Skip to content

Commit 838a194

Browse files
ps2ps2
authored
Merge pull request #269 from LoopKit/update_tidepool-merge
Update tidepool merge
2 parents 17aa656 + 18064d4 commit 838a194

File tree

16 files changed

+293
-132
lines changed

16 files changed

+293
-132
lines changed

‎.github/workflows/add_identifiers.yml

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,8 @@ jobs:
1212
identifiers:
1313
name: Add Identifiers
1414
needs: validate
15-
runs-on: macos-14
15+
runs-on: macos-15
1616
steps:
17-
# Uncomment to manually select latest Xcode if needed
18-
#- name: Select Latest Xcode
19-
# run: "sudo xcode-select --switch /Applications/Xcode_13.0.app/Contents/Developer"
20-
2117
# Checks-out the repo
2218
- name: Checkout Repo
2319
uses: actions/checkout@v4

‎.github/workflows/build_loop.yml

Lines changed: 24 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,12 @@ on:
66
## Remove the "#" sign from the beginning of the line below to get automated builds on push (code changes in your repository)
77
#push:
88

9+
# Automated builds now include automatic certificate update - the nuke certs part of that process could
10+
# affect other OS apps if run simultaneously.
11+
# Each OS needs a time of day distinct from other apps, LoopWorkspace uses 9 every Wed and 7 every 1st of month
912
schedule:
10-
- cron: "0 8 * * 3" # Checks for updates at 08:00 UTC every Wednesday
11-
- cron: "0 6 1 * *" # Builds the app on the 1st of every month at 06:00 UTC
13+
- cron: "0 9 * * 3" # Checks for updates at 09:00 UTC every Wednesday
14+
- cron: "0 7 1 * *" # Builds the app on the 1st of every month at 07:00 UTC
1215

1316
env:
1417
UPSTREAM_REPO: LoopKit/LoopWorkspace
@@ -18,15 +21,17 @@ env:
1821
ALIVE_BRANCH_DEV: alive-dev
1922

2023
jobs:
21-
validate:
22-
name: Validate
23-
uses: ./.github/workflows/validate_secrets.yml
24+
# Checks if Distribution certificate is present and valid, optionally nukes and
25+
# creates new certs if the repository variable ENABLE_NUKE_CERTS == 'true'
26+
check_certs:
27+
name: Check certificates
28+
uses: ./.github/workflows/create_certs.yml
2429
secrets: inherit
2530

2631
# Checks if GH_PAT holds workflow permissions
2732
# Checks for existence of alive branch; if non-existent creates it
2833
check_alive_and_permissions:
29-
needs: validate
34+
needs: check_certs
3035
runs-on: ubuntu-latest
3136
name: Check alive branch and permissions
3237
permissions:
@@ -96,7 +101,7 @@ jobs:
96101
# Checks for changes in upstream repository; if changes exist prompts sync for build
97102
# Performs keepalive to avoid stale fork
98103
check_latest_from_upstream:
99-
needs: [validate, check_alive_and_permissions]
104+
needs: [check_certs, check_alive_and_permissions]
100105
runs-on: ubuntu-latest
101106
name: Check upstream and keep alive
102107
outputs:
@@ -166,12 +171,14 @@ jobs:
166171
167172
# Keep repository "alive": add empty commits to ALIVE_BRANCH after "time_elapsed" days of inactivity to avoid inactivation of scheduled workflows
168173
- name: Keep alive
169-
if: |
170-
needs.check_alive_and_permissions.outputs.WORKFLOW_PERMISSION == 'true' &&
171-
(vars.SCHEDULED_BUILD != 'false' || vars.SCHEDULED_SYNC != 'false')
172-
uses: gautamkrishnar/keepalive-workflow@v1 # using the workflow with default settings
173-
with:
174-
time_elapsed: 20 # Time elapsed from the previous commit to trigger a new automated commit (in days)
174+
run: |
175+
echo "Keep Alive is no longer available"
176+
# if: |
177+
# needs.check_alive_and_permissions.outputs.WORKFLOW_PERMISSION == 'true' &&
178+
# (vars.SCHEDULED_BUILD != 'false' || vars.SCHEDULED_SYNC != 'false')
179+
# uses: gautamkrishnar/keepalive-workflow@v1 # using the workflow with default settings
180+
# with:
181+
# time_elapsed: 20 # Time elapsed from the previous commit to trigger a new automated commit (in days)
175182

176183
- name: Show scheduled build configuration message
177184
if: needs.check_alive_and_permissions.outputs.WORKFLOW_PERMISSION != 'true'
@@ -185,20 +192,20 @@ jobs:
185192
# Builds Loop
186193
build:
187194
name: Build
188-
needs: [validate, check_alive_and_permissions, check_latest_from_upstream]
189-
runs-on: macos-14
195+
needs: [check_certs, check_alive_and_permissions, check_latest_from_upstream]
196+
runs-on: macos-15
190197
permissions:
191198
contents: write
192199
if:
193200
| # runs if started manually, or if sync schedule is set and enabled and scheduled on the first Saturday each month, or if sync schedule is set and enabled and new commits were found
194201
github.event_name == 'workflow_dispatch' ||
195202
(needs.check_alive_and_permissions.outputs.WORKFLOW_PERMISSION == 'true' &&
196-
(vars.SCHEDULED_BUILD != 'false' && github.event.schedule == '0 6 1 * *') ||
203+
(vars.SCHEDULED_BUILD != 'false' && github.event.schedule == '0 7 1 * *') ||
197204
(vars.SCHEDULED_SYNC != 'false' && needs.check_latest_from_upstream.outputs.NEW_COMMITS == 'true' )
198205
)
199206
steps:
200207
- name: Select Xcode version
201-
run: "sudo xcode-select --switch /Applications/Xcode_16.1.app/Contents/Developer"
208+
run: "sudo xcode-select --switch /Applications/Xcode_16.3.app/Contents/Developer"
202209

203210
- name: Checkout Repo for syncing
204211
if: |

‎.github/workflows/create_certs.yml

Lines changed: 85 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,32 @@
11
name: 3. Create Certificates
22
run-name: Create Certificates (${{ github.ref_name }})
3-
on:
4-
workflow_dispatch:
3+
4+
on: [workflow_call, workflow_dispatch]
5+
6+
env:
7+
TEAMID: ${{ secrets.TEAMID }}
8+
GH_PAT: ${{ secrets.GH_PAT }}
9+
GH_TOKEN: ${{ secrets.GH_PAT }}
10+
MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
11+
FASTLANE_KEY_ID: ${{ secrets.FASTLANE_KEY_ID }}
12+
FASTLANE_ISSUER_ID: ${{ secrets.FASTLANE_ISSUER_ID }}
13+
FASTLANE_KEY: ${{ secrets.FASTLANE_KEY }}
514

615
jobs:
716
validate:
817
name: Validate
918
uses: ./.github/workflows/validate_secrets.yml
1019
secrets: inherit
11-
12-
certificates:
13-
name: Create Certificates
20+
21+
22+
create_certs:
23+
name: Certificates
1424
needs: validate
15-
runs-on: macos-14
25+
runs-on: macos-15
26+
outputs:
27+
new_certificate_needed: ${{ steps.set_output.outputs.new_certificate_needed }}
28+
1629
steps:
17-
# Uncomment to manually select latest Xcode if needed
18-
#- name: Select Latest Xcode
19-
# run: "sudo xcode-select --switch /Applications/Xcode_13.0.app/Contents/Developer"
20-
2130
# Checks-out the repo
2231
- name: Checkout Repo
2332
uses: actions/checkout@v4
@@ -41,13 +50,69 @@ jobs:
4150
- name: Sync clock
4251
run: sudo sntp -sS time.windows.com
4352

44-
# Create or update certificates for app
45-
- name: Create Certificates
46-
run: bundle exec fastlane certs
47-
env:
48-
TEAMID: ${{ secrets.TEAMID }}
49-
GH_PAT: ${{ secrets.GH_PAT }}
50-
MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
51-
FASTLANE_KEY_ID: ${{ secrets.FASTLANE_KEY_ID }}
52-
FASTLANE_ISSUER_ID: ${{ secrets.FASTLANE_ISSUER_ID }}
53-
FASTLANE_KEY: ${{ secrets.FASTLANE_KEY }}
53+
# Create or update Distribution certificate and provisioning profiles
54+
- name: Check and create or update Distribution certificate and profiles if needed
55+
run: |
56+
echo "Running Fastlane certs lane..."
57+
bundle exec fastlane certs || true # ignore and continue on errors without annotating an exit code
58+
- name: Check Distribution certificate and launch Nuke certificates if needed
59+
run: bundle exec fastlane check_and_renew_certificates
60+
id: check_certs
61+
62+
- name: Set output and annotations based on Fastlane result
63+
id: set_output
64+
run: |
65+
CERT_STATUS_FILE="${{ github.workspace }}/fastlane/new_certificate_needed.txt"
66+
ENABLE_NUKE_CERTS=${{ vars.ENABLE_NUKE_CERTS }}
67+
68+
if [ -f "$CERT_STATUS_FILE" ]; then
69+
CERT_STATUS=$(cat "$CERT_STATUS_FILE" | tr -d '\n' | tr -d '\r') # Read file content and strip newlines
70+
echo "new_certificate_needed: $CERT_STATUS"
71+
echo "new_certificate_needed=$CERT_STATUS" >> $GITHUB_OUTPUT
72+
else
73+
echo "Certificate status file not found. Defaulting to false."
74+
echo "new_certificate_needed=false" >> $GITHUB_OUTPUT
75+
fi
76+
# Check if ENABLE_NUKE_CERTS is not set to true when certs are valid
77+
if [ "$CERT_STATUS" != "true" ] && [ "$ENABLE_NUKE_CERTS" != "true" ]; then
78+
echo "::notice::🔔 Automated renewal of certificates is disabled because the repository variable ENABLE_NUKE_CERTS is not set to 'true'."
79+
fi
80+
# Check if ENABLE_NUKE_CERTS is not set to true when certs are not valid
81+
if [ "$CERT_STATUS" = "true" ] && [ "$ENABLE_NUKE_CERTS" != "true" ]; then
82+
echo "::error::❌ No valid distribution certificate found. Automated renewal of certificates was skipped because the repository variable ENABLE_NUKE_CERTS is not set to 'true'."
83+
exit 1
84+
fi
85+
# Check if vars.FORCE_NUKE_CERTS is not set to true
86+
if [ vars.FORCE_NUKE_CERTS = "true" ]; then
87+
echo "::warning::‼️ Nuking of certificates was forced because the repository variable FORCE_NUKE_CERTS is set to 'true'."
88+
fi
89+
# Nuke Certs if needed, and if the repository variable ENABLE_NUKE_CERTS is set to 'true', or if FORCE_NUKE_CERTS is set to 'true', which will always force certs to be nuked
90+
nuke_certs:
91+
name: Nuke certificates
92+
needs: [validate, create_certs]
93+
runs-on: macos-15
94+
if: ${{ (needs.create_certs.outputs.new_certificate_needed == 'true' && vars.ENABLE_NUKE_CERTS == 'true') || vars.FORCE_NUKE_CERTS == 'true' }}
95+
steps:
96+
- name: Output from step id 'check_certs'
97+
run: echo "new_certificate_needed=${{ needs.create_certs.outputs.new_certificate_needed }}"
98+
99+
- name: Checkout repository
100+
uses: actions/checkout@v4
101+
102+
- name: Install dependencies
103+
run: bundle install
104+
105+
- name: Run Fastlane nuke_certs
106+
run: |
107+
set -e # Set error immediately after this step if error occurs
108+
bundle exec fastlane nuke_certs
109+
- name: Recreate Distribution certificate after nuking
110+
run: |
111+
set -e # Set error immediately after this step if error occurs
112+
bundle exec fastlane certs
113+
- name: Add success annotations for nuke and certificate recreation
114+
if: ${{ success() }}
115+
run: |
116+
echo "::warning::⚠️ All Distribution certificates and TestFlight profiles have been revoked and recreated."
117+
echo "::warning::❗️ If you have other apps being distributed by GitHub Actions / Fastlane / TestFlight that does not renew certificates automatically, please run the '3. Create Certificates' workflow for each of these apps to allow these apps to be built."
118+
echo "::warning::✅ But don't worry about your existing TestFlight builds, they will keep working!"

‎.github/workflows/validate_secrets.yml

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ on: [workflow_call, workflow_dispatch]
55
jobs:
66
validate-access-token:
77
name: Access
8-
runs-on: macos-14
8+
runs-on: macos-15
99
env:
1010
GH_PAT: ${{ secrets.GH_PAT }}
1111
GH_TOKEN: ${{ secrets.GH_PAT }}
@@ -74,7 +74,7 @@ jobs:
7474
validate-match-secrets:
7575
name: Match-Secrets
7676
needs: validate-access-token
77-
runs-on: macos-14
77+
runs-on: macos-15
7878
env:
7979
GH_TOKEN: ${{ secrets.GH_PAT }}
8080
steps:
@@ -112,7 +112,7 @@ jobs:
112112
validate-fastlane-secrets:
113113
name: Fastlane
114114
needs: [validate-access-token, validate-match-secrets]
115-
runs-on: macos-14
115+
runs-on: macos-15
116116
env:
117117
GH_PAT: ${{ secrets.GH_PAT }}
118118
GH_TOKEN: ${{ secrets.GH_PAT }}
@@ -178,16 +178,15 @@ jobs:
178178
elif ! echo "$FASTLANE_KEY" | openssl pkcs8 -nocrypt >/dev/null; then
179179
failed=true
180180
echo "::error::The FASTLANE_KEY secret is set but invalid. Verify that you copied it correctly from the API Key file (*.p8) you downloaded and try again."
181-
elif ! bundle exec fastlane validate_secrets 2>&1 | tee fastlane.log; then
181+
elif ! (bundle exec fastlane validate_secrets 2>&1 || true) | tee fastlane.log; then # ignore "fastlane validate_secrets" errors and continue on errors without annotating an exit code
182182
if grep -q "bad decrypt" fastlane.log; then
183183
failed=true
184184
echo "::error::Unable to decrypt the Match-Secrets repository using the MATCH_PASSWORD secret. Verify that it is set correctly and try again."
185185
elif grep -q -e "required agreement" -e "license agreement" fastlane.log; then
186186
failed=true
187-
echo "::error::Unable to create a valid authorization token for the App Store Connect API. Verify that the latest developer program license agreement has been accepted at https://developer.apple.com/account (review and accept any updated agreement), then wait a few minutes for changes to propagate and try again."
188-
elif ! grep -q -e "No code signing identity found" -e "Could not install WWDR certificate" fastlane.log; then
189-
failed=true
190-
echo "::error::Unable to create a valid authorization token for the App Store Connect API. Verify that the FASTLANE_ISSUER_ID, FASTLANE_KEY_ID, and FASTLANE_KEY secrets are set correctly and try again."
187+
echo "::error::❗️ Verify that the latest developer program license agreement has been accepted at https://developer.apple.com/account (review and accept any updated agreement), then wait a few minutes for changes to take effect and try again."
188+
elif grep -q "Your certificate .* is not valid" fastlane.log; then
189+
echo "::notice::Your Distribution certificate is invalid or expired. Automated renewal of the certificate will be attempted."
191190
fi
192191
fi
193192

‎G7SensorKit

0 commit comments

Comments
 (0)