Build and deploy apps for testing #2159
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and deploy apps for testing | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| PULL_REQUEST_NUMBER: | |
| description: Pull Request number for correct placement of apps | |
| required: true | |
| pull_request_target: | |
| types: [opened, synchronize, labeled] | |
| branches: ['*ci-test/**'] | |
| env: | |
| PULL_REQUEST_NUMBER: ${{ github.event.number || github.event.inputs.PULL_REQUEST_NUMBER }} | |
| jobs: | |
| validateActor: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| READY_TO_BUILD: ${{ fromJSON(steps.isExpensifyEmployee.outputs.IS_EXPENSIFY_EMPLOYEE) && fromJSON(steps.hasReadyToBuildLabel.outputs.HAS_READY_TO_BUILD_LABEL) }} | |
| steps: | |
| - name: Is Expensify employee | |
| id: isExpensifyEmployee | |
| run: | | |
| if gh api /orgs/Expensify/teams/expensify-expensify/memberships/${{ github.actor }} --silent; then | |
| echo "IS_EXPENSIFY_EMPLOYEE=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "IS_EXPENSIFY_EMPLOYEE=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }} | |
| - id: hasReadyToBuildLabel | |
| name: Set HAS_READY_TO_BUILD_LABEL flag | |
| run: | | |
| echo "HAS_READY_TO_BUILD_LABEL=$(gh pr view "${{ env.PULL_REQUEST_NUMBER }}" --repo Expensify/App --json labels --jq '.labels[].name' | grep -q 'Ready To Build' && echo 'true')" >> "$GITHUB_OUTPUT" | |
| if [[ "$HAS_READY_TO_BUILD_LABEL" != 'true' ]]; then | |
| echo "The 'Ready to Build' label is not attached to the PR #${{ env.PULL_REQUEST_NUMBER }}" | |
| fi | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| getBranchRef: | |
| runs-on: ubuntu-latest | |
| needs: validateActor | |
| if: ${{ fromJSON(needs.validateActor.outputs.READY_TO_BUILD) }} | |
| outputs: | |
| REF: ${{steps.getHeadRef.outputs.REF}} | |
| steps: | |
| - name: Checkout | |
| if: ${{ github.event_name == 'workflow_dispatch' }} | |
| uses: actions/checkout@v4 | |
| - name: Check if pull request number is correct | |
| if: ${{ github.event_name == 'workflow_dispatch' }} | |
| id: getHeadRef | |
| run: | | |
| set -e | |
| echo "REF=$(gh pr view ${{ github.event.inputs.PULL_REQUEST_NUMBER }} --json headRefOid --jq '.headRefOid')" >> "$GITHUB_OUTPUT" | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| android: | |
| name: Build and deploy Android for testing | |
| needs: [validateActor, getBranchRef] | |
| if: ${{ fromJSON(needs.validateActor.outputs.READY_TO_BUILD) }} | |
| runs-on: ubuntu-latest-xl | |
| env: | |
| RUBYOPT: '-rostruct' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha || needs.getBranchRef.outputs.REF }} | |
| - name: Create .env.adhoc file based on staging and add PULL_REQUEST_NUMBER env to it | |
| run: | | |
| cp .env.staging .env.adhoc | |
| sed -i 's/ENVIRONMENT=staging/ENVIRONMENT=adhoc/' .env.adhoc | |
| echo "PULL_REQUEST_NUMBER=$PULL_REQUEST_NUMBER" >> .env.adhoc | |
| - name: Setup Node | |
| uses: ./.github/actions/composite/setupNode | |
| - name: Setup Java | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: 'oracle' | |
| java-version: '17' | |
| - name: Setup Ruby | |
| uses: ruby/setup-ruby@v1.190.0 | |
| with: | |
| bundler-cache: true | |
| - name: Decrypt keystore | |
| run: cd android/app && gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" --output my-upload-key.keystore my-upload-key.keystore.gpg | |
| env: | |
| LARGE_SECRET_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }} | |
| - name: Decrypt json key | |
| run: cd android/app && gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" --output android-fastlane-json-key.json android-fastlane-json-key.json.gpg | |
| env: | |
| LARGE_SECRET_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }} | |
| - name: Configure AWS Credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: us-east-1 | |
| - name: Configure MapBox SDK | |
| run: ./scripts/setup-mapbox-sdk.sh ${{ secrets.MAPBOX_SDK_DOWNLOAD_TOKEN }} | |
| - name: Run AdHoc build | |
| run: bundle exec fastlane android build_adhoc | |
| env: | |
| MYAPP_UPLOAD_STORE_PASSWORD: ${{ secrets.MYAPP_UPLOAD_STORE_PASSWORD }} | |
| MYAPP_UPLOAD_KEY_PASSWORD: ${{ secrets.MYAPP_UPLOAD_KEY_PASSWORD }} | |
| - name: Upload AdHoc build to S3 | |
| run: bundle exec fastlane android upload_s3 | |
| env: | |
| S3_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| S3_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| S3_BUCKET: ad-hoc-expensify-cash | |
| S3_REGION: us-east-1 | |
| - name: Upload Artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: android | |
| path: ./android_paths.json | |
| iOS: | |
| name: Build and deploy iOS for testing | |
| needs: [validateActor, getBranchRef] | |
| if: ${{ fromJSON(needs.validateActor.outputs.READY_TO_BUILD) }} | |
| env: | |
| DEVELOPER_DIR: /Applications/Xcode_15.2.0.app/Contents/Developer | |
| runs-on: macos-13-xlarge | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha || needs.getBranchRef.outputs.REF }} | |
| - name: Configure MapBox SDK | |
| run: ./scripts/setup-mapbox-sdk.sh ${{ secrets.MAPBOX_SDK_DOWNLOAD_TOKEN }} | |
| - name: Create .env.adhoc file based on staging and add PULL_REQUEST_NUMBER env to it | |
| run: | | |
| cp .env.staging .env.adhoc | |
| sed -i '' 's/ENVIRONMENT=staging/ENVIRONMENT=adhoc/' .env.adhoc | |
| echo "PULL_REQUEST_NUMBER=$PULL_REQUEST_NUMBER" >> .env.adhoc | |
| - name: Setup Node | |
| id: setup-node | |
| uses: ./.github/actions/composite/setupNode | |
| - name: Setup XCode | |
| run: sudo xcode-select -switch /Applications/Xcode_15.2.0.app | |
| - name: Setup Ruby | |
| uses: ruby/setup-ruby@v1.190.0 | |
| with: | |
| bundler-cache: true | |
| - name: Cache Pod dependencies | |
| uses: actions/cache@v4 | |
| id: pods-cache | |
| with: | |
| path: ios/Pods | |
| key: ${{ runner.os }}-pods-cache-${{ hashFiles('ios/Podfile.lock', 'firebase.json') }} | |
| - name: Compare Podfile.lock and Manifest.lock | |
| id: compare-podfile-and-manifest | |
| run: echo "IS_PODFILE_SAME_AS_MANIFEST=${{ hashFiles('ios/Podfile.lock') == hashFiles('ios/Pods/Manifest.lock') }}" >> "$GITHUB_OUTPUT" | |
| - name: Install cocoapods | |
| uses: nick-fields/retry@3f757583fb1b1f940bc8ef4bf4734c8dc02a5847 | |
| if: steps.pods-cache.outputs.cache-hit != 'true' || steps.compare-podfile-and-manifest.outputs.IS_PODFILE_SAME_AS_MANIFEST != 'true' || steps.setup-node.outputs.cache-hit != 'true' | |
| with: | |
| timeout_minutes: 10 | |
| max_attempts: 5 | |
| command: scripts/pod-install.sh | |
| - name: Decrypt AdHoc profile | |
| run: cd ios && gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" --output NewApp_AdHoc.mobileprovision NewApp_AdHoc.mobileprovision.gpg | |
| env: | |
| LARGE_SECRET_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }} | |
| - name: Decrypt AdHoc Notification Service profile | |
| run: cd ios && gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" --output NewApp_AdHoc_Notification_Service.mobileprovision NewApp_AdHoc_Notification_Service.mobileprovision.gpg | |
| env: | |
| LARGE_SECRET_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }} | |
| - name: Decrypt certificate | |
| run: cd ios && gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" --output Certificates.p12 Certificates.p12.gpg | |
| env: | |
| LARGE_SECRET_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }} | |
| - name: Configure AWS Credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: us-east-1 | |
| - name: Build AdHoc app | |
| run: bundle exec fastlane ios build_adhoc | |
| - name: Upload AdHoc build to S3 | |
| run: bundle exec fastlane ios upload_s3 | |
| env: | |
| S3_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| S3_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| S3_BUCKET: ad-hoc-expensify-cash | |
| S3_REGION: us-east-1 | |
| - name: Upload Artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ios | |
| path: ./ios_paths.json | |
| desktop: | |
| name: Build and deploy Desktop for testing | |
| needs: [validateActor, getBranchRef] | |
| if: ${{ fromJSON(needs.validateActor.outputs.READY_TO_BUILD) }} | |
| runs-on: macos-14-large | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha || needs.getBranchRef.outputs.REF }} | |
| - name: Create .env.adhoc file based on staging and add PULL_REQUEST_NUMBER env to it | |
| run: | | |
| cp .env.staging .env.adhoc | |
| sed -i '' 's/ENVIRONMENT=staging/ENVIRONMENT=adhoc/' .env.adhoc | |
| echo "PULL_REQUEST_NUMBER=$PULL_REQUEST_NUMBER" >> .env.adhoc | |
| - name: Setup Node | |
| uses: ./.github/actions/composite/setupNode | |
| - name: Decrypt Developer ID Certificate | |
| run: cd desktop && gpg --quiet --batch --yes --decrypt --passphrase="$DEVELOPER_ID_SECRET_PASSPHRASE" --output developer_id.p12 developer_id.p12.gpg | |
| env: | |
| DEVELOPER_ID_SECRET_PASSPHRASE: ${{ secrets.DEVELOPER_ID_SECRET_PASSPHRASE }} | |
| - name: Configure AWS Credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: us-east-1 | |
| - name: Build desktop app for testing | |
| run: npm run desktop-build-adhoc | |
| env: | |
| CSC_LINK: ${{ secrets.CSC_LINK }} | |
| CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }} | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }} | |
| AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| GCP_GEOLOCATION_API_KEY: $${{ secrets.GCP_GEOLOCATION_API_KEY_STAGING }} | |
| web: | |
| name: Build and deploy Web | |
| needs: [validateActor, getBranchRef] | |
| if: ${{ fromJSON(needs.validateActor.outputs.READY_TO_BUILD) }} | |
| runs-on: ubuntu-latest-xl | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha || needs.getBranchRef.outputs.REF }} | |
| - name: Create .env.adhoc file based on staging and add PULL_REQUEST_NUMBER env to it | |
| run: | | |
| cp .env.staging .env.adhoc | |
| sed -i 's/ENVIRONMENT=staging/ENVIRONMENT=adhoc/' .env.adhoc | |
| echo "PULL_REQUEST_NUMBER=$PULL_REQUEST_NUMBER" >> .env.adhoc | |
| - name: Setup Node | |
| uses: ./.github/actions/composite/setupNode | |
| - name: Configure AWS Credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: us-east-1 | |
| - name: Build web for testing | |
| run: npm run build-adhoc | |
| - name: Deploy to S3 for internal testing | |
| run: aws s3 cp --recursive --acl public-read "$GITHUB_WORKSPACE"/dist s3://ad-hoc-expensify-cash/web/"$PULL_REQUEST_NUMBER" | |
| postGithubComment: | |
| runs-on: ubuntu-latest | |
| name: Post a GitHub comment with app download links for testing | |
| needs: [validateActor, getBranchRef, android, iOS, desktop, web] | |
| if: ${{ always() }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| if: ${{ fromJSON(needs.validateActor.outputs.READY_TO_BUILD) }} | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha || needs.getBranchRef.outputs.REF }} | |
| - name: Download Artifact | |
| uses: actions/download-artifact@v4 | |
| if: ${{ fromJSON(needs.validateActor.outputs.READY_TO_BUILD) }} | |
| - name: Read JSONs with android paths | |
| id: get_android_path | |
| if: ${{ needs.android.result == 'success' }} | |
| run: | | |
| content_android="$(cat ./android/android_paths.json)" | |
| content_android="${content_android//'%'/'%25'}" | |
| content_android="${content_android//$'\n'/'%0A'}" | |
| content_android="${content_android//$'\r'/'%0D'}" | |
| android_path=$(echo "$content_android" | jq -r '.html_path') | |
| echo "android_path=$android_path" >> "$GITHUB_OUTPUT" | |
| - name: Read JSONs with iOS paths | |
| id: get_ios_path | |
| if: ${{ needs.iOS.result == 'success' }} | |
| run: | | |
| content_ios="$(cat ./ios/ios_paths.json)" | |
| content_ios="${content_ios//'%'/'%25'}" | |
| content_ios="${content_ios//$'\n'/'%0A'}" | |
| content_ios="${content_ios//$'\r'/'%0D'}" | |
| ios_path=$(echo "$content_ios" | jq -r '.html_path') | |
| echo "ios_path=$ios_path" >> "$GITHUB_OUTPUT" | |
| - name: Publish links to apps for download | |
| if: ${{ fromJSON(needs.validateActor.outputs.READY_TO_BUILD) }} | |
| uses: ./.github/actions/javascript/postTestBuildComment | |
| with: | |
| PR_NUMBER: ${{ env.PULL_REQUEST_NUMBER }} | |
| GITHUB_TOKEN: ${{ github.token }} | |
| ANDROID: ${{ needs.android.result }} | |
| DESKTOP: ${{ needs.desktop.result }} | |
| IOS: ${{ needs.iOS.result }} | |
| WEB: ${{ needs.web.result }} | |
| ANDROID_LINK: ${{steps.get_android_path.outputs.android_path}} | |
| DESKTOP_LINK: https://ad-hoc-expensify-cash.s3.amazonaws.com/desktop/${{ env.PULL_REQUEST_NUMBER }}/NewExpensify.dmg | |
| IOS_LINK: ${{steps.get_ios_path.outputs.ios_path}} | |
| WEB_LINK: https://${{ env.PULL_REQUEST_NUMBER }}.pr-testing.expensify.com |