Check Certificates (check_and_renew_certificates) #58
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Check Certificates | |
| run-name: Check Certificates (${{ github.ref_name }}) | |
| on: | |
| workflow_dispatch: | |
| env: | |
| EXPIRATION_WARNING_DAYS: 7 | |
| jobs: | |
| check_certs: | |
| runs-on: ubuntu-latest | |
| env: | |
| FASTLANE_ISSUER_ID: ${{ secrets.FASTLANE_ISSUER_ID }} | |
| FASTLANE_KEY_ID: ${{ secrets.FASTLANE_KEY_ID }} | |
| FASTLANE_KEY: ${{ secrets.FASTLANE_KEY }} | |
| outputs: | |
| new_certificate_needed: ${{ steps.set_output.outputs.new_certificate_needed }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v3 | |
| - name: Set up Ruby | |
| uses: ruby/setup-ruby@v1 | |
| with: | |
| ruby-version: '3.1' | |
| - name: Install dependencies | |
| run: bundle install | |
| - name: Check Certificates and create or renew if needed | |
| env: | |
| FASTLANE_USER: ${{ secrets.APPLE_ID }} | |
| FASTLANE_PASSWORD: ${{ secrets.APPLE_PASSWORD }} | |
| run: bundle exec fastlane check_and_renew_certificates | |
| id: check_certs | |
| - name: Set output based on Fastlane result | |
| id: set_output | |
| run: | | |
| CERT_STATUS_FILE="${{ github.workspace }}/fastlane/new_certificate_needed.txt" | |
| if [ -f "$CERT_STATUS_FILE" ]; then | |
| CERT_STATUS=$(cat "$CERT_STATUS_FILE" | tr -d '\n' | tr -d '\r') # Read file content and strip newlines | |
| echo "new_certificate_needed: $CERT_STATUS" | |
| echo "new_certificate_needed=$CERT_STATUS" >> $GITHUB_OUTPUT | |
| else | |
| echo "Certificate status file not found. Defaulting to false." | |
| echo "new_certificate_needed=false" >> $GITHUB_OUTPUT | |
| fi | |
| # Nuke Certs if needed | |
| nuke_certs: | |
| needs: check_certs | |
| runs-on: macos-14 | |
| if: ${{ needs.check_certs.outputs.new_certificate_needed == 'true' }} | |
| steps: | |
| - name: Debug check_certs output | |
| run: echo "new_certificate_needed=${{ needs.check_certs.outputs.new_certificate_needed }}" | |
| - name: Checkout repository | |
| uses: actions/checkout@v3 | |
| - name: Set up Ruby | |
| uses: ruby/setup-ruby@v1 | |
| with: | |
| ruby-version: '3.1' | |
| - name: Install dependencies | |
| run: bundle install | |
| - name: Run Fastlane nuke_certs | |
| run: bundle exec fastlane nuke_certs | |
| env: | |
| TEAMID: ${{ secrets.TEAMID }} | |
| GH_PAT: ${{ secrets.GH_PAT }} | |
| MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }} | |
| FASTLANE_USER: ${{ secrets.FASTLANE_USER }} | |
| FASTLANE_KEY_ID: ${{ secrets.FASTLANE_KEY_ID }} | |
| FASTLANE_ISSUER_ID: ${{ secrets.FASTLANE_ISSUER_ID }} | |
| FASTLANE_KEY: ${{ secrets.FASTLANE_KEY }} | |
| FASTLANE_SKIP_ALL_LANE_SUMMARIES: "true" | |
| - name: Annotate Summary after Nuke | |
| run: | | |
| echo "::warning::Certificates have been nuked. All TestFlight profiles are revoked." | |
| echo "::notice::Run the 'Create Certificates' workflow for each dependent app to rebuild profiles." | |
| # Trigger create_certs.yml if nuke_certs ran | |
| trigger_create_certs: | |
| needs: [check_certs, nuke_certs] | |
| uses: ./.github/workflows/create_certs.yml | |
| secrets: inherit | |
| # Annotate Summary after Certificate Creation | |
| annotate_summary: | |
| needs: trigger_create_certs | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Annotate Summary | |
| run: | | |
| echo "::notice::Certificates have been recreated successfully." | |
| echo "::warning::Make sure to test builds using the new certificates." |