Skip to content

Commit 664d569

Browse files
phantumcodephantumcode
authored
build: add GitHub actions for build, test, code scan, and release (#50)
* build: add github actions for build, test, code scan, and release * chore: update github action pinned version * update fortify scan
1 parent 680bb19 commit 664d569

File tree

19 files changed

+568
-13
lines changed

19 files changed

+568
-13
lines changed

Diff for: ‎.github/composite_actions/run_xcodebuild/action.yml

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: 'Run xcodebuild'
2+
description: 'Action runs `xcodebuild build` for the scheme specified'
3+
4+
inputs:
5+
scheme:
6+
required: true
7+
type: string
8+
project_path:
9+
required: false
10+
type: string
11+
xcode_path:
12+
required: false
13+
type: string
14+
destination:
15+
required: false
16+
type: string
17+
default: 'platform=iOS Simulator,name=iPhone 13,OS=latest'
18+
sdk:
19+
required: false
20+
type: string
21+
default: 'iphonesimulator'
22+
other_flags:
23+
required: false
24+
type: string
25+
default: ''
26+
27+
runs:
28+
using: "composite"
29+
steps:
30+
- name: Build ${{ inputs.scheme }}
31+
env:
32+
SCHEME: ${{ inputs.scheme }}
33+
PROJECT_PATH: ${{ inputs.project_path }}
34+
XCODE_PATH: ${{ inputs.xcode_path }}
35+
run: |
36+
if [ ! -z "$PROJECT_PATH" ]; then
37+
cd $PROJECT_PATH
38+
fi
39+
if [ ! -z "$XCODE_PATH" ]; then
40+
sudo xcode-select -s $XCODE_PATH
41+
fi
42+
xcodebuild -version
43+
xcodebuild build -scheme $SCHEME -sdk '${{ inputs.sdk }}' -destination '${{ inputs.destination }}' ${{ inputs.other_flags }} | xcpretty --simple --color --report junit && exit ${PIPESTATUS[0]}
44+
shell: bash

Diff for: ‎.github/composite_actions/run_xcodebuild_test/action.yml

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: 'Run xcodebuild test'
2+
description: 'Action runs the test for the scheme specified'
3+
4+
inputs:
5+
scheme:
6+
required: true
7+
type: string
8+
project_path:
9+
required: false
10+
type: string
11+
xcode_path:
12+
required: false
13+
type: string
14+
destination:
15+
required: false
16+
type: string
17+
default: 'platform=iOS Simulator,name=iPhone 13,OS=latest'
18+
sdk:
19+
required: false
20+
type: string
21+
default: 'iphonesimulator'
22+
other_flags:
23+
required: false
24+
type: string
25+
default: ''
26+
generate_coverage:
27+
required: false
28+
type: boolean
29+
default: false
30+
31+
runs:
32+
using: "composite"
33+
steps:
34+
- name: Test ${{ inputs.scheme }}
35+
env:
36+
SCHEME: ${{ inputs.scheme }}
37+
PROJECT_PATH: ${{ inputs.project_path }}
38+
XCODE_PATH: ${{ inputs.xcode_path }}
39+
run: |
40+
if [ ! -z "$PROJECT_PATH" ]; then
41+
cd $PROJECT_PATH
42+
fi
43+
if [ ! -z "$XCODE_PATH" ]; then
44+
echo "Using Xcode $XCODE_PATH"
45+
sudo xcode-select -s $XCODE_PATH
46+
fi
47+
coverageFlags=""
48+
if [ "${{ inputs.generate_coverage }}" == "true" ]; then
49+
echo "Code Coverage is enabled!"
50+
coverageFlags+="-derivedDataPath Build/ -clonedSourcePackagesDirPath "~/Library/Developer/Xcode/DerivedData/$SCHEME" -enableCodeCoverage YES build test"
51+
fi
52+
xcode-select -p
53+
xcodebuild -version
54+
xcodebuild test -scheme $SCHEME -sdk '${{ inputs.sdk }}' -destination '${{ inputs.destination }}' ${{ inputs.other_flags }} $coverageFlags | xcpretty --simple --color --report junit && exit ${PIPESTATUS[0]}
55+
shell: bash
56+
57+
- name: Generate Coverage report
58+
if: ${{ inputs.generate_coverage == 'true' }}
59+
run: |
60+
echo "Generating Coverage report..."
61+
cd Build/Build/ProfileData
62+
cd $(ls -d */|head -n 1)
63+
pathCoverage=Build/Build/ProfileData/${PWD##*/}/Coverage.profdata
64+
cd ../../../../
65+
xcrun llvm-cov export -format="lcov" -instr-profile $pathCoverage Build/Build/Products/Debug-iphonesimulator/$SCHEME.o > Coverage.lcov
66+
shell: bash

Diff for: ‎.github/workflows/build_liveness.yml

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
name: Build | Amplify UI Swift Liveness
2+
on:
3+
workflow_call:
4+
inputs:
5+
identifier:
6+
required: true
7+
type: string
8+
workflow_dispatch:
9+
push:
10+
branches-ignore:
11+
- main
12+
- release
13+
14+
permissions:
15+
contents: read
16+
17+
concurrency:
18+
group: ${{ inputs.identifier || github.workflow }}-${{ github.event.pull_request.number || github.ref }}
19+
cancel-in-progress: ${{ github.ref_name != 'main'}}
20+
21+
jobs:
22+
build-amplify-ui-swift-liveness:
23+
runs-on: macos-13
24+
timeout-minutes: 20
25+
steps:
26+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 #v3.5.3
27+
with:
28+
persist-credentials: false
29+
- name: Build Amplify Swift Liveness UI
30+
uses: ./.github/composite_actions/run_xcodebuild
31+
with:
32+
scheme: AmplifyUILiveness
33+
destination: 'platform=iOS Simulator,name=iPhone 14,OS=16.4'
34+
xcode_path: '/Applications/Xcode_14.3.app'
35+
36+
confirm-pass:
37+
runs-on: ubuntu-latest
38+
name: Confirm Passing Build Steps
39+
if: ${{ !cancelled() }}
40+
needs: [ build-amplify-ui-swift-liveness ]
41+
env:
42+
EXIT_CODE: ${{ contains(needs.*.result, 'failure') && 1 || 0 }}
43+
steps:
44+
- run: exit $EXIT_CODE
45+

Diff for: ‎.github/workflows/deploy_liveness.yml

+74
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
name: Deploy Liveness
2+
on:
3+
workflow_call:
4+
inputs:
5+
type:
6+
description: 'The type of deployment. Valid values are unstable (default) and release'
7+
default: 'unstable'
8+
required: false
9+
type: string
10+
11+
permissions:
12+
id-token: write
13+
contents: write
14+
15+
jobs:
16+
build-amplify-ui-swift-liveness:
17+
name: Build Amplify package
18+
uses: ./.github/workflows/build_liveness.yml
19+
with:
20+
identifier: 'workflow-call-build-liveness'
21+
22+
unit-tests:
23+
name: Run Unit Tests
24+
uses: ./.github/workflows/liveness_unit_tests.yml
25+
with:
26+
identifier: 'workflow-call-unit-test'
27+
28+
fortify:
29+
name: Run Fortify Scan
30+
uses: ./.github/workflows/fortify_scan.yml
31+
secrets: inherit
32+
with:
33+
identifier: 'workflow-call-fortify'
34+
35+
release:
36+
environment: Release
37+
name: Release new ${{ inputs.type }} version
38+
needs: [unit-tests, fortify, build-amplify-ui-swift-liveness]
39+
runs-on: macos-latest
40+
env:
41+
GITHUB_EMAIL: [email protected]
42+
GITHUB_USER: aws-amplify-ops
43+
steps:
44+
- name: Configure AWS credentials
45+
uses: aws-actions/configure-aws-credentials@8c3f20df09ac63af7b3ae3d7c91f105f857d8497 #v4
46+
with:
47+
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
48+
role-session-name: ${{ format('{0}.release', github.run_id) }}
49+
aws-region: ${{ secrets.AWS_REGION }}
50+
51+
- id: retrieve-token
52+
name: Retrieve Token
53+
env:
54+
DEPLOY_SECRET_ARN: ${{ secrets.DEPLOY_SECRET_ARN }}
55+
run: |
56+
PAT=$(aws secretsmanager get-secret-value \
57+
--secret-id "$DEPLOY_SECRET_ARN" \
58+
| jq -r ".SecretString | fromjson | .Credential")
59+
echo "token=$PAT" >> $GITHUB_OUTPUT
60+
61+
- name: Checkout repo
62+
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
63+
with:
64+
fetch-depth: 10
65+
token: ${{steps.retrieve-token.outputs.token}}
66+
67+
- name: Setup Ruby
68+
uses: ruby/setup-ruby@250fcd6a742febb1123a77a841497ccaa8b9e939 # v1.152.0
69+
with:
70+
ruby-version: '3.2.1'
71+
bundler-cache: true
72+
73+
- name: Release Package
74+
run: bundle exec fastlane ${{ inputs.type }}

Diff for: ‎.github/workflows/deploy_release.yml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
name: Build, Test and Release | Stable version
2+
on:
3+
push:
4+
branches:
5+
release
6+
7+
permissions:
8+
id-token: write
9+
contents: write
10+
11+
jobs:
12+
release-stable:
13+
uses: ./.github/workflows/deploy_liveness.yml
14+
with:
15+
type: release
16+
secrets: inherit
17+

Diff for: ‎.github/workflows/deploy_unstable.yml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
name: Build, Test and Release | Unstable version
2+
on:
3+
push:
4+
branches:
5+
main
6+
7+
permissions:
8+
id-token: write
9+
contents: write
10+
11+
jobs:
12+
release-unstable:
13+
uses: ./.github/workflows/deploy_liveness.yml
14+
with:
15+
type: unstable
16+
secrets: inherit

Diff for: ‎.github/workflows/fortify_scan.yml

+74
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
name: Fortify Scan
2+
on:
3+
workflow_dispatch:
4+
workflow_call:
5+
inputs:
6+
identifier:
7+
required: true
8+
type: string
9+
push:
10+
branches-ignore:
11+
- main
12+
- release
13+
14+
permissions:
15+
id-token: write
16+
contents: read
17+
18+
concurrency:
19+
group: ${{ inputs.identifier || github.workflow }}-${{ github.event.pull_request.number || github.ref }}
20+
cancel-in-progress: ${{ github.ref_name != 'main'}}
21+
22+
jobs:
23+
fortify-scan:
24+
runs-on: macos-latest
25+
environment: Fortify
26+
steps:
27+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 #v3.5.3
28+
with:
29+
persist-credentials: false
30+
31+
- name: Configure AWS credentials for fetching fortify resources
32+
uses: aws-actions/configure-aws-credentials@8c3f20df09ac63af7b3ae3d7c91f105f857d8497 #v4
33+
with:
34+
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
35+
aws-region: ${{ secrets.AWS_REGION }}
36+
role-session-name: GHAFortifySession
37+
role-duration-seconds: 900
38+
mask-aws-account-id: true
39+
40+
- name: Download License
41+
run: |
42+
aws s3 cp s3://${{ secrets.AWS_S3_FORTIFY_BUCKET }}${{ vars.LICENSE_PATH }} fortify.license
43+
44+
- name: Download Installer
45+
run: |
46+
aws s3 cp s3://${{ secrets.AWS_S3_FORTIFY_BUCKET }}${{ vars.INSTALLER_PATH }} Fortify_SCA_and_Apps_22.1.1_Mac.tar.gz
47+
tar -xvf Fortify_SCA_and_Apps_22.1.1_Mac.tar.gz
48+
unzip Fortify_SCA_and_Apps_22.1.1_osx_x64.app.zip
49+
50+
- name: Download Scripts
51+
run: |
52+
aws s3 cp s3://${{ secrets.AWS_S3_FORTIFY_BUCKET }}${{ vars.SCRIPTS_PATH }} liveness_swift_fortify_scan.sh
53+
54+
- name: Run Installer
55+
run: |
56+
Fortify_SCA_and_Apps_22.1.1_osx_x64.app/Contents/MacOS/installbuilder.sh --mode unattended --installdir ~/amplify-ui-swift-liveness/Fortify --InstallSamples 0 --fortify_license_path fortify.license --MigrateSCA 0
57+
export PATH=~/amplify-ui-swift-liveness/Fortify/bin:$PATH
58+
fortifyupdate -acceptKey
59+
sourceanalyzer -version
60+
61+
- name: Run Scan
62+
run: |
63+
export PATH=~/amplify-ui-swift-liveness/Fortify/bin:$PATH
64+
sh ./liveness_swift_fortify_scan.sh Sources
65+
66+
confirm-pass:
67+
runs-on: ubuntu-latest
68+
name: Confirm Passing Fortify Scan
69+
if: ${{ !cancelled() }}
70+
needs: [ fortify-scan ]
71+
env:
72+
EXIT_CODE: ${{ contains(needs.*.result, 'failure') && 1 || 0 }}
73+
steps:
74+
- run: exit $EXIT_CODE

Diff for: ‎.github/workflows/liveness_unit_tests.yml

+12-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Run Unit Tests
1+
name: Run Unit Tests | Amplify UI Swift Liveness
22

33
on:
44
workflow_dispatch:
@@ -12,5 +12,15 @@ jobs:
1212
runs-on: macos-latest
1313
steps:
1414
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
15+
with:
16+
persist-credentials: false
1517
- name: Test FaceLiveness
16-
run: xcodebuild test -scheme AmplifyUILiveness -sdk 'iphonesimulator' -destination 'platform=iOS Simulator,name=iPhone 14,OS=latest' | xcpretty --simple --color --report junit && exit ${PIPESTATUS[0]}
18+
with:
19+
scheme: AmplifyUILiveness
20+
destination: 'platform=iOS Simulator,name=iPhone 14,OS=16.4'
21+
xcode_path: '/Applications/Xcode_14.3.app'
22+
generate_coverage: true
23+
- name: Upload Coverage report to Codecov
24+
uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
25+
with:
26+
flags: 'unittests'

0 commit comments

Comments
 (0)