main.yaml

name: Native Build & Test

env:
  cacheId: "13" # increment to expire the cache
  appBuildNumber: ${{ github.run_number }}
  appBuildVersion: "1.0.5"

on:
  workflow_dispatch:
  push:
    branches: [main]
    paths:
      - app/**
      - bifold
      - .github/workflows/**
  pull_request:
    branches: [main]
    paths:
      - app/**
      - bifold
      - .github/workflows/**

jobs:
  check-android-secrets:
    runs-on: ubuntu-22.04
    outputs:
      isReleaseBuild: ${{ steps.isReleaseBuild.outputs.defined }}
    steps:
      - id: isReleaseBuild
        if: env.PLAY_STORE_JKS_BASE64 != null && env.PLAY_STORE_JKS_ALIAS != null && env.PLAY_STORE_JKS_PASSWD != null
        run: echo "::set-output name=defined::true"
        env:
          PLAY_STORE_JKS_BASE64: ${{ secrets.PLAY_STORE_JKS_BASE64 }}
          PLAY_STORE_JKS_ALIAS: ${{ secrets.PLAY_STORE_JKS_ALIAS }}
          PLAY_STORE_JKS_PASSWD: ${{ secrets.PLAY_STORE_JKS_PASSWD }}

  check-ios-secrets:
    runs-on: ubuntu-22.04
    outputs:
      isReleaseBuild: ${{ steps.isReleaseBuild.outputs.defined }}
    steps:
      - id: isReleaseBuild
        if: env.CERTIFICATE != null && env.KEYCHIAN_PASSWD != null && env.PROVISIONING_PROFILE != null
        run: echo "::set-output name=defined::true"
        env:
          CERTIFICATE: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
          KEYCHIAN_PASSWD: ${{ secrets.KEYCHIAN_PASSWD }}
          PROVISIONING_PROFILE: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }}

  build-ios:
    # if: ${{ false }}  # disable for now
    needs: [check-ios-secrets]
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v2

      - name: Pull & update submodules recursively
        run: |
          git submodule update --init --recursive

      - name: Configure node
        uses: actions/setup-node@v1
        with:
          node-version: "16.15.0"
          registry-url: "https://registry.npmjs.org"

      - name: Configure ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: 2.7

      - name: What XCode are we using?
        run: |
          xcode-select -p

      # Watch for changes to the HEAD ref, use
      # git for cache keys.
      - name: Generate cache key
        run: |
          echo $(git rev-parse HEAD:app/ios) > ./dd-cache-key.txt

      - uses: actions/cache@v2
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-pip-${{ env.cacheId }}-${{ hashFiles('**/dd-cache-key.txt') }}
          restore-keys: |
            ${{ runner.os }}-pip-

        # GitHub recommends not caching node_modules but rather
        # .npm because it can break across Node versions and
        #  won't work with npm ci.
      - name: Cache node modules
        uses: actions/cache@v1
        id: npm-cache
        with:
          path: ~/.npm
          key: ${{ runner.os }}-node-${{ env.cacheId }}-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-${{ env.cacheId }}-

      - name: Cache pod dependencies
        id: pod-cache
        uses: actions/cache@v1
        with:
          path: app/ios/Pods
          key: ${{ runner.os }}-pods-${{ env.cacheId }}-${{ hashFiles('**/Podfile.lock ') }}
          restore-keys: |
            ${{ runner.os }}-pods-${{ env.cacheId }}-

      - name: Cache derived data
        uses: actions/cache@v1
        with:
          path: app/ios/xbuild/Build
          key: ${{ runner.os }}-dd-xcode-${{ env.cacheId }}-${{ hashFiles('**/dd-cache-key.txt') }}
          restore-keys: |
            ${{ runner.os }}-dd-xcode-${{ env.cacheId }}-

      - name: Install react native dependencies
        working-directory: ./
        run: |
          npm ci && \
          git status

      - name: Install iOS dependencies
        # if: steps.pod-cache.outputs.cache-hit != 'true' || steps.npm-cache.outputs.cache-hit != 'true'
        working-directory: app/ios
        run: |
          gem install cocoapods && \
          pod install && \
          git status && \
          git diff Podfile.lock

      - name: Bump Build No.
        working-directory: app/ios
        env:
          CURRENT_PROJECT_VERSION: ${{ env.appBuildNumber }}
          MARKETING_VERSION: ${{ env.appBuildVersion }}
        run: |
          agvtool new-version ${CURRENT_PROJECT_VERSION} && \
          agvtool new-marketing-version ${MARKETING_VERSION}

        # Actual environment variables are not being picked up
        # by the build so they're put into an .env file.
      - name: Create environment settings
        if: env.MEDIATOR_URL != null || env.BUGSNAG_API_KEY != null
        working-directory: app
        env:
          MEDIATOR_URL: ${{ secrets.MEDIATOR_URL }}
          BUGSNAG_API_KEY: ${{ secrets.BUGSNAG_API_KEY }}
        run: |
          echo "MEDIATOR_URL=${MEDIATOR_URL}" >.env |
          echo "BUGSNAG_API_KEY=${BUGSNAG_API_KEY}" >>.env
      # https://docs.github.com/en/actions/deployment/deploying-xcode-applications/installing-an-apple-certificate-on-macos-runners-for-xcode-development
      - name: Create Provisioning Profile
        if: github.ref_name == 'main' && needs.check-ios-secrets.outputs.isReleaseBuild == 'true'
        env:
          PROVISIONING_PROFILE: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }}
        run: |
          scripts/makepp.sh

      # https://docs.github.com/en/actions/deployment/deploying-xcode-applications/installing-an-apple-certificate-on-macos-runners-for-xcode-development
      - name: Build Keychain
        if: github.ref_name == 'main' && needs.check-ios-secrets.outputs.isReleaseBuild == 'true'
        env:
          CERTIFICATE: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
        run: |
          scripts/makekc.sh ${{ secrets.KEYCHIAN_PASSWD }}

      - name: Update ledgers
        run: |
          node bifold/scripts/make-blocks.js
          
          # the ledgers file should be about 344K
          ls -lah ledgers.json
          
          mv ledgers.json bifold/packages/legacy/core/configs/ledgers/indy/ledgers.json
          shasum bifold/packages/legacy/core/configs/ledgers/indy/ledgers.json

      - name: Release build
        if: github.ref_name == 'main' && needs.check-ios-secrets.outputs.isReleaseBuild == 'true'
        working-directory: app/ios
        run: |
          xcodebuild \
          -workspace AriesBifold.xcworkspace \
          -scheme AriesBifold \
          -configuration Release \
          -derivedDataPath xbuild \
          -xcconfig ../../release.xcconfig \
          -archivePath AriesBifold.xcarchive \
          -sdk iphoneos \
          -verbose \
          archive

      - name: Debug build
        if: github.ref_name != 'main' || needs.check-ios-secrets.outputs.isReleaseBuild != 'true'
        working-directory: app/ios
        run: |
          xcodebuild \
          -workspace AriesBifold.xcworkspace \
          -scheme AriesBifold \
          -configuration Debug \
          -derivedDataPath xbuild \
          build \
          CODE_SIGNING_ALLOWED=NO \
          CODE_SIGNING_REQUIRED=NO

      - name: Archive & Sign
        if: github.ref_name == 'main' && needs.check-ios-secrets.outputs.isReleaseBuild == 'true'
        working-directory: app/ios
        run: |
          xcodebuild \
          -exportArchive \
          -archivePath AriesBifold.xcarchive \
          -exportPath export \
          -exportOptionsPlist ../../options.plist \
          -verbose

      # https://blog.codemagic.io/app-store-connect-api-codemagic-cli-tools/
      - name: Install Codemagic CLI Tools
        if: github.ref_name == 'main' && needs.check-ios-secrets.outputs.isReleaseBuild == 'true'
        run: |
          pip3 install codemagic-cli-tools

      - name: Ship to iTunes
        if: github.ref_name == 'main' && needs.check-ios-secrets.outputs.isReleaseBuild == 'true'
        working-directory: app/ios
        env:
          APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
          APP_STORE_CONNECT_KEY_IDENTIFIER: ${{ secrets.APP_STORE_CONNECT_KEY_IDENTIFIER }}
          APP_STORE_CONNECT_PRIVATE_KEY: ${{ secrets.APP_STORE_CONNECT_PRIVATE_KEY_95 }}
          VERSION_CODE: ${{ env.appBuildNumber }}
          VERSION_NAME: ${{ env.appBuildVersion }}
        run: |
          export PATH=$PATH:/Library/Frameworks/Python.framework/Versions/3.11/bin
          app-store-connect publish \
          --apple-id ${{ secrets.APPLE_ID }} \
          --password ${{ secrets.APPLE_ID_PASSWD }} \
          --enable-package-validation \
          --max-build-processing-wait 25 \
          --testflight \
          --beta-group "The Team" "IDIM Team" \
          --whats-new "Release ${VERSION_NAME}-${GITHUB_RUN_NUMBER}"

      - name: Ship to LambdaTest
        if: github.ref_name == 'main' && needs.check-ios-secrets.outputs.isReleaseBuild == 'true'
        working-directory: app/ios
        env:
          LAMBDA_USERNAME: ${{ secrets.LAMBDA_USERNAME }}
          LAMBDA_ACCESS_KEY: ${{ secrets.LAMBDA_ACCESS_KEY }}
        run: |
          curl \
          -u "$LAMBDA_USERNAME:$LAMBDA_ACCESS_KEY" \
          --location --request POST 'https://manual-api.lambdatest.com/app/upload/realDevice' \
          --form 'appFile=@"export/AriesBifold.ipa"' \
          --form "name=QCWallet-$GITHUB_RUN_NUMBER.ipa" \

  build-android:
    # if: ${{ false }}  # disable for now
    needs: [check-android-secrets]
    runs-on: ubuntu-22.04
    # container:
    #   image: docker.io/fullboar/android-builder:latest
    steps:
      - uses: actions/checkout@v1

      - name: Pull & update submodules recursively
        run: |
          git config --global --add safe.directory '*'
          git submodule update --init --recursive

      - name: Configure node
        uses: actions/setup-node@v1
        with:
          node-version: "16.15.0"
          registry-url: "https://registry.npmjs.org"

      - name: Update ledgers
        run: |
          node bifold/scripts/make-blocks.js

          # the ledgers file should be about 344K
          ls -lah ledgers.json
          # note md5
          shasum ledgers.json
          shasum bifold/packages/legacy/core/configs/ledgers/indy/ledgers.json

          mv ledgers.json bifold/packages/legacy/core/configs/ledgers/indy/ledgers.json
          shasum bifold/packages/legacy/core/configs/ledgers/indy/ledgers.json

      - name: Cache node modules
        uses: actions/cache@v1
        with:
          path: ~/.npm
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-

      - name: Install dependencies
        working-directory: ./
        run: |
          npm ci

        # Actual environment variables are not being picked up
        # by the build so they're put into an .env file.
      - name: Create environment settings
        if: env.MEDIATOR_URL != null || env.BUGSNAG_API_KEY != null
        working-directory: app
        env:
          MEDIATOR_URL: ${{ secrets.MEDIATOR_URL }}
          BUGSNAG_API_KEY: ${{ secrets.BUGSNAG_API_KEY }}
        run: |
          echo "MEDIATOR_URL=${MEDIATOR_URL}" >.env |
          echo "BUGSNAG_API_KEY=${BUGSNAG_API_KEY}" >>.env

      - name: Android debug build
        if: github.ref_name != 'main' || needs.check-android-secrets.outputs.isReleaseBuild != 'true'
        working-directory: app/android
        env:
          VERSION_CODE: ${{ env.appBuildNumber }}
          VERSION_NAME: ${{ env.appBuildVersion }}

        run: |
          ./gradlew buildDebug

      - name: Create release keystore
        if: github.ref_name == 'main' && needs.check-android-secrets.outputs.isReleaseBuild == 'true'
        working-directory: app/android/app
        env:
          PLAY_STORE_JKS_BASE64: ${{ secrets.PLAY_STORE_JKS_BASE64 }}
          PLAY_STORE_JKS_ALIAS: ${{ secrets.PLAY_STORE_JKS_ALIAS }}
          PLAY_STORE_JKS_PASSWD: ${{ secrets.PLAY_STORE_JKS_PASSWD }}
        run: |
          echo "${PLAY_STORE_JKS_BASE64}" | base64 -d >release.keystore && \
          keytool -list -v -keystore release.keystore -alias ${PLAY_STORE_JKS_ALIAS} -storepass:env PLAY_STORE_JKS_PASSWD | \
          grep "SHA1"

      - name: Android release build
        if: github.ref_name == 'main' && needs.check-android-secrets.outputs.isReleaseBuild == 'true'
        working-directory: app/android
        env:
          PLAY_STORE_JKS_ALIAS: ${{ secrets.PLAY_STORE_JKS_ALIAS }}
          PLAY_STORE_JKS_PASSWD: ${{ secrets.PLAY_STORE_JKS_PASSWD }}
          VERSION_CODE: ${{ env.appBuildNumber }}
          VERSION_NAME: ${{ env.appBuildVersion }}
        run: |
          cp ../node_modules/react-native-vector-icons/Fonts/* ./app/src/main/assets/fonts/ && \
          ( cd ../ && npx react-native bundle --platform android --dev false --entry-file index.js --bundle-output android/app/src/main/assets/index.android.bundle  --verbose ) && \
          ./gradlew bundleRelease

      - name: Ship to Google Play
        if: github.ref_name == 'main' && needs.check-android-secrets.outputs.isReleaseBuild == 'true'
        working-directory: app/
        env:
          GOOGLE_API_CREDENTIALS_BASE64: ${{ secrets.GOOGLE_API_CREDENTIALS_BASE64 }}
          GOOGLE_API_CREDENTIALS: "api_keys.json"
          ANDROID_PACKAGE_NAME: "ca.qc.gouv.portefeuilleqc"
          ANDROID_BUNDLE_PATH: "./android/app/build/outputs/bundle/release/app-release.aab"
          VERSION_CODE: ${{ env.appBuildNumber }}
          VERSION_NAME: ${{ env.appBuildVersion }}
        run: |
          echo "${GOOGLE_API_CREDENTIALS_BASE64}" | base64 -d >${GOOGLE_API_CREDENTIALS} && \
          node ./deploy-to-playstore.js

      - name: Ship to LambdaTest
        if: github.ref_name == 'main' && needs.check-android-secrets.outputs.isReleaseBuild == 'true'
        working-directory: app/android
        env:
          LAMBDA_USERNAME: ${{ secrets.LAMBDA_USERNAME }}
          LAMBDA_ACCESS_KEY: ${{ secrets.LAMBDA_ACCESS_KEY }}
        run: |
          curl \
          -u "$LAMBDA_USERNAME:$LAMBDA_ACCESS_KEY" \
          --location --request POST 'https://manual-api.lambdatest.com/app/upload/realDevice' \
          --form 'appFile=@"app/build/outputs/bundle/release/app-release.aab"' \
          --form "name=QCWallet-$GITHUB_RUN_NUMBER.aab" \

  release:
    if: github.ref_name == 'main' && needs.check-android-secrets.outputs.isReleaseBuild == 'true'&& needs.check-ios-secrets.outputs.isReleaseBuild == 'true'
    needs: [build-ios, build-android]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2
      - name: Create release
        uses: actions/create-release@v1.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: v${{ env.appBuildVersion }}-${{ env.appBuildNumber }}
          release_name: Version ${{ env.appBuildVersion }}-${{ env.appBuildNumber }}
          body: |
            Dev Release.

  run-on-device-tests:
    if: github.ref_name == 'main' && needs.check-android-secrets.outputs.isReleaseBuild == 'true'&& needs.check-ios-secrets.outputs.isReleaseBuild == 'true'
    needs: [build-ios, build-android]
    runs-on: ubuntu-22.04
    strategy:
      max-parallel: 1
      fail-fast: false
      matrix:
        include:
          - mobile-platform: "-p Android"
            app-file-name: "-a QCWallet-${{ github.run_number }}.aab"
            report-project: "android-one-device-smoke"
          - mobile-platform: "-p iOS"
            app-file-name: "-a QCWallet-${{ github.run_number }}.ipa"
            report-project: "ios-one-device-smoke"
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v2

      - name: run-aath-agents
        if: ${{ matrix.mobile-platform=='-p iOS' }}
        uses: ./.github/workflows/actions/run-aath-agents
        with:
          USE_NGROK: ""

      - name: run-aath-agents-ngrok
        if: ${{ matrix.mobile-platform=='-p Android' }}
        uses: ./.github/workflows/actions/run-aath-agents
        with:
          USE_NGROK: "-n"

      - name: run-lambdatest-connect-tunnel
        if: ${{ matrix.mobile-platform=='-p iOS' }}
        uses: LambdaTest/LambdaTest-tunnel-action@v1
        with:
          user: ${{ secrets.LAMBDA_USERNAME }}
          accessKey: ${{ secrets.LAMBDA_ACCESS_KEY }}
          tunnelName: "PortefeuilleQC-Tunnel-${{ github.run_number }}"

      - name: Fetch mobile test harness repo
        uses: actions/checkout@v2
        with:
          repository: MCN-ING/aries-mobile-test-harness
          path: aries-mobile-test-harness
          ref: main

      - name: Run LambdaTest smoke-test
        uses: ./.github/workflows/actions/run-test-harness
        env:
          LEDGER_URL_CONFIG: "http://test.bcovrin.vonx.io"
          REGION: "us-west-1"
        with:
          MOBILE_WALLET: "-w bifold"
          ISSUER_AGENT: '-i "AATH;http://0.0.0.0:9020"'
          VERIFIER_AGENT: '-v "AATH;http://0.0.0.0:9030"'
          DEVICE_CLOUD: "-d LambdaTest"
          DEVICE_CLOUD_USER: "-u ${{ secrets.LAMBDA_USERNAME }}"
          DEVICE_CLOUD_KEY: "-k ${{ secrets.LAMBDA_ACCESS_KEY }}"
          MOBILE_PLATFORM: ${{ matrix.mobile-platform }}
          APP_FILE_NAME: ${{ matrix.app-file-name }}
          TEST_SCOPE: "-t @qc_wallet -t @SmokeTest"
          REPORT_PROJECT: ${{ matrix.report-project }}

      - name: Upload smoke-test results to Allure
        if: ${{ always() }}
        uses: ./.github/workflows/actions/run-send-gen-test-results-secure
        with:
          REPORT_PROJECT: ${{ matrix.report-project }}
          ADMIN_USER: ${{ secrets.ALLURE_USERNAME }}
          ADMIN_PW: ${{ secrets.ALLURE_PASSWD }}