From 1052c7c00099e7a14fdbd377d57e34f4305eddea Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Thu, 13 Jul 2023 18:01:41 -0400 Subject: [PATCH 1/2] Do not publish signed .deb unless deploying --- .github/workflows/ci-pipeline.yml | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci-pipeline.yml b/.github/workflows/ci-pipeline.yml index 2ee2296c9f..62f74d4110 100644 --- a/.github/workflows/ci-pipeline.yml +++ b/.github/workflows/ci-pipeline.yml @@ -42,7 +42,6 @@ env: TGS_TEST_GITHUB_TOKEN: ${{ secrets.LIVE_TESTS_TOKEN }} TGS_RELEASE_NOTES_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }} WINGET_PUSH_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }} - PACKAGING_KEYGRIP: ${{ vars.PACKAGING_KEYGRIP }} PACKAGING_PRIVATE_KEY_PASSPHRASE: ${{ secrets.PACKAGING_PRIVATE_KEY_PASSPHRASE }} CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} @@ -926,11 +925,15 @@ jobs: runs-on: ubuntu-latest if: "!(cancelled() || failure()) && needs.start-ci-run-gate.result == 'success'" steps: - - name: Import GPG Key + - name: Install Native Dependencies run: | sudo dpkg --add-architecture i386 sudo apt-get update - sudo apt-get install -y -o APT::Immediate-Configure=0 libstdc++6:i386 libgcc-s1:i386 gnupg2 + sudo apt-get install -y -o APT::Immediate-Configure=0 libstdc++6:i386 libgcc-s1:i386 gnupg2 xmlstarlet + + - name: Import GPG Key + if: "github.event_name == 'push' && github.event.ref == 'refs/heads/master' && contains(github.event.head_commit.message, '[TGSDeploy]')" + run: | echo "${{ secrets.PACKAGING_PRIVATE_KEY }}" > private.pgp echo ${{ secrets.PACKAGING_PRIVATE_KEY_PASSPHRASE }} | gpg --batch --yes --passphrase-fd 0 --import private.pgp rm private.pgp @@ -945,15 +948,20 @@ jobs: with: ref: "refs/pull/${{ github.event.number }}/merge" - - name: Execute Build Script - run: sudo -E build/package/deb/build_package.sh - - name: Parse TGS version run: | echo "TGS_VERSION=$(xmlstarlet sel -N X="http://schemas.microsoft.com/developer/msbuild/2003" --template --value-of /X:Project/X:PropertyGroup/X:TgsCoreVersion build/Version.props)" >> $GITHUB_ENV - - name: Validate Signatures + - name: Execute Build Script (Unsigned) + if: "!(github.event_name == 'push' && github.event.ref == 'refs/heads/master' && contains(github.event.head_commit.message, '[TGSDeploy]'))" + run: sudo build/package/deb/build_package.sh + + - name: Execute Build Script (Signed) + if: "github.event_name == 'push' && github.event.ref == 'refs/heads/master' && contains(github.event.head_commit.message, '[TGSDeploy]')" + env: + PACKAGING_KEYGRIP: ${{ vars.PACKAGING_KEYGRIP }} run: | + sudo -E build/package/deb/build_package.sh gpg --verify tgstation-server_${{ env.TGS_VERSION }}-1.dsc gpg --verify tgstation-server_${{ env.TGS_VERSION }}-1_amd64.changes gpg --verify tgstation-server_${{ env.TGS_VERSION }}-1_amd64.buildinfo From fc343c483b243d52b418f82b5571a4f32307c15e Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Thu, 13 Jul 2023 22:57:22 -0400 Subject: [PATCH 2/2] Only deploy on master or dev --- .github/workflows/ci-pipeline.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci-pipeline.yml b/.github/workflows/ci-pipeline.yml index 40c1213f01..b5a21c360e 100644 --- a/.github/workflows/ci-pipeline.yml +++ b/.github/workflows/ci-pipeline.yml @@ -921,7 +921,7 @@ jobs: sudo apt-get install -y -o APT::Immediate-Configure=0 libstdc++6:i386 libgcc-s1:i386 gnupg2 xmlstarlet - name: Import GPG Key - if: "github.event_name == 'push' && github.event.ref == 'refs/heads/master' && contains(github.event.head_commit.message, '[TGSDeploy]')" + if: "github.event_name == 'push' && contains(github.event.head_commit.message, '[TGSDeploy]') && (github.event.ref == 'refs/heads/master' || github.event.ref == 'refs/heads/dev')" run: | echo "${{ secrets.PACKAGING_PRIVATE_KEY }}" > private.pgp echo ${{ secrets.PACKAGING_PRIVATE_KEY_PASSPHRASE }} | gpg --batch --yes --passphrase-fd 0 --import private.pgp @@ -959,11 +959,11 @@ jobs: echo "TGS_VERSION=$(xmlstarlet sel -N X="http://schemas.microsoft.com/developer/msbuild/2003" --template --value-of /X:Project/X:PropertyGroup/X:TgsCoreVersion build/Version.props)" >> $GITHUB_ENV - name: Execute Build Script (Unsigned) - if: "!(github.event_name == 'push' && github.event.ref == 'refs/heads/master' && contains(github.event.head_commit.message, '[TGSDeploy]'))" + if: "!(github.event_name == 'push' && contains(github.event.head_commit.message, '[TGSDeploy]') && (github.event.ref == 'refs/heads/master' || github.event.ref == 'refs/heads/dev'))" run: sudo build/package/deb/build_package.sh - name: Execute Build Script (Signed) - if: "github.event_name == 'push' && github.event.ref == 'refs/heads/master' && contains(github.event.head_commit.message, '[TGSDeploy]')" + if: "github.event_name == 'push' && contains(github.event.head_commit.message, '[TGSDeploy]') && (github.event.ref == 'refs/heads/master' || github.event.ref == 'refs/heads/dev')" env: PACKAGING_KEYGRIP: ${{ vars.PACKAGING_KEYGRIP }} run: | @@ -1186,7 +1186,7 @@ jobs: name: Deployment Start Gate needs: ci-completion-gate runs-on: ubuntu-latest - if: "!(cancelled() || failure()) && needs.ci-completion-gate.result == 'success' && github.event_name == 'push'" + if: "!(cancelled() || failure()) && needs.ci-completion-gate.result == 'success' && github.event_name == 'push' && (github.event.ref == 'refs/heads/master' || github.event.ref == 'refs/heads/dev')" steps: - name: GitHub Requires at Least One Step for a Job run: exit 0