platformDeploy.yml

name: Build and deploy android, desktop, iOS, and web clients

# This workflow is run when any tag is published
on:
  push:
    tags:
      - '*'
  release:
    types: [created]

env:
  SHOULD_DEPLOY_PRODUCTION: ${{ github.event_name == 'release' }}
  DEVELOPER_DIR: /Applications/Xcode_12.5.1.app/Contents/Developer

jobs:
  validateActor:
    runs-on: ubuntu-latest
    outputs:
      IS_DEPLOYER: ${{ fromJSON(steps.isUserDeployer.outputs.isTeamMember) || github.actor == 'OSBotify' }}
    steps:
      - id: isUserDeployer
        uses: tspascoal/get-user-teams-membership@baf2e6adf4c3b897bd65a7e3184305c165aec872
        with:
          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
          username: ${{ github.actor }}
          team: mobile-deployers

  android:
    name: Build and deploy Android
    needs: validateActor
    if: ${{ fromJSON(needs.validateActor.outputs.IS_DEPLOYER) }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2

      - uses: actions/setup-ruby@v1
        with:
          ruby-version: '2.7'

      - uses: actions/cache@v2
        with:
          path: vendor/bundle
          key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}

      - name: Install bundler
        run: |
          bundle config path vendor/bundle
          gem install bundler

      - name: Install gems
        run: bundle install

      - name: Cache node modules
        uses: actions/cache@v2
        env:
          cache-name: cache-node-modules
        with:
          # npm cache files are stored in `~/.npm` on Linux/macOS
          path: ~/.npm
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}

      - name: Install node packages
        uses: nick-invision/retry@7c68161adf97a48beb850a595b8784ec57a98cbb
        with:
          timeout_minutes: 10
          max_attempts: 5
          command: npm ci

      - name: Decrypt keystore
        run: cd android/app && gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" --output my-upload-key.keystore my-upload-key.keystore.gpg
        env:
          LARGE_SECRET_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}

      - name: Decrypt json key
        run: cd android/app && gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" --output android-fastlane-json-key.json android-fastlane-json-key.json.gpg
        env:
          LARGE_SECRET_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}

      - name: Set version in ENV
        run: echo "VERSION_CODE=$(grep -o 'versionCode\s\+[0-9]\+' android/app/build.gradle | awk '{ print $2 }')" >> $GITHUB_ENV

      - name: Run Fastlane beta
        if: ${{ !fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
        run: bundle exec fastlane android beta

      - name: Run Fastlane production
        if: ${{ fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
        run: bundle exec fastlane android production
        env:
          VERSION: ${{ env.VERSION_CODE }}

      - name: Warn deployers if Android production deploy failed
        if: ${{ failure() && fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
        uses: 8398a7/action-slack@v3
        with:
          status: custom
          custom_payload: |
            {
              channel: '#deployer',
              attachments: [{
                color: "#DB4545",
                pretext: `<!subteam^S4TJJ3PSL>`,
                text: `💥 Android production deploy failed. Please manually submit ${{ github.event.release.tag_name }} in the <https://play.google.com/console/u/0/developers/8765590895836334604/app/4973041797096886180/releases/overview|Google Play Store>. 💥`,
              }]
            }
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

  desktop:
    name: Build and deploy Desktop
    needs: validateActor
    if: ${{ fromJSON(needs.validateActor.outputs.IS_DEPLOYER) }}
    runs-on: macos-11
    steps:
      - uses: actions/checkout@v2

      - name: Setup Node
        uses: actions/setup-node@v1
        with:
          node-version: '14.x'

      - name: Cache node modules
        uses: actions/cache@v2
        env:
          cache-name: cache-node-modules
        with:
          # npm cache files are stored in `~/.npm` on Linux/macOS
          path: ~/.npm
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}

      - name: Install node packages
        uses: nick-invision/retry@7c68161adf97a48beb850a595b8784ec57a98cbb
        with:
          timeout_minutes: 10
          max_attempts: 5
          command: npm ci

      - name: Decrypt Developer ID Certificate
        run: cd desktop && gpg --quiet --batch --yes --decrypt --passphrase="$DEVELOPER_ID_SECRET_PASSPHRASE" --output developer_id.p12 developer_id.p12.gpg
        env:
          DEVELOPER_ID_SECRET_PASSPHRASE: ${{ secrets.DEVELOPER_ID_SECRET_PASSPHRASE }}

      - name: Build production desktop app
        if: ${{ fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
        run: npm run desktop-build -- --publish always -c.afterSign=desktop/notarize.js
        env:
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

      - name: Build staging desktop app
        if: ${{ !fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
        run: npm run desktop-build-staging -- --publish always -c.afterSign=desktop/notarize.js
        env:
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

  iOS:
    name: Build and deploy iOS
    needs: validateActor
    if: ${{ fromJSON(needs.validateActor.outputs.IS_DEPLOYER) }}
    runs-on: macos-11
    steps:
      - uses: actions/checkout@v2

      - name: Setup Node
        uses: actions/setup-node@v1
        with:
          node-version: '14.x'

      - uses: actions/setup-ruby@v1
        with:
          ruby-version: '2.7'

      - uses: actions/cache@v2
        with:
          path: vendor/bundle
          key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}

      - name: Install bundler
        run: |
          bundle config path vendor/bundle
          gem install bundler

      - name: Install gems
        run: bundle install

      - name: Cache node modules
        uses: actions/cache@v2
        env:
          cache-name: cache-node-modules
        with:
          # npm cache files are stored in `~/.npm` on Linux/macOS
          path: ~/.npm
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}

      - name: Install node packages
        uses: nick-invision/retry@7c68161adf97a48beb850a595b8784ec57a98cbb
        with:
          timeout_minutes: 10
          max_attempts: 5
          command: npm ci

      - uses: actions/cache@v2
        with:
          path: ios/Pods
          key: ${{ runner.os }}-pods-${{ hashFiles('**/Podfile.lock') }}

      - name: Install cocoapods
        run: cd ios && pod install

      - name: Decrypt profile
        run: cd ios && gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" --output chat_expensify_appstore.mobileprovision chat_expensify_appstore.mobileprovision.gpg
        env:
          LARGE_SECRET_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}

      - name: Decrypt certificate
        run: cd ios && gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" --output Certificates.p12 Certificates.p12.gpg
        env:
          LARGE_SECRET_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}

      - name: Decrypt App Store Connect API key
        run: cd ios && gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" --output ios-fastlane-json-key.json ios-fastlane-json-key.json.gpg
        env:
          LARGE_SECRET_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}

      - name: Run Fastlane
        if: ${{ !fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
        run: bundle exec fastlane ios beta
        env:
          APPLE_CONTACT_EMAIL: ${{ secrets.APPLE_CONTACT_EMAIL }}
          APPLE_CONTACT_PHONE: ${{ secrets.APPLE_CONTACT_PHONE }}
          APPLE_DEMO_EMAIL: ${{ secrets.APPLE_DEMO_EMAIL }}
          APPLE_DEMO_PASSWORD: ${{ secrets.APPLE_DEMO_PASSWORD }}

      - name: Set iOS version in ENV
        if: ${{ fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
        run: echo "IOS_VERSION=$(echo '${{ github.event.release.tag_name }}' | tr '-' '.')" >> $GITHUB_ENV

      - name: Run Fastlane for App Store release
        if: ${{ fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
        run: bundle exec fastlane ios production
        env:
          VERSION: ${{ env.IOS_VERSION }}

      - name: Warn deployers if iOS production deploy failed
        if: ${{ failure() && fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
        uses: 8398a7/action-slack@v3
        with:
          status: custom
          custom_payload: |
            {
              channel: '#deployer',
              attachments: [{
                color: "#DB4545",
                pretext: `<!subteam^S4TJJ3PSL>`,
                text: `💥 iOS production deploy failed. Please manually submit ${{ env.IOS_VERSION }} in the <https://appstoreconnect.apple.com/apps/1530278510/appstore|App Store>. 💥`,
              }]
            }
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

  web:
    name: Build and deploy Web
    needs: validateActor
    if: ${{ fromJSON(needs.validateActor.outputs.IS_DEPLOYER) }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2

      - name: Setup Node
        uses: actions/setup-node@v1
        with:
          node-version: '14.x'

      - name: Setup python
        run: sudo apt-get install python3-setuptools

      - name: Setup Cloudflare CLI
        run: |
          # Pip 21 doesn't support python 3.5, so use the version before it
          sudo python3 -m pip install --upgrade pip==20.3.4
          pip3 install wheel # need wheel before cloudflare, this is the only way to ensure order.
          pip3 install cloudflare

      - name: Configure AWS Credentials
        # Version: 1.5.5
        uses: aws-actions/configure-aws-credentials@e97d7fbc8e0e5af69631c13daa0f4b5a8d88165b
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Cache node modules
        uses: actions/cache@v2
        env:
          cache-name: cache-node-modules
        with:
          # npm cache files are stored in `~/.npm` on Linux/macOS
          path: ~/.npm
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}

      - name: Install node packages
        uses: nick-invision/retry@7c68161adf97a48beb850a595b8784ec57a98cbb
        with:
          timeout_minutes: 10
          max_attempts: 5
          command: npm ci

      - name: Build web for production
        if: ${{ fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
        run: npm run build

      - name: Build web for staging
        if: ${{ !fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
        run: npm run build-staging

      - name: Build docs
        run: npm run storybook-build

      - name: Deploy production to S3
        if: ${{ fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
        run: aws s3 cp --recursive --acl public-read $GITHUB_WORKSPACE/dist s3://expensify-cash/

      - name: Deploy staging to S3
        if: ${{ !fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
        run: aws s3 cp --recursive --acl public-read $GITHUB_WORKSPACE/dist s3://staging-expensify-cash/

      - name: Purge production Cloudflare cache
        if: ${{ fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
        run: /home/runner/.local/bin/cli4 --delete hosts=["new.expensify.com"] /zones/:9ee042e6cfc7fd45e74aa7d2f78d617b/purge_cache
        env:
          CF_API_KEY: ${{ secrets.CLOUDFLARE_TOKEN }}

      - name: Purge staging Cloudflare cache
        if: ${{ !fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
        run: /home/runner/.local/bin/cli4 --delete hosts=["staging.new.expensify.com"] /zones/:9ee042e6cfc7fd45e74aa7d2f78d617b/purge_cache
        env:
          CF_API_KEY: ${{ secrets.CLOUDFLARE_TOKEN }}

  postSlackMessage:
    name: Post a Slack message when any platform fails to build or deploy
    runs-on: ubuntu-latest
    if: ${{ failure() }}
    needs: [android, desktop, iOS, web]
    steps:
      - uses: 8398a7/action-slack@v3
        name: Job failed Slack notification
        with:
          status: custom
          fields: workflow, repo
          custom_payload: |
            {
              channel: '#announce',
              attachments: [{
                color: "#DB4545",
                pretext: `<!subteam^S4TJJ3PSL>`,
                text: `💥 ${process.env.AS_REPO} failed on ${process.env.AS_WORKFLOW} workflow 💥`,
              }]
            }
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

  postGithubComment:
    name: Post a GitHub comment when platforms are done building and deploying
    runs-on: ubuntu-latest
    if: ${{ always() }}
    needs: [android, desktop, iOS, web]
    steps:
      - uses: actions/checkout@v2
        with:
          fetch-depth: 0

      - name: Setup Node
        uses: actions/setup-node@v1
        with:
          node-version: '14.x'

      - name: Set version
        run: echo "VERSION=$(npm run print-version --silent)" >> $GITHUB_ENV

      - name: Get Release Pull Request List
        id: getReleasePRList
        uses: Expensify/App/.github/actions/getDeployPullRequestList@main
        with:
          TAG: ${{ env.VERSION }}
          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
          IS_PRODUCTION_DEPLOY: ${{ fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}

      - name: Comment on issues
        uses: Expensify/App/.github/actions/markPullRequestsAsDeployed@main
        with:
          PR_LIST: ${{ steps.getReleasePRList.outputs.PR_LIST }}
          IS_PRODUCTION_DEPLOY: ${{ fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
          DEPLOY_VERSION: ${{ env.VERSION }}
          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
          ANDROID: ${{ needs.android.result }}
          DESKTOP: ${{ needs.desktop.result }}
          IOS: ${{ needs.iOS.result }}
          WEB: ${{ needs.web.result }}

      - name: 'Announces the deploy in the #announce Slack room'
        if: ${{ success() }}
        uses: 8398a7/action-slack@v3
        with:
          status: custom
          custom_payload: |
            {
              channel: '#announce',
              attachments: [{
                color: 'good',
                text: `🎉️ Successfully deployed ${process.env.AS_REPO} v${{ env.VERSION }} to ${{ fromJSON(env.SHOULD_DEPLOY_PRODUCTION) && 'production' || 'staging' }} 🎉️`,
              }]
            }
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

      - name: 'Announces the deploy in the #deployer Slack room'
        if: ${{ success() }}
        uses: 8398a7/action-slack@v3
        with:
          status: custom
          custom_payload: |
            {
              channel: '#deployer',
              attachments: [{
                color: 'good',
                text: `🎉️ Successfully deployed ${process.env.AS_REPO} v${{ env.VERSION }} to ${{ fromJSON(env.SHOULD_DEPLOY_PRODUCTION) && 'production' || 'staging' }} 🎉️`,
              }]
            }
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

      - name: 'Announces a production deploy in the #expensify-open-source Slack room'
        uses: 8398a7/action-slack@v3
        if: ${{ success() && fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
        with:
          status: custom
          custom_payload: |
            {
              channel: '#expensify-open-source',
              attachments: [{
                color: 'good',
                text: `🎉️ Successfully deployed ${process.env.AS_REPO} v${{ env.VERSION }} to production 🎉️`,
              }]
            }
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}