chore: build main exp #25740
+199
−12
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,115 @@ | ||
| # Configure code signing from AWS Secrets Manager | ||
| # Uses role + secret name from builds.yml (per Mobile Signer Roles & Secrets doc) | ||
| name: 'Configure Signing' | ||
| description: 'Assume AWS role and fetch signing certificates from Secrets Manager' | ||
|
|
||
| inputs: | ||
| aws-role-to-assume: | ||
| description: 'The AWS IAM role to assume' | ||
| required: true | ||
| aws-region: | ||
| description: 'The AWS region where the secret is stored' | ||
| required: true | ||
| default: 'us-east-2' | ||
| platform: | ||
| description: 'Platform (android or ios)' | ||
| required: true | ||
| aws-secret-name: | ||
| description: 'AWS Secrets Manager secret name (e.g. metamask-mobile-main-uat-signer)' | ||
| required: true | ||
| android-keystore-path: | ||
| description: 'Target path in android/keystores/ (e.g. internalRelease.keystore). Required for Android.' | ||
| required: false | ||
|
|
||
| runs: | ||
| using: 'composite' | ||
| steps: | ||
| - name: Configure AWS credentials | ||
| uses: aws-actions/configure-aws-credentials@v4 | ||
| with: | ||
| role-to-assume: ${{ inputs.aws-role-to-assume }} | ||
| aws-region: ${{ inputs.aws-region }} | ||
|
|
||
| - name: Fetch secret and export as environment variables | ||
| shell: bash | ||
| env: | ||
| AWS_REGION: ${{ inputs.aws-region }} | ||
| AWS_SECRET_NAME: ${{ inputs.aws-secret-name }} | ||
| run: | | ||
| echo "🔐 Fetching secret from Secrets Manager..." | ||
| secret_json=$(aws secretsmanager get-secret-value \ | ||
| --region "$AWS_REGION" \ | ||
| --secret-id "$AWS_SECRET_NAME" \ | ||
| --query SecretString \ | ||
| --output text) | ||
|
|
||
| keys=$(echo "$secret_json" | jq -r 'keys[]') | ||
| for key in $keys; do | ||
| value=$(echo "$secret_json" | jq -r --arg k "$key" '.[$k]') | ||
| echo "::add-mask::$value" | ||
| echo "$key=$(printf '%s' "$value")" >> "$GITHUB_ENV" | ||
| echo "✅ Set secret for key: $key" | ||
| done | ||
|
cursor[bot] marked this conversation as resolved.
|
||
|
|
||
| - name: Configure Android Signing Certificates | ||
| if: inputs.platform == 'android' | ||
| shell: bash | ||
| env: | ||
| ANDROID_KEYSTORE_TARGET: ${{ inputs.android-keystore-path }} | ||
| run: | | ||
| echo "📦 Configuring Android keystore..." | ||
| if [[ -z "$ANDROID_KEYSTORE" ]]; then | ||
| echo "⚠️ ANDROID_KEYSTORE is not set. Skipping keystore decoding." | ||
| exit 1 | ||
| fi | ||
|
|
||
| # When copying to target, always decode to temp first to avoid "same file" error | ||
| # (secret may set ANDROID_KEYSTORE_PATH to the target path) | ||
| if [[ -n "$ANDROID_KEYSTORE_TARGET" ]]; then | ||
| KEYSTORE_PATH="/tmp/android.keystore" | ||
| else | ||
| KEYSTORE_PATH="${ANDROID_KEYSTORE_PATH:-/tmp/android.keystore}" | ||
| fi | ||
| echo "$ANDROID_KEYSTORE" | base64 --decode > "$KEYSTORE_PATH" | ||
| echo "✅ Android keystore decoded to $KEYSTORE_PATH" | ||
|
|
||
| if [[ -n "$ANDROID_KEYSTORE_TARGET" ]]; then | ||
| mkdir -p android/keystores | ||
| cp "$KEYSTORE_PATH" "android/keystores/$ANDROID_KEYSTORE_TARGET" | ||
| echo "✅ Android keystore copied to android/keystores/$ANDROID_KEYSTORE_TARGET" | ||
| fi | ||
|
|
||
| - name: Configure iOS Signing Certificates | ||
| if: inputs.platform == 'ios' | ||
| shell: bash | ||
| run: | | ||
| echo "📦 Configuring iOS code signing..." | ||
|
|
||
| CERT_PATH="$RUNNER_TEMP/build_certificate.p12" | ||
| PROFILE_PATH="$RUNNER_TEMP/build_pp.mobileprovision" | ||
| KEYCHAIN_PATH="$RUNNER_TEMP/app-signing.keychain-db" | ||
| CERT_PW="${IOS_SIGNING_KEYSTORE_PASSWORD}" | ||
|
|
||
| echo "$IOS_SIGNING_KEYSTORE" | base64 --decode > "$CERT_PATH" | ||
| echo "$IOS_SIGNING_PROFILE" | base64 --decode > "$PROFILE_PATH" | ||
| echo "✅ Decoded .p12 and provisioning profile" | ||
|
Contributor
There was a problem hiding this comment. iOS signing lacks validation unlike Android pathMedium Severity The iOS signing step directly uses |
||
|
|
||
| security create-keychain -p "$CERT_PW" "$KEYCHAIN_PATH" | ||
| security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH" | ||
| security unlock-keychain -p "$CERT_PW" "$KEYCHAIN_PATH" | ||
|
|
||
| echo "🔐 Importing certificate..." | ||
| if ! security import "$CERT_PATH" -P "$CERT_PW" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"; then | ||
| echo "❌ Failed to import certificate." | ||
| exit 1 | ||
| fi | ||
| echo "✅ Certificate imported" | ||
|
|
||
| security set-key-partition-list -S apple-tool:,apple: -k "$CERT_PW" "$KEYCHAIN_PATH" 2>/dev/null || true | ||
|
|
||
| mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles | ||
| cp "$PROFILE_PATH" ~/Library/MobileDevice/Provisioning\ Profiles/ | ||
| echo "✅ Installed provisioning profile" | ||
|
|
||
| security default-keychain -s "$KEYCHAIN_PATH" | ||
| echo "✅ Default keychain set" | ||
|
cursor[bot] marked this conversation as resolved.
Outdated
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Duplicated AWS secret fetching logic across workflows
Medium Severity
The "Fetch secret and export as environment variables" step (lines 33-52) is nearly identical to existing code in
.github/workflows/push-eas-update.yml(lines 384-400). Both implementations use the same AWS Secrets Manager CLI call, jq parsing pattern, masking, and export logic. The new action should be reused bypush-eas-update.ymlto consolidate this duplicated code.