Commit d1aa446

committed

Refactor signing certificate handling in "Arduino IDE" workflow

Previously, there was some code duplication of the complex code signing certificate handling commands, which made the related code more difficult to understand, maintain, and develop. The cause of this duplication is that there is a separate certificate for each operating system, each of which is stored in separate repository secrets, as well as a different certificate file extension for each OS. Since the secret names and file extensions are associated with the operating system, it is most logical to define them via attributes alongside the operating system definition in the job matrix configuration already used to generate the parallel job runs for native build on each OS. That done, the certificate handling commands are universal and the system can easily expand to additional host targets (e.g., Apple M1) as time goes on.

1 parent e454acb commit d1aa446Copy full SHA for d1aa446

File tree

1 file changed

+15

-15

lines changed

.github/workflows
- build.yml

1 file changed

+15

-15

lines changed

`‎.github/workflows/build.yml‎`

Lines changed: 15 additions & 15 deletions

Original file line number	Diff line number	Diff line change
`@@ -17,13 +17,22 @@ env:`
`17`	`17`
`18`	`18`	`jobs:`
`19`	`19`	`build:`
	`20`	`+ name: build (${{ matrix.config.os }})`
`20`	`21`	`if: github.repository == 'arduino/arduino-ide'`
`21`	`22`	`strategy:`
`22`	`23`	`matrix:`
`23`	`24`	`config:`
`24`	`25`	`- os: windows-2019`
	`26`	`+ certificate-secret: WINDOWS_SIGNING_CERTIFICATE_PFX # Name of the secret that contains the certificate.`
	`27`	`+ certificate-password-secret: WINDOWS_SIGNING_CERTIFICATE_PASSWORD # Name of the secret that contains the certificate password.`
	`28`	`+ certificate-extension: pfx # File extension for the certificate.`
`25`	`29`	`- os: ubuntu-18.04 # https://github.com/arduino/arduino-ide/issues/259`
`26`	`30`	`- os: macos-latest`
	`31`	`+ # APPLE_SIGNING_CERTIFICATE_P12 secret was produced by following the procedure from:`
	`32`	`+ # https://www.kencochrane.com/2020/08/01/build-and-sign-golang-binaries-for-macos-with-github-actions/#exporting-the-developer-certificate`
	`33`	`+ certificate-secret: APPLE_SIGNING_CERTIFICATE_P12`
	`34`	`+ certificate-password-secret: KEYCHAIN_PASSWORD`
	`35`	`+ certificate-extension: p12`
`27`	`36`	`runs-on: ${{ matrix.config.os }}`
`28`	`37`	`timeout-minutes: 90`
`29`	`38`
`@@ -59,23 +68,14 @@ jobs:`
`59`	`68`	`if [ $IS_FORK = true ]; then`
`60`	`69`	`echo "Skipping the app signing: building from a fork."`
`61`	`70`	`else`
`62`		`- if [ "${{ runner.OS }}" = "macOS" ]; then`
`63`		`- export CSC_LINK="${{ runner.temp }}/signing_certificate.p12"`
`64`		`- # APPLE_SIGNING_CERTIFICATE_P12 secret was produced by following the procedure from:`
`65`		`- # https://www.kencochrane.com/2020/08/01/build-and-sign-golang-binaries-for-macos-with-github-actions/#exporting-the-developer-certificate`
`66`		`- echo "${{ secrets.APPLE_SIGNING_CERTIFICATE_P12 }}" \| base64 --decode > "$CSC_LINK"`
`67`		`-`
`68`		`- export CSC_KEY_PASSWORD="${{ secrets.KEYCHAIN_PASSWORD }}"`
`69`		`-`
`70`		`- elif [ "${{ runner.OS }}" = "Windows" ]; then`
`71`		`- export CSC_LINK="${{ runner.temp }}/signing_certificate.pfx"`
`72`		`- npm config set msvs_version 2017 --global`
`73`		`- echo "${{ secrets.WINDOWS_SIGNING_CERTIFICATE_PFX }}" \| base64 --decode > "$CSC_LINK"`
`74`		`-`
`75`		`- export CSC_KEY_PASSWORD="${{ secrets.WINDOWS_SIGNING_CERTIFICATE_PASSWORD }}"`
`76`		`- fi`
	`71`	`+ export CSC_LINK="${{ runner.temp }}/signing_certificate.${{ matrix.config.certificate-extension }}"`
	`72`	`+ echo "${{ secrets[matrix.config.certificate-secret] }}" \| base64 --decode > "$CSC_LINK"`
	`73`	`+ export CSC_KEY_PASSWORD="${{ secrets[matrix.config.certificate-password-secret] }}"`
`77`	`74`	`fi`
`78`	`75`
	`76`	`+ if [ "${{ runner.OS }}" = "Windows" ]; then`
	`77`	`+ npm config set msvs_version 2017 --global`
	`78`	`+ fi`
`79`	`79`	`npx node-gyp install`
`80`	`80`	`yarn --cwd ./electron/packager/`
`81`	`81`	`yarn --cwd ./electron/packager/ package`

0 commit comments

Comments

(0)

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Commit d1aa446

File tree

1 file changed

1 file changed

`‎.github/workflows/build.yml‎`

0 commit comments