Add build_hotfix_release

duckduckgo · Feb 29, 2024 · 16b6645 · 16b6645
1 parent f3eec6c
commit 16b6645
Show file tree

Hide file tree

Showing 2 changed files with 132 additions and 0 deletions.
diff --git a/.github/actions/asana-add-comment/templates/hotfix-branch-ready.yml b/.github/actions/asana-add-comment/templates/hotfix-branch-ready.yml
@@ -0,0 +1,9 @@
+data:
+  html_text: |
+    <body>
+      <h2>Hotfix release branch ${BRANCH} is ready</h2>
+      <a data-asana-gid='${ASSIGNEE_ID}'/>, please follow up with having code merged to <code>${BRANCH}</code> and making a release build.</a>.
+
+
+      🔗 Workflow URL: <a href='${WORKFLOW_URL}'>${WORKFLOW_URL}</a>.
+    </body>
diff --git a/.github/workflows/build_hotfix_release.yml b/.github/workflows/build_hotfix_release.yml
@@ -0,0 +1,123 @@
+name: Build Hotfix Release
+
+on:
+  push:
+  workflow_dispatch:
+    inputs:
+      asana-task-url:
+        description: "Asana release task URL"
+        required: true
+        type: string
+      base-branch:
+        description: "Base branch (defaults to main, only override for testing)"
+        required: false
+        type: string
+      current-internal-release-branch:
+        description: "Current internal release branch (to merge hotfix branch to - hotfix branch is merged to main if this is not provided)"
+        required: false
+        type: string
+
+jobs:
+
+  assert_release_branch:
+
+    name: Assert Hotfix Branch
+
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+
+      - name: Assert hotfix release branch
+        run: |
+          case "${{ github.ref }}" in
+            refs/heads/hotfix/*) ;;
+            *) echo "👎 Not a hotfix release branch"; exit 1 ;;
+          esac
+
+  run_tests:
+
+    name: Run Tests
+
+    needs: assert_release_branch
+    uses: ./.github/workflows/pr.yml
+    secrets:
+      ASANA_ACCESS_TOKEN: ${{ secrets.ASANA_ACCESS_TOKEN }}
+
+  update_asana:
+
+    name: Update Asana tasks
+
+    needs: run_tests
+    runs-on: macos-13-xlarge
+    timeout-minutes: 10
+
+    steps:
+
+      - name: Check out the code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # Fetch all history and tags in order to extract Asana task URLs from git log
+          ref: ${{ github.ref_name }}
+          submodules: recursive
+
+      - name: Extract Asana Task ID
+        id: task-id
+        uses: ./.github/actions/asana-extract-task-id
+        with:
+          task-url: ${{ github.event.inputs.asana-task-url }}
+
+      - name: Update Asana tasks for the release
+        env:
+          ASANA_ACCESS_TOKEN: ${{ secrets.ASANA_ACCESS_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
+          BRANCH: ${{ github.ref_name }}
+        run: |
+          version="$(cut -d '/' -f 2 <<< "$BRANCH")"
+          ./scripts/update_asana_for_release.sh internal ${{ steps.task-id.outputs.task-id }} ${{ vars.MACOS_APP_BOARD_VALIDATION_SECTION_ID }} "${version}"
+
+  prepare_release:
+    name: Prepare Release
+    needs: run_tests
+    uses: ./.github/workflows/release.yml
+    with:
+      asana-task-url: ${{ github.event.inputs.asana-task-url }}
+    secrets:
+      BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
+      P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
+      KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+      REVIEW_PROVISION_PROFILE_BASE64: ${{ secrets.REVIEW_PROVISION_PROFILE_BASE64 }}
+      RELEASE_PROVISION_PROFILE_BASE64: ${{ secrets.RELEASE_PROVISION_PROFILE_BASE64 }}
+      DBP_AGENT_RELEASE_PROVISION_PROFILE_BASE64: ${{ secrets.DBP_AGENT_RELEASE_PROVISION_PROFILE_BASE64 }}
+      DBP_AGENT_REVIEW_PROVISION_PROFILE_BASE64: ${{ secrets.DBP_AGENT_REVIEW_PROVISION_PROFILE_BASE64 }}
+      NETP_SYSEX_RELEASE_PROVISION_PROFILE_BASE64_V2: ${{ secrets.NETP_SYSEX_RELEASE_PROVISION_PROFILE_BASE64_V2 }}
+      NETP_SYSEX_REVIEW_PROVISION_PROFILE_BASE64_V2: ${{ secrets.NETP_SYSEX_REVIEW_PROVISION_PROFILE_BASE64_V2 }}
+      NETP_AGENT_RELEASE_PROVISION_PROFILE_BASE64_V2: ${{ secrets.NETP_AGENT_RELEASE_PROVISION_PROFILE_BASE64_V2 }}
+      NETP_AGENT_REVIEW_PROVISION_PROFILE_BASE64_V2: ${{ secrets.NETP_AGENT_REVIEW_PROVISION_PROFILE_BASE64_V2 }}
+      NETP_NOTIFICATIONS_RELEASE_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_NOTIFICATIONS_RELEASE_PROVISION_PROFILE_BASE64 }}
+      NETP_NOTIFICATIONS_REVIEW_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_NOTIFICATIONS_REVIEW_PROVISION_PROFILE_BASE64 }}
+      APPLE_API_KEY_BASE64: ${{ secrets.APPLE_API_KEY_BASE64 }}
+      APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+      APPLE_API_KEY_ISSUER: ${{ secrets.APPLE_API_KEY_ISSUER }}
+      ASANA_ACCESS_TOKEN: ${{ secrets.ASANA_ACCESS_TOKEN }}
+      MM_HANDLES_BASE64: ${{ secrets.MM_HANDLES_BASE64 }}
+      MM_WEBHOOK_URL: ${{ secrets.MM_WEBHOOK_URL }}
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_ACCESS_KEY_ID_RELEASE_S3: ${{ secrets.AWS_ACCESS_KEY_ID_RELEASE_S3 }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      AWS_SECRET_ACCESS_KEY_RELEASE_S3: ${{ secrets.AWS_SECRET_ACCESS_KEY_RELEASE_S3 }}
+      MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
+      SSH_PRIVATE_KEY_FASTLANE_MATCH: ${{ secrets.SSH_PRIVATE_KEY_FASTLANE_MATCH }}
+
+  tag_and_merge:
+    name: Tag and Merge Branch
+    needs: [ prepare_release, update_asana ]
+    uses: ./.github/workflows/tag_release.yml
+    with:
+      asana-task-url: ${{ github.event.inputs.asana-task-url }}
+      branch: ${{ github.ref_name }}
+      base-branch: ${{ github.event.inputs.current-internal-release-branch || 'main' }}
+      prerelease: true
+    secrets:
+      ASANA_ACCESS_TOKEN: ${{ secrets.ASANA_ACCESS_TOKEN }}
+      GHA_ELEVATED_PERMISSIONS_TOKEN: ${{ secrets.GHA_ELEVATED_PERMISSIONS_TOKEN }}