android-ci/ci-credentials.sh at main · ThePalaceProject/android-ci · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
#!/bin/bash

#------------------------------------------------------------------------
# A script to clone the Credentials repository and check that the required
# secrets are present and working.
#

#------------------------------------------------------------------------
# Utility methods
#

fatal()
{
  echo "ci-credentials.sh: fatal: $1" 1>&2
  exit 1
}

info()
{
  echo "ci-credentials.sh: info: $1" 1>&2
}

error()
{
  echo "ci-credentials.sh: error: $1" 1>&2
}

#------------------------------------------------------------------------
# Check environment
#

FAILED=0
if [ -z "${MAVEN_CENTRAL_USERNAME}" ]
then
  error "MAVEN_CENTRAL_USERNAME is not defined"
  FAILED=1
fi
if [ -z "${MAVEN_CENTRAL_PASSWORD}" ]
then
  error "MAVEN_CENTRAL_PASSWORD is not defined"
  FAILED=1
fi
if [ -z "${MAVEN_CENTRAL_STAGING_PROFILE_ID}" ]
then
  error "MAVEN_CENTRAL_STAGING_PROFILE_ID is not defined"
  FAILED=1
fi
if [ -z "${MAVEN_CENTRAL_SIGNING_KEY_ID}" ]
then
  error "MAVEN_CENTRAL_SIGNING_KEY_ID is not defined"
  FAILED=1
fi
if [ -z "${CI_GITHUB_ACCESS_TOKEN}" ]
then
  error "CI_GITHUB_ACCESS_TOKEN is not defined"
  FAILED=1
fi

if [ ${FAILED} -eq 1 ]
then
  fatal "One or more required variables are not defined."
fi

#------------------------------------------------------------------------
# Clone credentials repos
#

info "Cloning credentials"

git clone \
  --depth 1 \
  "https://${CI_GITHUB_ACCESS_TOKEN}@github.com/ThePalaceProject/mobile-certificates" \
  ".ci/credentials" || fatal "Could not clone credentials"

#------------------------------------------------------------------------
# Import the PGP key for signing Central releases, and try to sign a test
# file to check that the key hasn't expired.
#

info "Importing GPG key"
gpg --import ".ci/credentials/APK Signing/thePalaceProject.asc" || fatal "Could not import GPG key"

info "Signing test file"
echo "Test" > hello.txt || fatal "Could not create test file"
gpg --sign -a hello.txt || fatal "Could not produce test signature"

#------------------------------------------------------------------------
# Download jreleaser if necessary.
#

ci-install-jreleaser.sh || fatal "Failed to install jreleaser"

#------------------------------------------------------------------------
# Download changelog if necessary.
#

ci-install-changelog.sh || fatal "Failed to install changelog"

#------------------------------------------------------------------------
# Run local credentials hooks if present.
#

if [ -f .ci-local/credentials.sh ]
then
  .ci-local/credentials.sh || fatal "local credentials hook failed"
fi