\2/g'
+  html_text: |
+    <body>
+      <h2>[ACTION NEEDED] Public release ${TAG} tagged</h2>
+      <ul>
+        <li>🏷️ Repository is tagged with <code>${TAG}</code> tag.</li>
+        <li>🚢 GitHub <a href='${RELEASE_URL}'>${TAG} release</a> is created.</li>
+        <li><b>❗️ Deleting <code>${BRANCH}</code> failed.</b>
+          <ul>
+            <li><a data-asana-gid='${ASSIGNEE_ID}'/>, please proceed with deleting the branch manually <a data-asana-gid='${TASK_ID}' data-asana-dynamic='false'>according to instructions</a>.</li>
+          </ul></li>
+      </ul>
+
+      🔗 Workflow URL: <a href='${WORKFLOW_URL}'>${WORKFLOW_URL}</a>.
+    </body>
diff --git a/.github/actions/asana-add-comment/templates/public-release-tagged.yml b/.github/actions/asana-add-comment/templates/public-release-tagged.yml
@@ -0,0 +1,15 @@
+data:
+  # yq -o=j | sed -E 's/\\n( *)([^\\n])/\2/g'
+  html_text: |
+    <body>
+      <h2>Public release ${TAG} has been tagged ✅</h2>
+      <ul>
+        <li>📥 DMG is available from <a href='${DMG_URL}'>${DMG_URL}</a>.</li>
+        <li>🏷️ Repository is tagged with <code>${TAG}</code> tag.</li>
+        <li>🚢 GitHub <a href='${RELEASE_URL}'>${TAG} release</a> is created.</li>
+        <li>🔱 <code>${BRANCH}</code> branch has been deleted.</li>
+        <li>🚀 The relase will be published to Sparkle in a few minutes (you'll get notified).</li>
+      </ul>
+
+      🔗 Workflow URL: <a href='${WORKFLOW_URL}'>${WORKFLOW_URL}</a>.
+    </body>
diff --git a/.github/actions/asana-add-comment/templates/validate-check-for-updates-public.yml b/.github/actions/asana-add-comment/templates/validate-check-for-updates-public.yml
@@ -0,0 +1,11 @@
+data:
+  html_text: |
+    <body>
+      <h2>Build ${TAG} is available publicly through Sparkle 🚀</h2>
+      <ul>
+        <li>🌟 New appcast file has been generated and uploaded to S3, together with binary delta files.</li>
+        <li>👀 <a data-asana-gid='${ASSIGNEE_ID}'/>, please proceed by following instructions in <a data-asana-gid='${TASK_ID}'/> which concludes the release process.</li>
+      </ul>
+
+      🔗 Workflow URL: <a href='${WORKFLOW_URL}'>${WORKFLOW_URL}</a>.
+    </body>
diff --git a/.github/actions/asana-create-action-item/templates/appcast-failed-hotfix.yml b/.github/actions/asana-create-action-item/templates/appcast-failed-hotfix.yml
@@ -0,0 +1,36 @@
+data:
+  name: Generate appcast2.xml for ${TAG} hotfix release and upload assets to S3
+  assignee: "${ASSIGNEE_ID}"
+  html_notes: |
+    <body>
+      Publishing ${TAG} hotfix release failed in CI. Please follow the steps to generate the appcast file and upload files to S3 from your local machine.
+
+      <ol>
+        <li>Create a new file called <code>release-notes.txt</code> on your disk.
+          <ul>
+            <li>Add each release note as a separate line and don't add bullet points (•) – the script will add them automatically.</li>
+          </ul></li>
+        <li>Run <code>appcastManager</code>:
+          <ul>
+            <li><code>./scripts/appcast_manager/appcastManager.swift --release-hotfix-to-public-channel --dmg ~/Downloads/${DMG_NAME} --release-notes release-notes.txt</code></li>
+          </ul></li>
+        <li>Verify that the new build is in the appcast file with the latest release notes and no internal channel tag. The phased rollout tag should <em>not</em> be present:
+          <ul>
+            <li><code>&lt;sparkle:phasedRolloutInterval&gt;43200&lt;/sparkle:phasedRolloutInterval&gt;</code></li>
+          </ul></li>
+        <li>Run <code>upload_to_s3.sh</code> script:
+          <ul>
+            <li><code>./scripts/upload_to_s3/upload_to_s3.sh --run --overwrite-duckduckgo-dmg ${VERSION}</code></li>
+          </ul></li>
+      </ol>
+      When done, please verify that "Check for Updates" works correctly:
+      <ol>
+        <li>Launch a debug version of the app with an old version number.</li>
+        <li>Make sure you're not identified as an internal user in the app.</li>
+        <li>Go to Main Menu → DuckDuckGo → Check for Updates...</li>
+        <li>Verify that you're being offered to update to ${TAG}.</li>
+        <li>Verify that the update works.</li>
+      </ol>
+
+      🔗 Workflow URL: <a href='${WORKFLOW_URL}'>${WORKFLOW_URL}</a>.
+    </body>
diff --git a/...-action-item/templates/appcast-failed.yml → ...tem/templates/appcast-failed-internal.yml b/...-action-item/templates/appcast-failed.yml → ...tem/templates/appcast-failed-internal.yml
@@ -3,7 +3,7 @@ data:
   assignee: "${ASSIGNEE_ID}"
   html_notes: |
     <body>
-      Publishing internal release ${TAG} failed in CI. Please follow the steps to generate the appcast file and upload files to S3 from your local machine.
+      Publishing ${TAG} internal release failed in CI. Please follow the steps to generate the appcast file and upload files to S3 from your local machine.
 
       <ol>
         <li>Download <a href='${DMG_URL}'>the DMG for ${TAG} release</a>.</li>

diff --git a/.github/actions/asana-create-action-item/templates/appcast-failed-public.yml b/.github/actions/asana-create-action-item/templates/appcast-failed-public.yml
@@ -0,0 +1,36 @@
+data:
+  name: Generate appcast2.xml for ${TAG} public release and upload assets to S3
+  assignee: "${ASSIGNEE_ID}"
+  html_notes: |
+    <body>
+      Publishing ${TAG} release failed in CI. Please follow the steps to generate the appcast file and upload files to S3 from your local machine.
+
+      <ol>
+        <li>Create a new file called <code>release-notes.txt</code> on your disk.
+          <ul>
+            <li>Add each release note as a separate line and don't add bullet points (•) – the script will add them automatically.</li>
+          </ul></li>
+        <li>Run <code>appcastManager</code>:
+          <ul>
+            <li><code>./scripts/appcast_manager/appcastManager.swift --release-to-public-channel --version ${VERSION} --release-notes release-notes.txt</code></li>
+          </ul></li>
+        <li>Verify that the new build is in the appcast file with the latest release notes, the phased rollout tag (below) and no internal channel tag:
+          <ul>
+            <li><code>&lt;sparkle:phasedRolloutInterval&gt;43200&lt;/sparkle:phasedRolloutInterval&gt;</code></li>
+          </ul></li>
+        <li>Run <code>upload_to_s3.sh</code> script:
+          <ul>
+            <li><code>./scripts/upload_to_s3/upload_to_s3.sh --run --overwrite-duckduckgo-dmg ${VERSION}</code></li>
+          </ul></li>
+      </ol>
+      When done, please verify that "Check for Updates" works correctly:
+      <ol>
+        <li>Launch a debug version of the app with an old version number.</li>
+        <li>Make sure you're not identified as an internal user in the app.</li>
+        <li>Go to Main Menu → DuckDuckGo → Check for Updates...</li>
+        <li>Verify that you're being offered to update to ${TAG}.</li>
+        <li>Verify that the update works.</li>
+      </ol>
+
+      🔗 Workflow URL: <a href='${WORKFLOW_URL}'>${WORKFLOW_URL}</a>.
+    </body>
diff --git a/.github/actions/asana-create-action-item/templates/delete-branch-failed.yml b/.github/actions/asana-create-action-item/templates/delete-branch-failed.yml
@@ -0,0 +1,15 @@
+data:
+  name: Delete ${BRANCH} branch
+  assignee: "${ASSIGNEE_ID}"
+  html_notes: |
+    <body>
+      The <code>${TAG}</code> public release has been successfully tagged and published in GitHub releases, 
+      but deleting <code>${BRANCH}</code> branch failed. Please delete it manually:
+      <ul>
+        <li><code>git push origin --delete ${BRANCH}</code></li>
+      </ul>
+      Complete this task when ready, or if the release branch has already been deleted.
+
+
+      🔗 Workflow URL: <a href='${WORKFLOW_URL}'>${WORKFLOW_URL}</a>.
+    </body>
diff --git a/...eate-action-item/templates/tag-failed.yml → ...templates/internal-release-tag-failed.yml b/...eate-action-item/templates/tag-failed.yml → ...templates/internal-release-tag-failed.yml
@@ -1,5 +1,5 @@
 data:
-  name: Merging ${BRANCH} to ${BASE_BRANCH} failed
+  name: Tag ${BRANCH} branch and create GitHub release
   assignee: "${ASSIGNEE_ID}"
   html_notes: |
     <body>

diff --git a/.github/actions/asana-create-action-item/templates/merge-failed.yml b/.github/actions/asana-create-action-item/templates/merge-failed.yml
@@ -1,5 +1,5 @@
 data:
-  name: Merging ${BRANCH} to ${BASE_BRANCH} failed
+  name: Merge ${BRANCH} to ${BASE_BRANCH}
   assignee: "${ASSIGNEE_ID}"
   html_notes: |
     <body>

diff --git a/.github/actions/asana-create-action-item/templates/public-release-tag-failed.yml b/.github/actions/asana-create-action-item/templates/public-release-tag-failed.yml
@@ -0,0 +1,38 @@
+data:
+  name: Tag ${BRANCH} branch, delete it, and create GitHub release
+  assignee: "${ASSIGNEE_ID}"
+  html_notes: |
+    <body>
+      Failed to tag the release with <code>${TAG}</code> tag.
+
+      Please follow instructions below to tag the branch, make GitHub release and delete the release branch manually.
+      <ul>
+        <li>If the tag has already been created, please proceed with creating GitHub release and deleting the branch.</li>
+        <li>If both tag and GitHub release have already been created, please close this task already.</li>
+      </ul>
+
+      Issue the following git commands to tag the release and delete the branch:
+      <ul>
+        <li><code>git fetch origin</code></li>
+        <li><code>git checkout ${BRANCH}</code> switch to the release branch</li>
+        <li><code>git pull origin ${BRANCH}</code> pull latest changes</li>
+        <li><code>git tag ${TAG}</code> tag the release</li>
+        <li><code>git push origin ${TAG}</code> push the tag</li>
+        <li><code>git checkout ${BASE_BRANCH}</code> switch to ${BASE_BRANCH}</li>
+        <li><code>git push origin --delete ${BRANCH}</code> delete the release branch</li>
+      </ul>
+
+      To create GitHub release:
+      <ul>
+        <li>Set up GH CLI if you haven't yet: <a data-asana-gid='1203791243007683'/></li>
+        <li>Run the following command:
+        <ul>
+          <li><code>gh release create ${TAG} --generate-notes --latest --notes-start-tag ${LAST_RELEASE_TAG}</code></li>
+        </ul></li>
+      </ul>
+
+      Complete this task when ready.
+
+
+      🔗 Workflow URL: <a href='${WORKFLOW_URL}'>${WORKFLOW_URL}</a>.
+    </body>
diff --git a/.github/actions/asana-create-action-item/templates/validate-check-for-updates-public.yml b/.github/actions/asana-create-action-item/templates/validate-check-for-updates-public.yml
@@ -0,0 +1,41 @@
+data:
+  name: Validate that 'Check For Updates' upgrades to ${TAG}
+  assignee: "${ASSIGNEE_ID}"
+  html_notes: |
+    <body>
+      <h1>Build ${TAG} has been released publicly via Sparkle 🎉</h1>
+      Please verify that "Check for Updates" works correctly:
+      <ol>
+        <li>Launch a debug version of the app with an old version number.</li>
+        <li>Make sure you're not identified as an internal user in the app.</li>
+        <li>Go to Main Menu → DuckDuckGo → Check for Updates...</li>
+        <li>Verify that you're being offered to update to ${TAG}.</li>
+        <li>Verify that the update works.</li>
+      </ol>
+      <h1>🚨In case "Check for Updates" is broken</h1>
+      You can restore previous version of the appcast2.xml:
+      <ol>
+        <li>Download the ${OLD_APPCAST_NAME} file attached to this task.</li>
+        <li>Log in to AWS session:
+          <ul>
+            <li><code>aws --profile ddg-macos sso login</code></li>
+          </ul></li>
+        <li>Overwrite appcast2.xml with the old version:
+          <ul>
+            <li><code>aws --profile ddg-macos s3 cp ${OLD_APPCAST_NAME} s3://${RELEASE_BUCKET_NAME}/${RELEASE_BUCKET_PREFIX}/appcast2.xml --acl public-read</code></li>
+          </ul></li>
+      </ol>
+
+      <hr>
+      <h1>Summary of automated changes</h1>
+      <h2>Changes to appcast2.xml</h2>
+      See the attached <em>${APPCAST_PATCH_NAME}</em> file.
+      <h2>Release notes</h2>
+      See the attached <em>${RELEASE_NOTES_FILE}</em> file for release notes extracted automatically from <a data-asana-gid='${RELEASE_TASK_ID}' data-asana-dynamic='false'>the release task</a> description.
+      <h2>List of files uploaded to S3</h2>
+      <ol>
+        ${FILES_UPLOADED}
+      </ol>
+
+      🔗 Workflow URL: <a href='${WORKFLOW_URL}'>${WORKFLOW_URL}</a>.
+    </body>
diff --git a/.github/actions/create-tag-and-github-release/action.yml b/.github/actions/create-tag-and-github-release/action.yml
@@ -11,8 +11,11 @@ inputs:
     required: true
     type: string
 outputs:
+  promoted-tag:
+    description: "Pre-release tag (x.y.z-N) that has been promoted to a release tag (x.y.z)"
+    value: ${{ steps.compute-tag.outputs.promoted-tag }}
   tag:
-    description: "Tag that has been added"
+    description: "Tag that has been added (x.y.z-N for internal, x.y.z for public and hotfixes)"
     value: ${{ steps.compute-tag.outputs.tag }}
   tag-created:
     description: "Whether the tag has been created"
@@ -30,11 +33,13 @@ runs:
       shell: bash
       run: |
         version="$(cut -d ' ' -f 3 < Configuration/Version.xcconfig)"
+        build_number="$(cut -d ' ' -f 3 < Configuration/BuildNumber.xcconfig)"
         if [[ "${{ inputs.prerelease }}" == "true" ]]; then
-          build_number="$(cut -d ' ' -f 3 < Configuration/BuildNumber.xcconfig)"
           tag="${version}-${build_number}"
         else
           tag="${version}"
+          promoted_tag="${version}-${build_number}"
+          echo "promoted-tag=${promoted_tag}" >> $GITHUB_OUTPUT
         fi
         echo "tag=${tag}" >> $GITHUB_OUTPUT
 
@@ -53,5 +58,5 @@ runs:
         if [[ "${{ inputs.prerelease }}" == "true" ]]; then
           gh release create ${{ steps.compute-tag.outputs.tag }} --generate-notes --prerelease --notes-start-tag ${latest_release}
         else
-          gh release create ${{ steps.compute-tag.outputs.tag }} --generate-notes --notes-start-tag ${latest_release}
+          gh release create ${{ steps.compute-tag.outputs.tag }} --generate-notes --latest --notes-start-tag ${latest_release}
         fi
diff --git a/.github/actions/install-certs-and-profiles/action.yml b/.github/actions/install-certs-and-profiles/action.yml
@@ -1,4 +1,4 @@
-name: Instal Certs and Profiles
+name: Install Certs and Profiles
 description: Installs signing certificates and provisioning profiles
 inputs:
   BUILD_CERTIFICATE_BASE64:

diff --git a/.github/workflows/bump_internal_release.yml b/.github/workflows/bump_internal_release.yml
@@ -123,11 +123,12 @@ jobs:
   tag_and_merge:
     name: Tag and Merge Branch
     needs: [ prepare_release ]
-    uses: ./.github/workflows/tag_and_merge.yml
+    uses: ./.github/workflows/tag_release.yml
     with:
       asana-task-url: ${{ github.event.inputs.asana-task-url }}
       branch: ${{ github.ref_name }}
       base-branch: ${{ github.event.inputs.base-branch || 'main' }}
+      prerelease: true
     secrets:
       ASANA_ACCESS_TOKEN: ${{ secrets.ASANA_ACCESS_TOKEN }}
       GHA_ELEVATED_PERMISSIONS_TOKEN: ${{ secrets.GHA_ELEVATED_PERMISSIONS_TOKEN }}
diff --git a/.github/workflows/code_freeze.yml b/.github/workflows/code_freeze.yml
@@ -163,10 +163,11 @@ jobs:
   tag_and_merge:
     name: Tag and Merge Branch
     needs: [ create_release_branch, prepare_release ]
-    uses: ./.github/workflows/tag_and_merge.yml
+    uses: ./.github/workflows/tag_release.yml
     with:
       asana-task-url: ${{ needs.create_release_branch.outputs.asana_task_url }}
       branch: ${{ needs.create_release_branch.outputs.release_branch_name }}
+      prerelease: true
     secrets:
       ASANA_ACCESS_TOKEN: ${{ secrets.ASANA_ACCESS_TOKEN }}
       GHA_ELEVATED_PERMISSIONS_TOKEN: ${{ secrets.GHA_ELEVATED_PERMISSIONS_TOKEN }}