Skip to content

Commit dc0ce9e

Browse files
phantumcodephantumcode
authored
chore: kickoff release
2 parents f015e12 + 21f31d0 commit dc0ce9e

31 files changed

+769
-236
lines changed

‎.github/composite_actions/run_xcodebuild/action.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: 'Run xcodebuild'
2+
description: 'Action runs `xcodebuild build` for the scheme specified'
3+
4+
inputs:
5+
scheme:
6+
required: true
7+
type: string
8+
project_path:
9+
required: false
10+
type: string
11+
xcode_path:
12+
required: false
13+
type: string
14+
destination:
15+
required: false
16+
type: string
17+
default: 'platform=iOS Simulator,name=iPhone 13,OS=latest'
18+
sdk:
19+
required: false
20+
type: string
21+
default: 'iphonesimulator'
22+
other_flags:
23+
required: false
24+
type: string
25+
default: ''
26+
27+
runs:
28+
using: "composite"
29+
steps:
30+
- name: Build ${{ inputs.scheme }}
31+
env:
32+
SCHEME: ${{ inputs.scheme }}
33+
PROJECT_PATH: ${{ inputs.project_path }}
34+
XCODE_PATH: ${{ inputs.xcode_path }}
35+
run: |
36+
if [ ! -z "$PROJECT_PATH" ]; then
37+
cd $PROJECT_PATH
38+
fi
39+
if [ ! -z "$XCODE_PATH" ]; then
40+
sudo xcode-select -s $XCODE_PATH
41+
fi
42+
xcodebuild -version
43+
xcodebuild build -scheme $SCHEME -sdk '${{ inputs.sdk }}' -destination '${{ inputs.destination }}' ${{ inputs.other_flags }} | xcpretty --simple --color --report junit && exit ${PIPESTATUS[0]}
44+
shell: bash

‎.github/composite_actions/run_xcodebuild_test/action.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: 'Run xcodebuild test'
2+
description: 'Action runs the test for the scheme specified'
3+
4+
inputs:
5+
scheme:
6+
required: true
7+
type: string
8+
project_path:
9+
required: false
10+
type: string
11+
xcode_path:
12+
required: false
13+
type: string
14+
destination:
15+
required: false
16+
type: string
17+
default: 'platform=iOS Simulator,name=iPhone 13,OS=latest'
18+
sdk:
19+
required: false
20+
type: string
21+
default: 'iphonesimulator'
22+
other_flags:
23+
required: false
24+
type: string
25+
default: ''
26+
generate_coverage:
27+
required: false
28+
type: boolean
29+
default: false
30+
31+
runs:
32+
using: "composite"
33+
steps:
34+
- name: Test ${{ inputs.scheme }}
35+
env:
36+
SCHEME: ${{ inputs.scheme }}
37+
PROJECT_PATH: ${{ inputs.project_path }}
38+
XCODE_PATH: ${{ inputs.xcode_path }}
39+
run: |
40+
if [ ! -z "$PROJECT_PATH" ]; then
41+
cd $PROJECT_PATH
42+
fi
43+
if [ ! -z "$XCODE_PATH" ]; then
44+
echo "Using Xcode $XCODE_PATH"
45+
sudo xcode-select -s $XCODE_PATH
46+
fi
47+
coverageFlags=""
48+
if [ "${{ inputs.generate_coverage }}" == "true" ]; then
49+
echo "Code Coverage is enabled!"
50+
coverageFlags+="-derivedDataPath Build/ -clonedSourcePackagesDirPath "~/Library/Developer/Xcode/DerivedData/$SCHEME" -enableCodeCoverage YES build test"
51+
fi
52+
xcode-select -p
53+
xcodebuild -version
54+
xcodebuild test -scheme $SCHEME -sdk '${{ inputs.sdk }}' -destination '${{ inputs.destination }}' ${{ inputs.other_flags }} $coverageFlags | xcpretty --simple --color --report junit && exit ${PIPESTATUS[0]}
55+
shell: bash
56+
57+
- name: Generate Coverage report
58+
if: ${{ inputs.generate_coverage == 'true' }}
59+
run: |
60+
echo "Generating Coverage report..."
61+
cd Build/Build/ProfileData
62+
cd $(ls -d */|head -n 1)
63+
pathCoverage=Build/Build/ProfileData/${PWD##*/}/Coverage.profdata
64+
cd ../../../../
65+
xcrun llvm-cov export -format="lcov" -instr-profile $pathCoverage Build/Build/Products/Debug-iphonesimulator/$SCHEME.o > Coverage.lcov
66+
shell: bash

‎.github/workflows/build_liveness.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
name: Build | Amplify UI Swift Liveness
2+
on:
3+
workflow_call:
4+
inputs:
5+
identifier:
6+
required: true
7+
type: string
8+
workflow_dispatch:
9+
push:
10+
branches-ignore:
11+
- main
12+
- release
13+
14+
permissions:
15+
contents: read
16+
17+
concurrency:
18+
group: ${{ inputs.identifier || github.workflow }}-${{ github.event.pull_request.number || github.ref }}
19+
cancel-in-progress: ${{ github.ref_name != 'main'}}
20+
21+
jobs:
22+
build-amplify-ui-swift-liveness:
23+
runs-on: macos-13
24+
timeout-minutes: 20
25+
steps:
26+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 #v3.5.3
27+
with:
28+
persist-credentials: false
29+
- name: Build Amplify Swift Liveness UI
30+
uses: ./.github/composite_actions/run_xcodebuild
31+
with:
32+
scheme: AmplifyUILiveness
33+
destination: 'platform=iOS Simulator,name=iPhone 14,OS=16.4'
34+
xcode_path: '/Applications/Xcode_14.3.app'
35+
36+
confirm-pass:
37+
runs-on: ubuntu-latest
38+
name: Confirm Passing Build Steps
39+
if: ${{ !cancelled() }}
40+
needs: [ build-amplify-ui-swift-liveness ]
41+
env:
42+
EXIT_CODE: ${{ contains(needs.*.result, 'failure') && 1 || 0 }}
43+
steps:
44+
- run: exit $EXIT_CODE
45+

‎.github/workflows/dependency-review.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: Dependency Review
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
dependency-review:
13+
name: Dependency Review
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Checkout Code
17+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
18+
with:
19+
persist-credentials: false
20+
21+
- name: Dependency Review
22+
uses: actions/dependency-review-action@7d90b4f05fea31dde1c4a1fb3fa787e197ea93ab # v3.0.7
23+
with:
24+
config-file: aws-amplify/amplify-ci-support/.github/dependency-review-config.yml@main

‎.github/workflows/deploy_liveness.yml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: Deploy Liveness
2+
on:
3+
workflow_call:
4+
inputs:
5+
type:
6+
description: 'The type of deployment. Valid values are unstable (default) and release'
7+
default: 'unstable'
8+
required: false
9+
type: string
10+
11+
permissions:
12+
id-token: write
13+
contents: write
14+
15+
jobs:
16+
build-amplify-ui-swift-liveness:
17+
name: Build Amplify package
18+
uses: ./.github/workflows/build_liveness.yml
19+
with:
20+
identifier: 'workflow-call-build-liveness'
21+
22+
unit-tests:
23+
name: Run Unit Tests
24+
uses: ./.github/workflows/liveness_unit_tests.yml
25+
with:
26+
identifier: 'workflow-call-unit-test'
27+
28+
fortify:
29+
name: Run Fortify Scan
30+
uses: ./.github/workflows/fortify_scan.yml
31+
secrets: inherit
32+
with:
33+
identifier: 'workflow-call-fortify'
34+
35+
release:
36+
environment: Release
37+
name: Release new ${{ inputs.type }} version
38+
needs: [unit-tests, fortify, build-amplify-ui-swift-liveness]
39+
runs-on: macos-latest
40+
env:
41+
GITHUB_EMAIL: aws-amplify-ops@amazon.com
42+
GITHUB_USER: aws-amplify-ops
43+
steps:
44+
- name: Configure AWS credentials
45+
uses: aws-actions/configure-aws-credentials@8c3f20df09ac63af7b3ae3d7c91f105f857d8497 #v4
46+
with:
47+
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
48+
role-session-name: ${{ format('{0}.release', github.run_id) }}
49+
aws-region: ${{ secrets.AWS_REGION }}
50+
mask-aws-account-id: true
51+
52+
- id: retrieve-token
53+
name: Retrieve Token
54+
env:
55+
DEPLOY_SECRET_ARN: ${{ secrets.DEPLOY_SECRET_ARN }}
56+
run: |
57+
PAT=$(aws secretsmanager get-secret-value \
58+
--secret-id "$DEPLOY_SECRET_ARN" \
59+
| jq -r ".SecretString | fromjson | .Credential")
60+
echo "token=$PAT" >> $GITHUB_OUTPUT
61+
62+
- name: Checkout repo
63+
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
64+
with:
65+
fetch-depth: 10
66+
token: ${{steps.retrieve-token.outputs.token}}
67+
68+
- name: Setup Ruby
69+
uses: ruby/setup-ruby@250fcd6a742febb1123a77a841497ccaa8b9e939 # v1.152.0
70+
with:
71+
ruby-version: '3.2.1'
72+
bundler-cache: true
73+
74+
- name: Release Package
75+
run: bundle exec fastlane ${{ inputs.type }}

‎.github/workflows/deploy_release.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
name: Build, Test and Release | Stable version
2+
on:
3+
push:
4+
branches:
5+
release
6+
7+
permissions:
8+
id-token: write
9+
contents: write
10+
11+
jobs:
12+
release-stable:
13+
uses: ./.github/workflows/deploy_liveness.yml
14+
with:
15+
type: release
16+
secrets: inherit
17+

‎.github/workflows/deploy_unstable.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
name: Build, Test and Release | Unstable version
2+
on:
3+
push:
4+
branches:
5+
main
6+
7+
permissions:
8+
id-token: write
9+
contents: write
10+
11+
jobs:
12+
release-unstable:
13+
uses: ./.github/workflows/deploy_liveness.yml
14+
with:
15+
type: unstable
16+
secrets: inherit

‎.github/workflows/fortify_scan.yml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
name: Fortify Scan
2+
on:
3+
workflow_dispatch:
4+
workflow_call:
5+
inputs:
6+
identifier:
7+
required: true
8+
type: string
9+
push:
10+
branches-ignore:
11+
- main
12+
- release
13+
14+
permissions:
15+
id-token: write
16+
contents: read
17+
18+
concurrency:
19+
group: ${{ inputs.identifier || github.workflow }}-${{ github.event.pull_request.number || github.ref }}
20+
cancel-in-progress: ${{ github.ref_name != 'main'}}
21+
22+
jobs:
23+
fortify-scan:
24+
runs-on: macos-latest
25+
environment: Fortify
26+
steps:
27+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 #v3.5.3
28+
with:
29+
persist-credentials: false
30+
31+
- name: Configure AWS credentials for fetching fortify resources
32+
uses: aws-actions/configure-aws-credentials@8c3f20df09ac63af7b3ae3d7c91f105f857d8497 #v4
33+
with:
34+
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
35+
aws-region: ${{ secrets.AWS_REGION }}
36+
role-session-name: GHAFortifySession
37+
role-duration-seconds: 900
38+
mask-aws-account-id: true
39+
40+
- name: Download License
41+
run: |
42+
aws s3 cp s3://${{ secrets.AWS_S3_FORTIFY_BUCKET }}${{ vars.LICENSE_PATH }} fortify.license
43+
44+
- name: Download Installer
45+
run: |
46+
aws s3 cp s3://${{ secrets.AWS_S3_FORTIFY_BUCKET }}${{ vars.INSTALLER_PATH }} Fortify_SCA_and_Apps_22.1.1_Mac.tar.gz
47+
tar -xvf Fortify_SCA_and_Apps_22.1.1_Mac.tar.gz
48+
unzip Fortify_SCA_and_Apps_22.1.1_osx_x64.app.zip
49+
50+
- name: Download Scripts
51+
run: |
52+
aws s3 cp s3://${{ secrets.AWS_S3_FORTIFY_BUCKET }}${{ vars.SCRIPTS_PATH }} liveness_swift_fortify_scan.sh
53+
54+
- name: Run Installer
55+
run: |
56+
Fortify_SCA_and_Apps_22.1.1_osx_x64.app/Contents/MacOS/installbuilder.sh --mode unattended --installdir ~/amplify-ui-swift-liveness/Fortify --InstallSamples 0 --fortify_license_path fortify.license --MigrateSCA 0
57+
export PATH=~/amplify-ui-swift-liveness/Fortify/bin:$PATH
58+
fortifyupdate -acceptKey
59+
sourceanalyzer -version
60+
61+
- name: Run Scan
62+
run: |
63+
export PATH=~/amplify-ui-swift-liveness/Fortify/bin:$PATH
64+
sh ./liveness_swift_fortify_scan.sh Sources
65+
66+
confirm-pass:
67+
runs-on: ubuntu-latest
68+
name: Confirm Passing Fortify Scan
69+
if: ${{ !cancelled() }}
70+
needs: [ fortify-scan ]
71+
env:
72+
EXIT_CODE: ${{ contains(needs.*.result, 'failure') && 1 || 0 }}
73+
steps:
74+
- run: exit $EXIT_CODE

0 commit comments

Comments
 (0)