mob.yml

name: mob

concurrency:
  group: ${{github.workflow}}-${{github.event_name}}


#--------------------------------------------------#
#                     Triggers                     # 
#--------------------------------------------------#
on:

  workflow_call:

    inputs:
      mainBranch:
        type: string
        required: false
        default: master
        description: "Main repository branch may interfere with versioning"
      ecosystem:
        type: string
        required: false
        description: "Special prefix that will be added to the image name"
      staticAnalysis:
        type: boolean
        required: false
        default: false
        description: "Enable static analysis scans"
      autoVersioning:
        type: boolean
        required: false
        default: true
        description: "Enable auto versioning with semantic versioning"
      buildDirectory:
        type: string
        required: false
        default: "dist"
        description: "Output directory from build"


#--------------------------------------------------#
#                  Workflow Jobs                   # 
#--------------------------------------------------#
jobs:

  #--------------------------------------------------#
  #                    Setup Jobs                    # 
  #--------------------------------------------------#
  Setup:
    runs-on: ubuntu-latest

    outputs:
      Event: ${{steps.analysis.outputs.event}}
      Analysis: ${{steps.analysis.outputs.result}}
      Environment: ${{steps.analysis.outputs.environment}}
      Repository: ${{steps.analysis.outputs.repository}}
      Pwd: ${{steps.analysis.outputs.pwd}}

    steps:

      # pre-job
      - name: Setup | Cloning repository
        uses: actions/checkout@v3

      # job
      - name: Pipeline config scrapper
        id: analysis
        uses: filipeforattini/ff-iac-github-actions/.github/actions/config-scrapper@main
        # env:
        #   PIPESECRET_KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
        #   PIPESECRET_REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
        #   PIPESECRET_REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
        #   PIPESECRET_PIPELINE_DEPLOY_TOKEN: ${{ secrets.PIPELINE_DEPLOY_TOKEN }}
        with:
          writeSummary: true

  #--------------------------------------------------#
  #                  Static Analysis                 # 
  #--------------------------------------------------#
  Static-Analysis:
    runs-on: ubuntu-latest
    if: needs.Setup.outputs.Event == 'push'
    needs: Setup

    permissions:
      security-events: write

    steps:

      # pre-job
      - name: Setup | Cloning repository
        uses: actions/checkout@v3
        if: inputs.staticAnalysis
        with:
          token: "${{secrets.GITHUB_TOKEN}}"
          fetch-depth: '0'
          persist-credentials: false

      #job
      - name: Run code analysis
        uses: filipeforattini/ff-iac-github-actions/.github/actions/pack-static-code-analysis@main
        if: inputs.staticAnalysis
        with:
          token: "${{secrets.PIPELINE_DEPLOY_TOKEN}}"
          language: ${{needs.Setup.outputs.Language}}


  #--------------------------------------------------#
  #                      Release                     # 
  #--------------------------------------------------#
  Release:
    runs-on: ubuntu-latest
    if: needs.Setup.outputs.Event == 'push'

    needs: 
      - Setup
      - Static-Analysis

    outputs:
      Version: ${{ steps.versioning.outputs.version }}

    steps:

      # pre-job
      - name: Setup | Cloning repository
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
          # persist-credentials: false

      - name: Setup | Pipeline config scrapper
        uses: filipeforattini/ff-iac-github-actions/.github/actions/config-scrapper@main
        id: analysis

      # release
      - name: Semantic Release
        uses: filipeforattini/ff-iac-github-actions/.github/actions/pack-semantic-release@main
        with:
          token: "${{secrets.PIPELINE_DEPLOY_TOKEN}}"
          writeSummary: false
          createRelease: false
          updateChangelog: true
          installNode: true
          npmPlugin: true
          defaultBranch: ${{inputs.mainBranch}}
          author: ${{steps.analysis.outputs.commiter_name}} 
          email: ${{steps.analysis.outputs.commiter_email}}

      - name: Current Version
        id: versioning
        run: |
          echo "version=$(cat package.json | jq -r '.version')" >> $GITHUB_OUTPUT
          echo -e "\n\nINFO  current version = $(cat package.json | jq -r '.version')\n\n"


  #--------------------------------------------------#
  #                      Trigger                     # 
  #--------------------------------------------------#
  Trigger-Build:
    runs-on: ubuntu-latest
    if: github.event_name == 'push'

    needs: 
      - Release

    steps:

      # pre-job
      - name: Setup | Cloning repository
        uses: actions/checkout@v3
        with:
          token: ${{ secrets.PIPELINE_DEPLOY_TOKEN }}

      - name: Pipeline config scrapper
        id: analysis
        uses: filipeforattini/ff-iac-github-actions/.github/actions/config-scrapper@main

      - name: Trigger
        run: |
          git config --global user.name "${{steps.analysis.outputs.commiter_name}}"
          git config --global user.email "${{steps.analysis.outputs.commiter_email}}"
          git fetch
          git checkout -B env/dev
          git commit --allow-empty -am "deploy: to dev [skip ci]\\nVersion: ${{needs.Release.outputs.Version}}\nCommit: ${{steps.setup.outputs.commit_hash}}"
          git push -f -u origin env/dev

      - name: Create GitHub deployment
        uses: altinukshini/deployment-action@releases/v1
        id: deployment
        with:
          token: "${{ secrets.PIPELINE_DEPLOY_TOKEN }}"
          environment: dev


  #--------------------------------------------------#
  #                  Trigger Manual                  # 
  #--------------------------------------------------#
  Trigger-Manual:
    runs-on: ubuntu-latest
    if: github.event_name == 'workflow_dispatch'

    needs: 
      - Setup

    steps:

      # pre-job
      - name: Setup | Cloning repository
        uses: actions/checkout@v3
        with:
          token: ${{ secrets.PIPELINE_DEPLOY_TOKEN }}

      - name: Pipeline config scrapper
        id: analysis
        uses: filipeforattini/ff-iac-github-actions/.github/actions/config-scrapper@main
  
      - name: Trigger
        run: |
          git config --global user.name "pipeline-bot"
          git config --global user.email "pipeline-bot"
          git fetch
          git checkout -B env/${{steps.analysis.outputs.environment}}
          git commit --allow-empty -am "deploy: to ${{steps.analysis.outputs.environment}} [skip ci]\nCommit: ${{steps.setup.outputs.commit_hash}}"
          git push -f -u origin env/${{steps.analysis.outputs.environment}}

      - uses: altinukshini/deployment-action@releases/v1
        name: Create GitHub deployment
        id: deployment
        with:
          token: "${{ secrets.PIPELINE_DEPLOY_TOKEN }}"
          environment: ${{steps.analysis.outputs.environment}}


  #--------------------------------------------------#
  #                   Build Android                  # 
  #--------------------------------------------------#
  Build-Android:
    runs-on: ubuntu-latest
    if: github.event_name == 'deployment'

    needs: 
      - Setup

    env:
      ANDROID_KEYSTORE_PATH: ${{needs.Setup.outputs.Pwd}}/android/pipeline-key.jks
      ANDROID_KEYSTORE_CERTPATH: ${{needs.Setup.outputs.Pwd}}/android/pipeline-key.pem
      ANDROID_KEYSTORE_CERT: ${{ secrets.ANDROID_KEYSTORE_CERT }}
      ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}

    steps:

      # pre-job
      - name: Setup | Cloning tools
        uses: actions/checkout@v3
        with:
          ref: env/${{needs.Setup.outputs.Environment}}

      - name: Pipeline config scrapper
        id: analysis
        uses: filipeforattini/ff-iac-github-actions/.github/actions/config-scrapper@main

      - name: Setup | Dependencies
        if: inputs.installNode
        uses: filipeforattini/ff-iac-github-actions/.github/actions/setup-binaries@main
        with:
          java: 17
          nodejs: 18

      # pre-build
      - name: Docs | Write summary title
        run: |
          echo "### 🚢 Build Android" >> $GITHUB_STEP_SUMMARY

      # install dependencies
      - name: Install dependencies
        run: |
          if test -f ./pnpm-lock.yaml; then pnpm i --frozen-lockfile --force --no-color; fi
          if test -f ./yarn.lock; then yarn install --frozen-lockfile --ignore-optional --immutable --network-timeout 1000000; fi
          if test -f ./package-lock.json; then npm ci --force --no-fund --no-audit --maxsockets 1; fi

      # cache
      - name: Cache Gradle Wrapper
        uses: actions/cache@v2
        with:
          path: ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-wrapper-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}

      - name: Cache Gradle Dependencies
        uses: actions/cache@v2
        with:
          path: ~/.gradle/caches
          key: ${{ runner.os }}-gradle-caches-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-caches-
            ${{ runner.os }}-gradle-caches-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}

      # signature
      - name: Get signature
        run: |
          echo "$ANDROID_KEYSTORE_CERT" > $ANDROID_KEYSTORE_CERTPATH
          keytool -import \
            -noprompt \
            -trustcacerts \
            -keystore $ANDROID_KEYSTORE_PATH \
            -alias pipeline-key \
            -storepass $ANDROID_KEYSTORE_PASSWORD \
            -file $ANDROID_KEYSTORE_CERTPATH
          keytool -list \
            -keystore $ANDROID_KEYSTORE_PATH \
            -storepass $ANDROID_KEYSTORE_PASSWORD

      # build
      - name: Copy config
        run: |
          if test -f ./manifests/configs/${{needs.Setup.outputs.Environment}}.env; then cp ./manifests/configs/${{needs.Setup.outputs.Environment}}.env ./.env; fi

      - name: Gradle | Assemble Debug
        run: |
          mkdir -p android/app/src/main/assets
          ./node_modules/.bin/react-native bundle \
            --platform android \
            --dev false \
            --entry-file index.js \
            --bundle-output android/app/src/main/assets/index.android.bundle \
            --assets-dest android/app/src/main/res/
          cd ./android; ./gradlew assembleDebug; cd ..;

      - name: Gradle | Assemble Release
        run: |
          ./node_modules/.bin/react-native bundle \
            --platform android \
            --dev false \
            --entry-file index.js \
            --bundle-output android/app/src/main/assets/index.android.bundle \
            --assets-dest android/app/build/intermediates/res/merged/release/
          rm -rf android/app/src/main/res/drawable-*
          rm -rf android/app/src/main/res/raw/*
          cd ./android; ./gradlew assembleRelease; cd ..;

      - name: Gradle | Sign APKSs
        run: |
          sudo apt-get install -y apksigner
          apksigner sign \
            --ks $ANDROID_KEYSTORE_PATH \
            --ks-pass pass:$ANDROID_KEYSTORE_PASSWORD \
            --ks-key-alias pipeline-key \
            --key-pass pass:$ANDROID_KEYSTORE_PASSWORD \
            android/app/build/outputs/apk/debug/app-debug.apk
          apksigner verify \
            --verbose --print-certs \
            -v4-signature-file android/app/build/outputs/apk/debug/app-debug.apk.idsig \
            android/app/build/outputs/apk/debug/app-debug.apk
          apksigner sign \
            --ks $ANDROID_KEYSTORE_PATH \
            --ks-pass pass:$ANDROID_KEYSTORE_PASSWORD \
            --ks-key-alias pipeline-key \
            --key-pass pass:$ANDROID_KEYSTORE_PASSWORD \
            android/app/build/outputs/apk/release/app-release.apk
          apksigner verify \
            --verbose --print-certs \
            -v4-signature-file android/app/build/outputs/apk/release/app-release.apk.idsig \
            android/app/build/outputs/apk/release/app-release.apk

      - name: Gradle | Bundle Release
        run: |
          cd ./android; ./gradlew bundleRelease

      # upload artifacts
      - name: Upload | Android artifacts
        uses: actions/upload-artifact@v3
        with:
          name: android-artifacts
          path: android/app/build/outputs/


  #--------------------------------------------------#
  #                     Build iOS                    # 
  #--------------------------------------------------#
  Build-iOS:
    runs-on: ubuntu-latest
    if: github.event_name == 'deployment'

    needs: 
      - Setup

    steps:

      # pre-job
      - name: Setup | Cloning tools
        uses: actions/checkout@v3
        with:
          ref: env/${{needs.Setup.outputs.Environment}}

      - name: Pipeline config scrapper
        id: analysis
        uses: filipeforattini/ff-iac-github-actions/.github/actions/config-scrapper@main

      # pre-build
      - name: Docs | Write summary title
        run: |
          echo "### 🚢 Build iOS" >> $GITHUB_STEP_SUMMARY

      - name: Build
        run: |
          echo "coming soon"
          # yarn ios


  #--------------------------------------------------#
  #                   Build Release                  # 
  #--------------------------------------------------#
  Build-Release:
    runs-on: ubuntu-latest
    if: github.event_name == 'deployment'
    environment: ${{needs.Setup.outputs.Environment}}

    needs: 
      - Setup
      - Build-Android
      - Build-iOS

    steps:

      # pre-job
      - name: Setup | Cloning tools
        uses: actions/checkout@v3
        with:
          ref: env/${{needs.Setup.outputs.Environment}}
          fetch-depth: 0
          persist-credentials: false

      - name: Version
        id: version
        run: |
          NEXT_VERSION=$(git for-each-ref --sort=authordate --format '%(refname)' refs/tags | tail -n 1 | sed -n -e 's/^.*refs\/tags\/v//p')
          echo "next version = $NEXT_VERSION"
          echo "version=$NEXT_VERSION" >> $GITHUB_OUTPUT

      - name: Download | Android artifacts
        uses: actions/download-artifact@v3
        with:
          name: android-artifacts
          path: android/app/build/outputs/
      
      - name: Prettify
        run: |
          cp android/app/build/outputs/apk/debug/app-debug.apk android/app/build/outputs/apk/debug/${{needs.Setup.outputs.Repository}}-debug.${{ steps.version.outputs.version }}.apk
          cp android/app/build/outputs/apk/release/app-release.apk android/app/build/outputs/apk/release/${{needs.Setup.outputs.Repository}}-release.${{ steps.version.outputs.version }}.apk
          cp android/app/build/outputs/bundle/release/app-release.aab android/app/build/outputs/bundle/release/${{needs.Setup.outputs.Repository}}.${{ steps.version.outputs.version }}.aab

      - name: Make release
        uses: marvinpinto/action-automatic-releases@latest
        continue-on-error: true
        with:
          repo_token: "${{ secrets.PIPELINE_DEPLOY_TOKEN }}"
          prerelease: false
          title: v${{ steps.version.outputs.version }}-${{needs.Setup.outputs.Environment}}
          automatic_release_tag: v${{ steps.version.outputs.version }}-${{needs.Setup.outputs.Environment}}
          files: |
            android/app/build/outputs/apk/debug/${{needs.Setup.outputs.Repository}}-debug.${{ steps.version.outputs.version }}.apk
            android/app/build/outputs/apk/release/${{needs.Setup.outputs.Repository}}-release.${{ steps.version.outputs.version }}.apk
            android/app/build/outputs/bundle/release/${{needs.Setup.outputs.Repository}}.${{ steps.version.outputs.version }}.aab