publish-go-nightly-task.yml

# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/publish-go-nightly-task.md
name: Publish Nightly Build

env:
  # As defined by the Taskfile's PROJECT_NAME variable
  PROJECT_NAME: arduino-lint
  # As defined by the Taskfile's DIST_DIR variable
  DIST_DIR: dist
  # The project's folder on Arduino's download server for uploading builds
  AWS_PLUGIN_TARGET: /arduino-lint/
  AWS_REGION: "us-east-1"
  ARTIFACT_PREFIX: dist-

# See: https://docs.github.com/actions/reference/workflows-and-actions/events-that-trigger-workflows
on:
  schedule:
    # run every day at 1AM
    - cron: "0 1 * * *"
  workflow_dispatch:
  repository_dispatch:

jobs:
  create-nightly-artifacts:
    runs-on: ${{ matrix.os.runner }}
    permissions:
      contents: read

    strategy:
      matrix:
        os:
          - task: Windows_32bit
            artifact-suffix: Windows_32bit
            runner: ubuntu-latest
          - task: Windows_64bit
            artifact-suffix: Windows_64bit
            runner: ubuntu-latest
          - task: Windows_ARM64
            artifact-suffix: Windows_ARM64
            runner: ubuntu-24.04-arm
          - task: Linux_32bit
            artifact-suffix: Linux_32bit
            runner: ubuntu-latest
          - task: Linux_64bit
            artifact-suffix: Linux_64bit
            runner: ubuntu-latest
          - task: Linux_ARMv6
            artifact-suffix: Linux_ARMv6
            runner: ubuntu-latest
          - task: Linux_ARMv7
            artifact-suffix: Linux_ARMv7
            runner: ubuntu-latest
          - task: Linux_ARM64
            artifact-suffix: Linux_ARM64
            runner: ubuntu-24.04-arm
          - task: macOS_64bit
            artifact-suffix: macOS_64bit
            runner: ubuntu-latest
          - task: macOS_ARM64
            artifact-suffix: macOS_ARM64
            runner: ubuntu-24.04-arm

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod

      - name: Build
        env:
          NIGHTLY: true
        run: |
          go tool \
            github.com/go-task/task/v3/cmd/task dist:${{ matrix.os.task }}

      - name: Upload artifacts
        uses: actions/upload-artifact@v6
        with:
          if-no-files-found: error
          name: ${{ env.ARTIFACT_PREFIX }}${{ matrix.os.artifact-suffix }}
          path: ${{ env.DIST_DIR }}

  notarize-macos:
    name: Notarize ${{ matrix.build.folder-suffix }}
    runs-on: macos-latest
    needs: create-nightly-artifacts
    permissions:
      contents: read

    env:
      GON_CONFIG_PATH: gon.config.hcl

    strategy:
      matrix:
        build:
          - artifact-suffix: macOS_64bit
            folder-suffix: darwin_amd64
            package-suffix: "macOS_64bit.tar.gz"
          - artifact-suffix: macOS_ARM64
            folder-suffix: darwin_arm64
            package-suffix: "macOS_ARM64.tar.gz"

    steps:
      - name: Set environment variables
        run: |
          # See: https://docs.github.com/actions/reference/workflows-and-actions/workflow-commands#setting-an-environment-variable
          echo "BUILD_FOLDER=${{ env.PROJECT_NAME }}_osx_${{ matrix.build.folder-suffix }}" >>"$GITHUB_ENV"

      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod

      - name: Download artifacts
        uses: actions/download-artifact@v7
        with:
          name: ${{ env.ARTIFACT_PREFIX }}${{ matrix.build.artifact-suffix }}
          path: ${{ env.DIST_DIR }}

      - name: Import Code-Signing Certificates
        env:
          KEYCHAIN: "sign.keychain"
          INSTALLER_CERT_MAC_PATH: "/tmp/ArduinoCerts2020.p12"
          # Arbitrary password for a keychain that exists only for the duration of the job, so not secret
          KEYCHAIN_PASSWORD: keychainpassword
        run: |
          echo "${{ secrets.INSTALLER_CERT_MAC_P12 }}" | base64 --decode >"${{ env.INSTALLER_CERT_MAC_PATH }}"

          security create-keychain \
            -p "${{ env.KEYCHAIN_PASSWORD }}" \
            "${{ env.KEYCHAIN }}"

          security default-keychain \
            -s "${{ env.KEYCHAIN }}"

          security unlock-keychain \
            -p "${{ env.KEYCHAIN_PASSWORD }}" \
            "${{ env.KEYCHAIN }}"

          security import \
            "${{ env.INSTALLER_CERT_MAC_PATH }}" \
            -k "${{ env.KEYCHAIN }}" \
            -f pkcs12 \
            -A \
            -T /usr/bin/codesign \
            -P '${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}'

          security set-key-partition-list \
            -S apple-tool:,apple: \
            -s \
            -k "${{ env.KEYCHAIN_PASSWORD }}" \
            "${{ env.KEYCHAIN }}"

      - name: Write gon config to file
        # gon does not allow env variables in config file (https://github.com/mitchellh/gon/issues/20)
        run: |
          cat >"${{ env.GON_CONFIG_PATH }}" \
          <<EOF
          # See: https://github.com/Bearer/gon#configuration-file
          source = ["${{ env.DIST_DIR }}/${{ env.BUILD_FOLDER }}/${{ env.PROJECT_NAME }}"]
          bundle_id = "cc.arduino.${{ env.PROJECT_NAME }}"

          sign {}

          # Ask Gon for zip output to force notarization process to take place.
          # The CI will ignore the zip output, using the signed binary only.
          zip {
            output_path = "unused.zip"
          }
          EOF

      - name: Sign and notarize binary
        env:
          AC_APPLICATION_IDENTITY: ${{ vars.AC_APPLICATION_IDENTITY }}
          AC_USERNAME: ${{ secrets.AC_USERNAME }}
          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
          AC_PROVIDER: ${{ vars.AC_PROVIDER }}
        run: |
          go tool \
            github.com/bearer/gon/cmd/gon "${{ env.GON_CONFIG_PATH }}"

      - name: Re-package binary
        working-directory: ${{ env.DIST_DIR }}
        # Repackage the signed binary replaced in place by Gon (ignoring the output zip file)
        run: |
          # GitHub's upload/download-artifact actions don't preserve file permissions,
          # so we need to add execution permission back until the action is made to do this.
          chmod \
            +x \
            "${{ env.BUILD_FOLDER }}/${{ env.PROJECT_NAME }}"

          # Use of an array here is required for globbing
          PACKAGE_FILENAME=(${{ env.PROJECT_NAME }}_nightly-*${{ matrix.build.package-suffix }})

          tar \
            -czvf "$PACKAGE_FILENAME" \
            -C "${{ env.BUILD_FOLDER }}/" \
            "${{ env.PROJECT_NAME }}" \
            -C ../../ \
            LICENSE.txt

          echo "PACKAGE_FILENAME=$PACKAGE_FILENAME" >>$GITHUB_ENV

      - name: Replace artifact with notarized build
        uses: actions/upload-artifact@v6
        with:
          if-no-files-found: error
          name: ${{ env.ARTIFACT_PREFIX }}${{ matrix.build.artifact-suffix }}
          overwrite: true
          path: ${{ env.DIST_DIR }}/${{ env.PACKAGE_FILENAME }}

  checksums:
    needs: notarize-macos
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Set environment variables
        run: |
          # See: https://docs.github.com/actions/reference/workflows-and-actions/workflow-commands#setting-an-environment-variable
          TAG="nightly-$(date -u +"%Y%m%d")"
          echo "CHECKSUM_FILE_PATH=${{ runner.temp }}/${TAG}-checksums.txt" >>"$GITHUB_ENV"
          echo "TAG=$TAG" >>"$GITHUB_ENV"

      - name: Download artifacts
        uses: actions/download-artifact@v7
        with:
          merge-multiple: true
          path: ${{ env.DIST_DIR }}
          pattern: ${{ env.ARTIFACT_PREFIX }}*

      - name: Create checksum file
        working-directory: ${{ env.DIST_DIR }}
        run: |
          sha256sum ${{ env.PROJECT_NAME }}_${{ env.TAG }}* >"${{ env.CHECKSUM_FILE_PATH }}"

      - name: Upload checksum artifact
        uses: actions/upload-artifact@v6
        with:
          if-no-files-found: error
          name: ${{ env.ARTIFACT_PREFIX }}checksums
          path: ${{ env.CHECKSUM_FILE_PATH }}

  publish-nightly:
    runs-on: ubuntu-latest
    environment: production
    needs: checksums
    permissions:
      contents: write
      id-token: write # This is required for requesting the JWT

    steps:
      - name: Determine whether publishing to AWS is possible
        id: aws-determination
        run: |
          echo "publish=${{ secrets.AWS_ROLE_TO_ASSUME != '' }}" >>$GITHUB_OUTPUT

      - name: Download artifact
        if: steps.aws-determination.outputs.publish == 'true'
        uses: actions/download-artifact@v7
        with:
          pattern: ${{ env.ARTIFACT_PREFIX }}*
          merge-multiple: true
          path: ${{ env.DIST_DIR }}

      - name: configure aws credentials
        if: steps.aws-determination.outputs.publish == 'true'
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          role-session-name: "github_${{ env.PROJECT_NAME }}"
          aws-region: ${{ env.AWS_REGION }}

      - name: Upload release files on Arduino downloads servers
        if: steps.aws-determination.outputs.publish == 'true'
        run: |
          aws s3 sync \
            ${{ env.DIST_DIR }} \
            s3://${{ secrets.DOWNLOADS_BUCKET }}${{ env.AWS_PLUGIN_TARGET }}nightly

  report:
    runs-on: ubuntu-latest
    needs: publish-nightly
    if: failure() # Run if publish-nightly or any of its job dependencies failed
    permissions: {}

    steps:
      - name: Report failure
        uses: masci/datadog@v1
        with:
          api-key: ${{ secrets.DD_API_KEY }}
          events: |
            - title: "${{ env.PROJECT_NAME }} nightly build failed"
              text: "Nightly build workflow has failed"
              alert_type: "error"
              host: ${{ github.repository }}
              tags:
                - "project:${{ env.PROJECT_NAME }}"
                - "workflow:${{ github.workflow }}"