vineyardbovines
145 lines
4.7 KiB
YAML
145 lines
4.7 KiB
YAML
---
|
|
name: Deploy Production OTA
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'ota-*'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
DENIS_RELEASE_TAG: denis-v0.1.1
|
|
|
|
jobs:
|
|
validate:
|
|
if: github.repository == 'bluesky-social/social-app'
|
|
name: Validate production OTA
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
runtime-version: ${{ steps.target.outputs.runtime-version }}
|
|
ios-build-number: ${{ steps.target.outputs.ios-build-number }}
|
|
android-version-code: ${{ steps.target.outputs.android-version-code }}
|
|
steps:
|
|
- name: ⬇️ Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: 🧐 Resolve and validate OTA target
|
|
id: target
|
|
run: bash scripts/resolveOtaTarget.sh
|
|
|
|
- uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
|
|
|
|
- name: 🔧 Setup Node
|
|
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version-file: package.json
|
|
cache: pnpm
|
|
|
|
- name: 📷 Check native fingerprint and install dependencies
|
|
id: fingerprint
|
|
uses: bluesky-social/github-actions/fingerprint-native@abc6a46eb4badf243f55bfd7d6cec42722456300 # v0.3.0
|
|
with:
|
|
profile: production
|
|
previous-commit-tag: ${{ steps.target.outputs.runtime-version }}
|
|
|
|
- name: 🛑 Reject native changes
|
|
if: ${{ steps.fingerprint.outputs.includes-changes }}
|
|
run: |
|
|
echo "::error::Production OTA contains native changes and requires a full app release."
|
|
exit 1
|
|
|
|
- name: 🔤 Compile translations
|
|
uses: ./.github/actions/compile-i18n
|
|
|
|
- name: 🧹 Lint check
|
|
run: pnpm lint
|
|
|
|
- name: 💅 Prettier check
|
|
run: pnpm prettier --check .
|
|
|
|
- name: 🔎 Type check
|
|
run: pnpm typecheck
|
|
|
|
publish:
|
|
name: Publish production OTA
|
|
needs: [validate]
|
|
runs-on: ubuntu-latest
|
|
environment: production-ota
|
|
permissions:
|
|
id-token: write
|
|
contents: read
|
|
concurrency:
|
|
group: production-ota-deploy
|
|
cancel-in-progress: false
|
|
steps:
|
|
- name: ⬇️ Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
|
|
|
|
- name: 🔧 Setup Node
|
|
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version-file: package.json
|
|
cache: pnpm
|
|
|
|
- name: 🔑 Check for EXPO_TOKEN
|
|
run: >
|
|
if [ -z "${{ secrets.EXPO_TOKEN }}" ]; then
|
|
echo "You must provide an EXPO_TOKEN secret linked to this project's Expo account in this repo's secrets."
|
|
exit 1
|
|
fi
|
|
|
|
- name: 🔨 Setup EAS
|
|
uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
|
|
with:
|
|
eas-version: '19.0.5'
|
|
packager: 'pnpm --allow-build=dtrace-provider'
|
|
token: ${{ secrets.EXPO_TOKEN }}
|
|
|
|
- name: 🪛 Setup jq
|
|
uses: dcarbone/install-jq-action@4fcb5062d7ce9bc4382d1a352d19ba3ba2c317c1 # v4.0.1
|
|
|
|
- name: ✏️ Write environment variables
|
|
id: env
|
|
uses: ./.github/actions/write-env
|
|
with:
|
|
env-token: ${{ secrets.ENV_TOKEN }}
|
|
sentry-dsn: ${{ secrets.SENTRY_DSN }}
|
|
bitdrift-api-key: ${{ secrets.BITDRIFT_API_KEY }}
|
|
gcp-project-id: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
|
|
google-services-token: ${{ secrets.GOOGLE_SERVICES_TOKEN }}
|
|
expo-public-env: production
|
|
|
|
- name: 🏗️ Create Bundle
|
|
run: >
|
|
SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
|
|
SENTRY_RELEASE=${{ steps.env.outputs.release-version }}
|
|
SENTRY_DIST=${{ steps.env.outputs.bundle-identifier }}
|
|
pnpm export
|
|
|
|
- name: ☁️ Configure AWS credentials (denis)
|
|
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
|
|
with:
|
|
role-to-assume: arn:aws:iam::007404326489:role/denis-ci-publish
|
|
aws-region: us-east-2
|
|
|
|
- name: ⬇️ Setup denis CLI
|
|
uses: ./.github/actions/setup-denis
|
|
with:
|
|
release-tag: ${{ env.DENIS_RELEASE_TAG }}
|
|
app-id: ${{ vars.SYNC_INTERNAL_APP_ID }}
|
|
private-key: ${{ secrets.SYNC_INTERNAL_PK }}
|
|
|
|
- name: 🚀 Publish OTA to denis (S3)
|
|
run: pnpm use-build-number bash scripts/denisPublish.sh
|
|
env:
|
|
RUNTIME_VERSION: ${{ needs.validate.outputs.runtime-version }}
|
|
CHANNEL_NAME: production
|
|
BSKY_IOS_BUILD_NUMBER: ${{ needs.validate.outputs.ios-build-number }}
|
|
BSKY_ANDROID_VERSION_CODE: ${{ needs.validate.outputs.android-version-code }}
|