chore: build main exp #25740
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,127 @@ | ||
| # Configure code signing from AWS Secrets Manager | ||
| # Uses role + secret name from builds.yml (per Mobile Signer Roles & Secrets doc) | ||
| name: 'Configure Signing' | ||
| description: 'Assume AWS role and fetch signing certificates from Secrets Manager' | ||
|
|
||
| inputs: | ||
| aws-role-to-assume: | ||
| description: 'The AWS IAM role to assume' | ||
| required: true | ||
| aws-region: | ||
| description: 'The AWS region where the secret is stored' | ||
| required: true | ||
| default: 'us-east-2' | ||
| platform: | ||
| description: 'Platform (android or ios)' | ||
| required: true | ||
| aws-secret-name: | ||
| description: 'AWS Secrets Manager secret name (e.g. metamask-mobile-main-uat-signer)' | ||
| required: true | ||
| android-keystore-path: | ||
| description: 'Target path in android/keystores/ (e.g. internalRelease.keystore). Required for Android.' | ||
| required: false | ||
|
|
||
| runs: | ||
| using: 'composite' | ||
| steps: | ||
| - name: Configure AWS credentials | ||
| uses: aws-actions/configure-aws-credentials@v4 | ||
| with: | ||
| role-to-assume: ${{ inputs.aws-role-to-assume }} | ||
| aws-region: ${{ inputs.aws-region }} | ||
|
|
||
| - name: Fetch secret and export as environment variables | ||
| shell: bash | ||
| env: | ||
| AWS_REGION: ${{ inputs.aws-region }} | ||
| AWS_SECRET_NAME: ${{ inputs.aws-secret-name }} | ||
| run: | | ||
| echo "🔐 Fetching secret from Secrets Manager..." | ||
| secret_json=$(aws secretsmanager get-secret-value \ | ||
| --region "$AWS_REGION" \ | ||
| --secret-id "$AWS_SECRET_NAME" \ | ||
| --query SecretString \ | ||
| --output text) | ||
|
|
||
| keys=$(echo "$secret_json" | jq -r 'keys[]') | ||
| for key in $keys; do | ||
| value=$(echo "$secret_json" | jq -r --arg k "$key" '.[$k]') | ||
| # Mask each line (add-mask doesn't support multiline values) | ||
| printf '%s' "$value" | while IFS= read -r line || [[ -n "$line" ]]; do | ||
| echo "::add-mask::$line" | ||
| done | ||
| # Use heredoc for GITHUB_ENV to support multiline values (e.g. base64 certs) | ||
| delimiter="$(uuidgen)" | ||
| { | ||
| echo "${key}<<${delimiter}" | ||
| printf '%s' "$value" | ||
| echo | ||
| echo "${delimiter}" | ||
| } >> "$GITHUB_ENV" | ||
| echo "✅ Set secret for key: $key" | ||
| done | ||
|
Contributor
There was a problem hiding this comment. Duplicated AWS secret fetching logic across workflowsMedium Severity The "Fetch secret and export as environment variables" step (lines 33-52) is nearly identical to existing code in
cursor[bot] marked this conversation as resolved.
|
||
|
|
||
| - name: Configure Android Signing Certificates | ||
| if: inputs.platform == 'android' | ||
| shell: bash | ||
| env: | ||
| ANDROID_KEYSTORE_TARGET: ${{ inputs.android-keystore-path }} | ||
| run: | | ||
| echo "📦 Configuring Android keystore..." | ||
| if [[ -z "$ANDROID_KEYSTORE" ]]; then | ||
| echo "⚠️ ANDROID_KEYSTORE is not set. Skipping keystore decoding." | ||
| exit 1 | ||
| fi | ||
|
|
||
| # When copying to target, always decode to temp first to avoid "same file" error | ||
| # (secret may set ANDROID_KEYSTORE_PATH to the target path) | ||
| if [[ -n "$ANDROID_KEYSTORE_TARGET" ]]; then | ||
| KEYSTORE_PATH="/tmp/android.keystore" | ||
| else | ||
| KEYSTORE_PATH="${ANDROID_KEYSTORE_PATH:-/tmp/android.keystore}" | ||
| fi | ||
| echo "$ANDROID_KEYSTORE" | base64 --decode > "$KEYSTORE_PATH" | ||
| echo "✅ Android keystore decoded to $KEYSTORE_PATH" | ||
|
|
||
| if [[ -n "$ANDROID_KEYSTORE_TARGET" ]]; then | ||
| mkdir -p android/keystores | ||
| cp "$KEYSTORE_PATH" "android/keystores/$ANDROID_KEYSTORE_TARGET" | ||
| echo "✅ Android keystore copied to android/keystores/$ANDROID_KEYSTORE_TARGET" | ||
| fi | ||
|
|
||
| - name: Configure iOS Signing Certificates | ||
| if: inputs.platform == 'ios' | ||
| shell: bash | ||
| run: | | ||
| echo "📦 Configuring iOS code signing..." | ||
|
|
||
| CERT_PATH="$RUNNER_TEMP/build_certificate.p12" | ||
| PROFILE_PATH="$RUNNER_TEMP/build_pp.mobileprovision" | ||
| KEYCHAIN_PATH="$RUNNER_TEMP/app-signing.keychain-db" | ||
| CERT_PW="${IOS_SIGNING_KEYSTORE_PASSWORD}" | ||
|
|
||
| echo "$IOS_SIGNING_KEYSTORE" | base64 --decode > "$CERT_PATH" | ||
| echo "$IOS_SIGNING_PROFILE" | base64 --decode > "$PROFILE_PATH" | ||
| echo "✅ Decoded .p12 and provisioning profile" | ||
|
Contributor
There was a problem hiding this comment. iOS signing lacks validation unlike Android pathMedium Severity The iOS signing step directly uses |
||
|
|
||
| security create-keychain -p "$CERT_PW" "$KEYCHAIN_PATH" | ||
| security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH" | ||
| security unlock-keychain -p "$CERT_PW" "$KEYCHAIN_PATH" | ||
|
|
||
| echo "🔐 Importing certificate..." | ||
| if ! security import "$CERT_PATH" -P "$CERT_PW" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"; then | ||
| echo "❌ Failed to import certificate." | ||
| exit 1 | ||
| fi | ||
| echo "✅ Certificate imported" | ||
|
|
||
| security set-key-partition-list -S apple-tool:,apple: -k "$CERT_PW" "$KEYCHAIN_PATH" 2>/dev/null || true | ||
|
|
||
| mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles | ||
| cp "$PROFILE_PATH" ~/Library/MobileDevice/Provisioning\ Profiles/ | ||
| echo "✅ Installed provisioning profile" | ||
|
|
||
| # Add keychain to search list (codesign searches this; default-keychain alone is insufficient) | ||
| security list-keychains -d user -s "$KEYCHAIN_PATH" $(security list-keychains -d user | tr -d '"' | xargs) | ||
| security default-keychain -s "$KEYCHAIN_PATH" | ||
| echo "✅ Keychain added to search list and set as default" | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.