diff --git a/.github/workflows/build_loop.yml b/.github/workflows/build_loop.yml index 9dab27ff57..7bf98a8de7 100644 --- a/.github/workflows/build_loop.yml +++ b/.github/workflows/build_loop.yml @@ -1,11 +1,7 @@ -name: 4. Build Loop -run-name: Build Loop (${{ github.ref_name }}) +name: 4. Build Loop Manual +run-name: Build Loop Manual (${{ github.ref_name }}) on: workflow_dispatch: - schedule: - # Check for updates every Sunday - # Later logic builds if there are updates or if it is the 2nd Sunday of the month - - cron: "33 7 * * 0" # Sunday at UTC 7:33 env: GH_PAT: ${{ secrets.GH_PAT }} @@ -260,4 +256,4 @@ jobs: name: build-artifacts path: | artifacts - buildlog + buildlog \ No newline at end of file diff --git a/.github/workflows/build_loop_auto.yml b/.github/workflows/build_loop_auto.yml new file mode 100644 index 0000000000..5d2d647be3 --- /dev/null +++ b/.github/workflows/build_loop_auto.yml @@ -0,0 +1,287 @@ +name: 4. Build Loop Auto +run-name: Build Loop Auto (${{ github.ref_name }}) +on: + workflow_dispatch: + schedule: + # Check for updates every Sunday + # Later logic builds if there are updates or if it is the 2nd Sunday of the month + - cron: "33 7 * * 0" # Sunday at UTC 7:33 + +env: + GH_PAT: ${{ secrets.GH_PAT }} + UPSTREAM_REPO: LoopKit/LoopWorkspace + UPSTREAM_BRANCH: ${{ github.ref_name }} # branch on upstream repository to sync from (replace with specific branch name if needed) + TARGET_BRANCH: ${{ github.ref_name }} # target branch on fork to be kept in sync + +jobs: + # use a single runner for these sequential steps + check_status: + runs-on: ubuntu-latest + name: Check status to decide whether to build + permissions: + contents: write + outputs: + NEW_COMMITS: ${{ steps.sync.outputs.has_new_commits }} + IS_SECOND_IN_MONTH: ${{ steps.date-check.outputs.is_second_instance }} + + # Check GH_PAT, sync repository, check day in month + steps: + + - name: Access + id: workflow-permission + run: | + # Validate Access Token + + # Ensure that gh exit codes are handled when output is piped. + set -o pipefail + + # Define patterns to validate the access token (GH_PAT) and distinguish between classic and fine-grained tokens. + GH_PAT_CLASSIC_PATTERN='^ghp_[a-zA-Z0-9]{36}$' + GH_PAT_FINE_GRAINED_PATTERN='^github_pat_[a-zA-Z0-9]{22}_[a-zA-Z0-9]{59}$' + + # Validate Access Token (GH_PAT) + if [ -z "$GH_PAT" ]; then + failed=true + echo "::error::The GH_PAT secret is unset or empty. Set it and try again." + else + if [[ $GH_PAT =~ $GH_PAT_CLASSIC_PATTERN ]]; then + provides_scopes=true + echo "The GH_PAT secret is a structurally valid classic token." + elif [[ $GH_PAT =~ $GH_PAT_FINE_GRAINED_PATTERN ]]; then + echo "The GH_PAT secret is a structurally valid fine-grained token." + else + unknown_format=true + echo "The GH_PAT secret does not have a known token format." + fi + + # Attempt to capture the x-oauth-scopes scopes of the token. + if ! scopes=$(curl -sS -f -I -H "Authorization: token $GH_PAT" https://api.github.com | { grep -i '^x-oauth-scopes:' || true; } | cut -d ' ' -f2- | tr -d '\r'); then + failed=true + if [ $unknown_format ]; then + echo "::error::Unable to connect to GitHub using the GH_PAT secret. Verify that it is set correctly (including the 'ghp_' or 'github_pat_' prefix) and try again." + else + echo "::error::Unable to connect to GitHub using the GH_PAT secret. Verify that the token exists and has not expired at https://github.com/settings/tokens. If necessary, regenerate or create a new token (and update the secret), then try again." + fi + elif [[ $scopes =~ workflow ]]; then + echo "The GH_PAT secret has repo and workflow permissions." + echo "has_permission=true" >> $GITHUB_OUTPUT + elif [[ $scopes =~ repo ]]; then + echo "The GH_PAT secret has repo (but not workflow) permissions." + elif [ $provides_scopes ]; then + failed=true + if [ -z "$scopes" ]; then + echo "The GH_PAT secret is valid and can be used to connect to GitHub, but it does not provide any permission scopes." + else + echo "The GH_PAT secret is valid and can be used to connect to GitHub, but it only provides the following permission scopes: $scopes" + fi + echo "::error::The GH_PAT secret is lacking at least the 'repo' permission scope required to access the Match-Secrets repository. Update the token permissions at https://github.com/settings/tokens (to include the 'repo' and 'workflow' scopes) and try again." + else + echo "The GH_PAT secret is valid and can be used to connect to GitHub, but it does not provide inspectable scopes. Assuming that the 'repo' and 'workflow' permission scopes required to access the Match-Secrets repository and perform automations are present." + echo "has_permission=true" >> $GITHUB_OUTPUT + fi + fi + + # Exit unsuccessfully if secret validation failed. + if [ $failed ]; then + exit 2 + fi + + - name: Checkout target repo + if: | + steps.workflow-permission.outputs.has_permission == 'true' && + (vars.SCHEDULED_BUILD != 'false' || vars.SCHEDULED_SYNC != 'false') + uses: actions/checkout@v5 + with: + token: ${{ secrets.GH_PAT }} + + # This syncs any target branch to upstream branch of the same name + - name: Sync upstream changes + if: | # do not run the upstream sync action on the upstream repository + steps.workflow-permission.outputs.has_permission == 'true' && + vars.SCHEDULED_SYNC != 'false' && github.repository_owner != 'LoopKit' + id: sync + uses: aormsby/Fork-Sync-With-Upstream-action@v3.4.2 + with: + target_sync_branch: ${{ env.TARGET_BRANCH }} + shallow_since: 6 months ago + target_repo_token: ${{ secrets.GH_PAT }} + upstream_sync_branch: ${{ env.UPSTREAM_BRANCH }} + upstream_sync_repo: ${{ env.UPSTREAM_REPO }} + + # Display a sample message based on the sync output var 'has_new_commits' + - name: New commits found + if: | + steps.workflow-permission.outputs.has_permission == 'true' && + vars.SCHEDULED_SYNC != 'false' && steps.sync.outputs.has_new_commits == 'true' + run: echo "New commits were found to sync." + + - name: No new commits + if: | + steps.workflow-permission.outputs.has_permission == 'true' && + vars.SCHEDULED_SYNC != 'false' && steps.sync.outputs.has_new_commits == 'false' + run: echo "There were no new commits." + + - name: Show value of 'has_new_commits' + if: steps.workflow-permission.outputs.has_permission == 'true' && vars.SCHEDULED_SYNC != 'false' + run: | + echo ${{ steps.sync.outputs.has_new_commits }} + echo "NEW_COMMITS=${{ steps.sync.outputs.has_new_commits }}" >> $GITHUB_OUTPUT + + - name: Show scheduled build configuration message + if: steps.workflow-permission.outputs.has_permission != 'true' + run: | + echo "### :calendar: Scheduled Sync and Build Disabled :mobile_phone_off:" >> $GITHUB_STEP_SUMMARY + echo "You have not yet configured the scheduled sync and build for Loop's browser build." >> $GITHUB_STEP_SUMMARY + echo "Synchronizing your fork of LoopWorkspace with the upstream repository LoopKit/LoopWorkspace will be skipped." >> $GITHUB_STEP_SUMMARY + echo "If you want to enable automatic builds and updates for your Loop, please follow the instructions \ + under the following path LoopWorkspace/fastlane/testflight.md." >> $GITHUB_STEP_SUMMARY + + # Set a logic flag if this is the second instance of this day-of-week in this month + - name: Check if this is the second time this day-of-week happens this month + id: date-check + run: | + DAY_OF_MONTH=$(date +%-d) + WEEK_OF_MONTH=$(( ($(date +%-d) - 1) / 7 + 1 )) + if [[ $WEEK_OF_MONTH -eq 2 ]]; then + echo "is_second_instance=true" >> "$GITHUB_OUTPUT" + else + echo "is_second_instance=false" >> "$GITHUB_OUTPUT" + fi + + # When a scheduled run finds nothing new to build, cancel the run so it shows + # as "cancelled" instead of "success" — a green check should always mean a + # new build was made. + cancel_when_no_build: + needs: check_status + name: Cancel run when there is nothing to build + runs-on: ubuntu-latest + permissions: + actions: write + if: | + github.event_name == 'schedule' && + !(vars.SCHEDULED_BUILD != 'false' && needs.check_status.outputs.IS_SECOND_IN_MONTH == 'true') && + !(vars.SCHEDULED_SYNC != 'false' && needs.check_status.outputs.NEW_COMMITS == 'true') + steps: + - name: Cancel the run + env: + GH_TOKEN: ${{ github.token }} + run: | + echo "Repository is up to date and no monthly build is due — cancelling this run so it is not reported as a successful build." >> "$GITHUB_STEP_SUMMARY" + gh run cancel ${{ github.run_id }} --repo ${{ github.repository }} + # Keep the job alive until the cancellation lands, so the run ends as + # "cancelled" rather than completing successfully first. + sleep 300 + + # Checks if Distribution certificate is present and valid, optionally nukes and + # creates new certs if the repository variable ENABLE_NUKE_CERTS == 'true' + # only run if a build is planned + check_certs: + needs: [check_status] + name: Check certificates + uses: ./.github/workflows/create_certs.yml + secrets: inherit + if: | + github.event_name == 'workflow_dispatch' || + (vars.SCHEDULED_BUILD != 'false' && needs.check_status.outputs.IS_SECOND_IN_MONTH == 'true') || + (vars.SCHEDULED_SYNC != 'false' && needs.check_status.outputs.NEW_COMMITS == 'true' ) + + # Builds Loop + build: + name: Build + needs: [check_certs, check_status] + runs-on: macos-26 + permissions: + contents: write + if: + | # builds with manual start; if scheduled: once a month or when new commits are found + github.event_name == 'workflow_dispatch' || + (vars.SCHEDULED_BUILD != 'false' && needs.check_status.outputs.IS_SECOND_IN_MONTH == 'true') || + (vars.SCHEDULED_SYNC != 'false' && needs.check_status.outputs.NEW_COMMITS == 'true' ) + steps: + - name: Select Xcode version + run: "sudo xcode-select --switch /Applications/Xcode_26.5.app/Contents/Developer" + + - name: Checkout Repo for building + uses: actions/checkout@v5 + with: + token: ${{ secrets.GH_PAT }} + submodules: recursive + ref: ${{ env.TARGET_BRANCH }} + + # Customize Loop: Download and apply patches + - name: Customize Loop + run: | + + # LoopWorkspace patches + # -applies any patches located in the LoopWorkspace/patches/ directory + if $(ls ./patches/* &> /dev/null); then + git apply ./patches/* --allow-empty -v --whitespace=fix + fi + + # Submodule Loop patches: + # Template for customizing submodule Loop (changes Loop app name to "CustomLoop") + # Remove the "#" sign from the beginning of the line below to activate: + #curl https://github.com/loopnlearn/Loop/commit/d206432b024279ef710df462b20bd464cd9682d4.patch | git apply --directory=Loop -v --whitespace=fix + + # Submodule LoopKit patches: + # General template for customizing submodule LoopKit + # Copy url from a GitHub commit or pull request and insert below, and remove the "#" sign from the beginning of the line to activate: + #curl url_to_github_commit.patch | git apply --directory=LoopKit -v --whitespace=fix + + # Submodule xxxxx patches: + + # Add patches for customization of additional submodules by following the templates above, + # and make sure to specify the submodule by setting "--directory=(submodule_name)". + # Several patches may be added per submodule. + # Adding comments (#) may be useful to easily tell the individual patches apart. + + # Patch Fastlane Match to not print tables + - name: Patch Match Tables + run: | + TABLE_PRINTER_PATH=$(ruby -e 'puts Gem::Specification.find_by_name("fastlane").gem_dir')/match/lib/match/table_printer.rb + if [ -f "$TABLE_PRINTER_PATH" ]; then + sed -i "" "/puts(Terminal::Table.new(params))/d" "$TABLE_PRINTER_PATH" + else + echo "table_printer.rb not found" + exit 1 + fi + + # Install project dependencies + - name: Install Project Dependencies + run: bundle install + + # Sync the GitHub runner clock with the Windows time server (workaround as suggested in https://github.com/actions/runner/issues/2996) + - name: Sync clock + run: sudo sntp -sS time.windows.com + + # Build signed Loop IPA file + - name: Fastlane Build & Archive + run: bundle exec fastlane build_loop + env: + TEAMID: ${{ secrets.TEAMID }} + GH_PAT: ${{ secrets.GH_PAT }} + FASTLANE_KEY_ID: ${{ secrets.FASTLANE_KEY_ID }} + FASTLANE_ISSUER_ID: ${{ secrets.FASTLANE_ISSUER_ID }} + FASTLANE_KEY: ${{ secrets.FASTLANE_KEY }} + MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }} + + # Upload to TestFlight + - name: Fastlane upload to TestFlight + run: bundle exec fastlane release + env: + TEAMID: ${{ secrets.TEAMID }} + GH_PAT: ${{ secrets.GH_PAT }} + FASTLANE_KEY_ID: ${{ secrets.FASTLANE_KEY_ID }} + FASTLANE_ISSUER_ID: ${{ secrets.FASTLANE_ISSUER_ID }} + FASTLANE_KEY: ${{ secrets.FASTLANE_KEY }} + MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }} + + # Upload Build artifacts + - name: Upload build log, IPA and Symbol artifacts + if: always() + uses: actions/upload-artifact@v6 + with: + name: build-artifacts + path: | + artifacts + buildlog \ No newline at end of file diff --git a/Gemfile b/Gemfile index 0eb90cb08b..502d6331b5 100644 --- a/Gemfile +++ b/Gemfile @@ -1,2 +1,2 @@ source "https://rubygems.org" -gem "fastlane", "2.235.0" +gem "fastlane", "2.237.0" diff --git a/Gemfile.lock b/Gemfile.lock index 0089a8cdb4..8e70830ead 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -8,8 +8,8 @@ GEM artifactory (3.0.17) atomos (0.1.3) aws-eventstream (1.4.0) - aws-partitions (1.1206.0) - aws-sdk-core (3.241.4) + aws-partitions (1.1267.0) + aws-sdk-core (3.253.0) aws-eventstream (~> 1, >= 1.3.0) aws-partitions (~> 1, >= 1.992.0) aws-sigv4 (~> 1.9) @@ -17,19 +17,19 @@ GEM bigdecimal jmespath (~> 1, >= 1.6.1) logger - aws-sdk-kms (1.121.0) - aws-sdk-core (~> 3, >= 3.241.4) + aws-sdk-kms (1.129.0) + aws-sdk-core (~> 3, >= 3.248.0) aws-sigv4 (~> 1.5) - aws-sdk-s3 (1.211.0) - aws-sdk-core (~> 3, >= 3.241.3) + aws-sdk-s3 (1.226.0) + aws-sdk-core (~> 3, >= 3.248.0) aws-sdk-kms (~> 1) aws-sigv4 (~> 1.5) aws-sigv4 (1.12.1) aws-eventstream (~> 1, >= 1.0.2) babosa (1.0.4) - base64 (0.2.0) + base64 (0.3.0) benchmark (0.5.0) - bigdecimal (4.0.1) + bigdecimal (4.1.2) claide (1.1.0) colored (1.2) colored2 (3.1.2) @@ -42,8 +42,9 @@ GEM domain_name (0.6.20240107) dotenv (2.8.1) emoji_regex (3.2.3) - excon (0.112.0) - faraday (1.10.5) + excon (1.5.0) + logger + faraday (1.10.6) faraday-em_http (~> 1.0) faraday-em_synchrony (~> 1.0) faraday-excon (~> 1.1) @@ -71,11 +72,11 @@ GEM faraday-retry (1.0.4) faraday_middleware (1.2.1) faraday (~> 1.0) - fastimage (2.4.0) - fastlane (2.235.0) + fastimage (2.4.1) + fastlane (2.237.0) CFPropertyList (>= 2.3, < 5.0.0) abbrev (~> 0.1) - addressable (>= 2.8, < 3.0.0) + addressable (>= 2.9.0, < 3.0.0) artifactory (~> 3.0) aws-sdk-s3 (~> 1.197) babosa (>= 1.0.3, < 2.0.0) @@ -87,7 +88,7 @@ GEM csv (~> 3.3) dotenv (>= 2.1.1, < 3.0.0) emoji_regex (>= 0.1, < 4.0) - excon (>= 0.71.0, < 1.0.0) + excon (>= 0.71.0, < 2.0.0) faraday (~> 1.0) faraday-cookie_jar (~> 0.0.6) faraday_middleware (~> 1.0) @@ -101,9 +102,10 @@ GEM highline (~> 2.0) http-cookie (~> 1.0.5) json (< 3.0.0) - jwt (>= 2.1.0, < 4) + jwt (>= 2.10.3, < 4) logger (>= 1.6, < 2.0) mini_magick (>= 4.9.4, < 5.0.0) + multi_json (~> 1.12) multipart-post (>= 2.0.0, < 3.0.0) mutex_m (~> 0.3) naturally (~> 2.2) @@ -124,41 +126,46 @@ GEM xcpretty-travis-formatter (>= 0.0.3, < 2.0.0) fastlane-sirp (1.1.0) gh_inspector (1.1.3) - google-apis-androidpublisher_v3 (0.54.0) - google-apis-core (>= 0.11.0, < 2.a) - google-apis-core (0.11.3) + google-apis-androidpublisher_v3 (0.104.0) + google-apis-core (>= 0.15.0, < 2.a) + google-apis-core (0.18.0) addressable (~> 2.5, >= 2.5.1) - googleauth (>= 0.16.2, < 2.a) - httpclient (>= 2.8.1, < 3.a) + googleauth (~> 1.9) + httpclient (>= 2.8.3, < 3.a) mini_mime (~> 1.0) + mutex_m representable (~> 3.0) retriable (>= 2.0, < 4.a) - rexml - google-apis-iamcredentials_v1 (0.17.0) - google-apis-core (>= 0.11.0, < 2.a) - google-apis-playcustomapp_v1 (0.13.0) - google-apis-core (>= 0.11.0, < 2.a) - google-apis-storage_v1 (0.31.0) - google-apis-core (>= 0.11.0, < 2.a) - google-cloud-core (1.8.0) + google-apis-iamcredentials_v1 (0.28.0) + google-apis-core (>= 0.15.0, < 2.a) + google-apis-playcustomapp_v1 (0.18.0) + google-apis-core (>= 0.15.0, < 2.a) + google-apis-storage_v1 (0.64.0) + google-apis-core (>= 0.15.0, < 2.a) + google-cloud-core (1.9.0) google-cloud-env (>= 1.0, < 3.a) google-cloud-errors (~> 1.0) - google-cloud-env (1.6.0) - faraday (>= 0.17.3, < 3.0) - google-cloud-errors (1.5.0) - google-cloud-storage (1.47.0) + google-cloud-env (2.2.2) + base64 (~> 0.2) + faraday (>= 1.0, < 3.a) + google-cloud-errors (1.7.0) + google-cloud-storage (1.62.0) addressable (~> 2.8) digest-crc (~> 0.4) - google-apis-iamcredentials_v1 (~> 0.1) - google-apis-storage_v1 (~> 0.31.0) + google-apis-core (>= 0.18, < 2) + google-apis-iamcredentials_v1 (~> 0.18) + google-apis-storage_v1 (>= 0.42) google-cloud-core (~> 1.6) - googleauth (>= 0.16.2, < 2.a) + googleauth (~> 1.9) mini_mime (~> 1.0) - googleauth (1.8.1) - faraday (>= 0.17.3, < 3.a) - jwt (>= 1.4, < 3.0) - multi_json (~> 1.11) + google-logging-utils (0.2.0) + googleauth (1.17.1) + faraday (>= 1.0, < 3.a) + google-cloud-env (~> 2.2) + google-logging-utils (~> 0.1) + jwt (>= 1.4, < 4.0) os (>= 0.9, < 2.0) + pstore (~> 0.1) signet (>= 0.16, < 2.a) highline (2.0.3) http-cookie (1.0.8) @@ -166,39 +173,39 @@ GEM httpclient (2.9.0) mutex_m jmespath (1.6.2) - json (2.19.4) - jwt (2.10.2) + json (2.20.0) + jwt (3.2.0) base64 logger (1.7.0) mini_magick (4.13.2) mini_mime (1.1.5) - multi_json (1.19.1) + multi_json (1.21.1) multipart-post (2.4.1) mutex_m (0.3.0) nanaimo (0.4.0) naturally (2.3.0) - nkf (0.2.0) + nkf (0.3.0) optparse (0.8.1) os (1.1.4) ostruct (0.6.3) plist (3.7.2) - public_suffix (7.0.2) - rake (13.3.1) + pstore (0.2.1) + public_suffix (7.0.5) + rake (13.4.2) representable (3.2.0) declarative (< 0.1.0) trailblazer-option (>= 0.1.1, < 0.2.0) uber (< 0.2.0) - retriable (3.1.2) + retriable (3.8.0) rexml (3.4.4) rouge (3.28.0) ruby2_keywords (0.0.5) rubyzip (2.4.1) security (0.1.5) - signet (0.21.0) + signet (0.22.0) addressable (~> 2.8) faraday (>= 0.17.5, < 3.a) jwt (>= 1.5, < 4.0) - multi_json (~> 1.10) simctl (1.6.10) CFPropertyList naturally @@ -213,12 +220,14 @@ GEM uber (0.1.0) unicode-display_width (2.6.0) word_wrap (1.0.0) - xcodeproj (1.27.0) + xcodeproj (1.28.1) CFPropertyList (>= 2.3.3, < 4.0) atomos (~> 0.1.3) + base64 claide (>= 1.0.2, < 2.0) colored2 (~> 3.1) nanaimo (~> 0.4.0) + nkf rexml (>= 3.3.6, < 4.0) xcpretty (0.4.1) rouge (~> 3.28.0) @@ -230,7 +239,7 @@ PLATFORMS ruby DEPENDENCIES - fastlane (= 2.235.0) + fastlane (= 2.237.0) BUNDLED WITH 4.0.12 diff --git a/fastlane/testflight.md b/fastlane/testflight.md index b44f07df07..185aea17e0 100644 --- a/fastlane/testflight.md +++ b/fastlane/testflight.md @@ -12,7 +12,7 @@ These instructions allow you to build your app without having access to a Mac. > The browser build **defaults to** automatically updating and building a new version of Loop according to this schedule: > - automatically checks for updates weekly and if updates are found, it will build a new version of the app > - even when there are no updates, it builds on the second Sunday of the month -> - with each scheduled weekly run, a successful build log appears - if the time is very short, it did not need to build - only the long actions (>20 minutes) built a new app +> - if a scheduled run finds nothing new to build, the run is cancelled and shows as cancelled (grey) in the Actions list - a green check always means a new build was made and uploaded to TestFlight > > The [**Optional**](#optional) section provides instructions to modify the default behavior if desired.