Disable code signing when workflows run from forks #208

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Closed

rsora wants to merge 1 commit into main from rsora/fork-build

Closed

Disable code signing when workflows run from forks #208

rsora wants to merge 1 commit into main from rsora/fork-build

Conversation

rsora

Copy link

Contributor

@rsora rsora commented Mar 12, 2021

This PR refactors the CI workflows to be more "fork friendly".
If workflows are run on a PR generated by a fork, where secrets are not available, the CI will run skipping the signing steps, providing unsigned artifacts.

What this PR does:

Skip Mac/Win code signing and Apple notarization only if PR comes from a fork
Disable workflows entirely if the user enabled Github Actions in
their fork repo
Add steps to help Mac users to test their forked code in BUILDING.md


 Disable code signing when workflows run from forks

93b21ad

- Skip Mac/Win code signing and Apple notarization only if PR comes from a fork
- Disable workflows entirely if the user enabled Github Actions in
their fork repo
- Add steps to help Mac users to test their forked code in BUILDING.md

@rsora rsora requested review from per1234 and kittaakos

March 12, 2021 08:36

kittaakos

kittaakos suggested changes

Mar 12, 2021

View reviewed changes

Copy link

Contributor

@kittaakos kittaakos left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added a few comments here and there. I will accept the PR if you re-submit it from a fork. Otherwise, we cannot verify if it works or not.

From the build logs:

IS_FORK: false

electron/build/scripts/notarize.js

appleIdPassword: process.env.AC_PASSWORD,

});

};

Copy link

Contributor

@kittaakos kittaakos Mar 12, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please revert. The project uses trailing empty lines.

BUILDING.md

```

## Notes for macOS contributors

Beginning in macOS 10.14.5, software [must be notarized to run](https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution). The signing and notarization processes for the Arduino IDE are managed by our Continuous Integration (CI) workflows, implemented with GitHub Actions. On every push and pull request, the Arduino IDE is built and saved to a workflow artifact. These artifacts can be used by contributors and beta testers who don't want to set up a build system locally.

Copy link

Contributor

@kittaakos kittaakos Mar 12, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

software -> the software

BUILDING.md

## Notes for macOS contributors

For security reasons, signing and notarization is disabled for workflow runs for pull requests from forks of this repository. This means that macOS will block you from running those artifacts.

Copy link

Contributor

@kittaakos kittaakos Mar 12, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

signing and notarization is -> signing and notarization are

.github/workflows/check-certificates.yml

:warning::warning::warning::warning:

SLACK_COLOR: danger

MSG_MINIMAL: true

Copy link

Contributor

@kittaakos kittaakos Mar 12, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We use empty trailing lines.

Hint: if you edit the code in VS Code, Code will insert the empty line for you one save. Please use Code.

arduino-ide/.vscode/settings.json

Line 19 in eadc993

"files.insertFinalNewline": true,

.github/workflows/build.yml

PLUGIN_BUCKET: ${{ secrets.DOWNLOADS_BUCKET }}

AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}

AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

Copy link

Contributor

@kittaakos kittaakos Mar 12, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing empty line.

.github/workflows/build.yml

jobs:

build:

if: github.repository == 'arduino/arduino-ide'

Copy link

Contributor

@kittaakos kittaakos Mar 12, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure if I understand this condition. Can you please explain?

@rsora

Copy link

Contributor Author

rsora commented Mar 12, 2021

@kittaakos I'll open a new PR from a fork, so we can test the workflow mods I prepared as you requested.
I'll address all your change requests in the new PR and answer to your question there. I'll close this one once we merge the new PR.
Is that ok for you?