platformDeploy.yml

name: Build and deploy android, desktop, iOS, and web clients

# This workflow is run when any tag is published
on:
  push:
    tags:
      - '*'
  release:
    types: [created]

env:
  SHOULD_DEPLOY_PRODUCTION: ${{ github.event_name == 'release' }}
  DEVELOPER_DIR: /Applications/Xcode_12.3.app/Contents/Developer

jobs:
  android:
    name: Build and deploy Android
    if: github.actor == 'OSBotify'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2

      - uses: actions/setup-ruby@v1
        with:
          ruby-version: '2.7'

      - name: Install bundler
        run: gem install bundler

      - name: Install gems
        run: bundle install

      - name: Install node packages
        uses: nick-invision/retry@7c68161adf97a48beb850a595b8784ec57a98cbb
        with:
          timeout_minutes: 10
          max_attempts: 5
          command: npm ci

      - name: Decrypt keystore
        run: cd android/app && gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" --output my-upload-key.keystore my-upload-key.keystore.gpg
        env:
          LARGE_SECRET_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}

      - name: Decrypt json key
        run: cd android/app && gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" --output android-fastlane-json-key.json android-fastlane-json-key.json.gpg
        env:
          LARGE_SECRET_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}

      - name: Set version in ENV
        run: echo "VERSION_CODE=$(grep -o 'versionCode\s\+\d\+' android/app/build.gradle | awk '{ print $2 }')" >> $GITHUB_ENV

      - name: Run Fastlane beta
        if: ${{ env.SHOULD_DEPLOY_PRODUCTION == 'false' }}
        run: bundle exec fastlane android beta

      - name: Run Fastlane production
        if: ${{ env.SHOULD_DEPLOY_PRODUCTION == 'true' }}
        run: bundle exec fastlane android production
        env:
          VERSION: ${{ env.VERSION_CODE }}

  desktop:
    name: Build and deploy Desktop
    if: github.actor == 'OSBotify'
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v2

      - name: Setup Node
        uses: actions/setup-node@v1
        with:
          node-version: '14.x'

      - name: Install node packages
        uses: nick-invision/retry@7c68161adf97a48beb850a595b8784ec57a98cbb
        with:
          timeout_minutes: 10
          max_attempts: 5
          command: npm ci

      - name: Decrypt Developer ID Certificate
        run: cd desktop && gpg --quiet --batch --yes --decrypt --passphrase="$DEVELOPER_ID_SECRET_PASSPHRASE" --output developer_id.p12 developer_id.p12.gpg
        env:
          DEVELOPER_ID_SECRET_PASSPHRASE: ${{ secrets.DEVELOPER_ID_SECRET_PASSPHRASE }}

      - name: Build production desktop app
        if: ${{ env.SHOULD_DEPLOY_PRODUCTION == 'true' }}
        run: npm run desktop-build -- --publish always -c.afterSign=desktop/notarize.js
        env:
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

      - name: Build staging desktop app
        if: ${{ env.SHOULD_DEPLOY_PRODUCTION == 'false' }}
        run: npm run desktop-build-staging -- --publish always -c.afterSign=desktop/notarize.js
        env:
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

  iOS:
    name: Build and deploy iOS
    if: github.actor == 'OSBotify'
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v2

      - name: Setup Node
        uses: actions/setup-node@v1
        with:
          node-version: '14.x'

      - uses: actions/setup-ruby@v1
        with:
          ruby-version: '2.7'

      - name: Install bundler
        run: gem install bundler

      - name: Install gems
        run: bundle install

      - name: Install node packages
        uses: nick-invision/retry@7c68161adf97a48beb850a595b8784ec57a98cbb
        with:
          timeout_minutes: 10
          max_attempts: 5
          command: npm ci

      - name: Install cocoapods
        run: cd ios && pod install

      - name: Decrypt profile
        run: cd ios && gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" --output chat_expensify_appstore.mobileprovision chat_expensify_appstore.mobileprovision.gpg
        env:
          LARGE_SECRET_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}

      - name: Decrypt certificate
        run: cd ios && gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" --output Certificates.p12 Certificates.p12.gpg
        env:
          LARGE_SECRET_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}

      - name: Decrypt App Store Connect API key
        run: cd ios && gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" --output ios-fastlane-json-key.json ios-fastlane-json-key.json.gpg
        env:
          LARGE_SECRET_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}

      - name: Run Fastlane
        if: ${{ env.SHOULD_DEPLOY_PRODUCTION == 'false' }}
        run: bundle exec fastlane ios beta
        env:
          APPLE_CONTACT_EMAIL: ${{ secrets.APPLE_CONTACT_EMAIL }}
          APPLE_CONTACT_PHONE: ${{ secrets.APPLE_CONTACT_PHONE }}
          APPLE_DEMO_EMAIL: ${{ secrets.APPLE_DEMO_EMAIL }}
          APPLE_DEMO_PASSWORD: ${{ secrets.APPLE_DEMO_PASSWORD }}

      # TODO: uncomment when we want to release iOS to production
      - name: Run Fastlane for App Store release
        #              if: ${{ env.SHOULD_DEPLOY_PRODUCTION == 'true' }}
        if: ${{ env.SHOULD_DEPLOY_PRODUCTION == 'true' && 'false' == 'true' }}
        run: bundle exec fastlane ios production
        env:
          VERSION: ${{ env.NEW_IOS_VERSION }}

  web:
    name: Build and deploy Web
    if: github.actor == 'OSBotify'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2

      - name: Setup Node
        uses: actions/setup-node@v1
        with:
          node-version: '14.x'

      - name: Setup python
        run: sudo apt-get install python3-setuptools

      - name: Setup Cloudflare CLI
        run: |
          # Pip 21 doesn't support python 3.5, so use the version before it
          sudo python3 -m pip install --upgrade pip==20.3.4
          pip3 install wheel # need wheel before cloudflare, this is the only way to ensure order.
          pip3 install cloudflare

      - name: Configure AWS Credentials
        # Version: 1.5.5
        uses: aws-actions/configure-aws-credentials@e97d7fbc8e0e5af69631c13daa0f4b5a8d88165b
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Install node packages
        uses: nick-invision/retry@7c68161adf97a48beb850a595b8784ec57a98cbb
        with:
          timeout_minutes: 10
          max_attempts: 5
          command: npm ci

      - name: Build web for production
        if: ${{ env.SHOULD_DEPLOY_PRODUCTION == 'true' }}
        run: npm run build

      - name: Build web for staging
        if: ${{ env.SHOULD_DEPLOY_PRODUCTION == 'false' }}
        run: npm run build-staging

      - name: Build docs
        run: npm run storybook-build

      - name: Deploy production to S3
        if: ${{ env.SHOULD_DEPLOY_PRODUCTION == 'true' }}
        run: aws s3 cp --recursive --acl public-read $GITHUB_WORKSPACE/dist s3://expensify-cash/

      - name: Deploy staging to S3
        if: ${{ env.SHOULD_DEPLOY_PRODUCTION == 'false' }}
        run: aws s3 cp --recursive --acl public-read $GITHUB_WORKSPACE/dist s3://staging-expensify-cash/

      - name: Purge production Cloudflare cache
        if: ${{ env.SHOULD_DEPLOY_PRODUCTION == 'true' }}
        run: /home/runner/.local/bin/cli4 --delete hosts=["expensify.cash"] /zones/:357b42c0989e3bed82f6d6400e8b9d66/purge_cache
        env:
          CF_API_KEY: ${{ secrets.CLOUDFLARE_TOKEN }}

      - name: Purge staging Cloudflare cache
        if: ${{ env.SHOULD_DEPLOY_PRODUCTION == 'false' }}
        run: /home/runner/.local/bin/cli4 --delete hosts=["staging.expensify.cash"] /zones/:357b42c0989e3bed82f6d6400e8b9d66/purge_cache
        env:
          CF_API_KEY: ${{ secrets.CLOUDFLARE_TOKEN }}

  postSlackMessage:
    name: Post a Slack message when any platform fails to build or deploy
    runs-on: ubuntu-latest
    if: ${{ failure() }}
    needs: [android, desktop, iOS, web]
    steps:
      - uses: 8398a7/action-slack@v3
        name: Job failed Slack notification
        with:
          status: custom
          fields: workflow, repo
          custom_payload: |
            {
              channel: '#announce',
              attachments: [{
                color: "#DB4545",
                pretext: `<!here>`,
                text: `💥 ${process.env.AS_REPO} failed on ${process.env.AS_WORKFLOW} workflow 💥`,
              }]
            }
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

  postGithubComment:
    name: Post a GitHub comment when platforms are done building and deploying
    runs-on: ubuntu-latest
    if: ${{ always() }}
    needs: [android, desktop, iOS, web]
    steps:
      - uses: actions/checkout@v2
        with:
          fetch-depth: 0

      - name: Setup Node
        uses: actions/setup-node@v1
        with:
          node-version: '14.x'

      - name: Determine if this was a cherry-pick
        id: isStagingDeployLocked
        uses: Expensify/Expensify.cash/.github/actions/isStagingDeployLocked@main
        with:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Set version
        run: echo "VERSION=$(npm run print-version --silent)" >> $GITHUB_ENV

      - name: Get Release Pull Request List
        id: getReleasePRList
        uses: Expensify/Expensify.cash/.github/actions/getDeployPullRequestList@main
        with:
          TAG: ${{ env.VERSION }}
          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
          IS_PRODUCTION_DEPLOY: ${{ env.SHOULD_DEPLOY_PRODUCTION == 'true' }}

      - name: Comment on issues
        uses: Expensify/Expensify.cash/.github/actions/markPullRequestsAsDeployed@main
        with:
          PR_LIST: ${{ steps.getReleasePRList.outputs.PR_LIST }}
          IS_PRODUCTION_DEPLOY: ${{ env.SHOULD_DEPLOY_PRODUCTION == 'true' }}
          # If the StagingDeployCash is still locked, then this was a cherry-pick deploy
          IS_CHERRY_PICK: ${{ steps.isStagingDeployLocked.outputs.IS_LOCKED }}
          DEPLOY_VERSION: ${{ env.VERSION }}
          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
          ANDROID: ${{ needs.android.result }}
          DESKTOP: ${{ needs.desktop.result }}
          IOS: ${{ needs.iOS.result }}
          WEB: ${{ needs.web.result }}