bitwarden-android/.github/workflows/build.yml

---
name: Build

on:
  push:
    branches-ignore:
      - 'l10n_master'
      - 'gh-pages'

jobs:
  cloc:
    name: CLOC
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout repo
        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f  # v2.3.4

      - name: Set up CLOC
        run: |
          sudo apt-get update
          sudo apt-get -y install cloc

      - name: Print lines of code
        run: cloc --vcs git --exclude-dir Resources,store,test,Properties --include-lang C#,XAML


  setup:
    name: Setup
    runs-on: ubuntu-20.04
    outputs:
      rc_branch_exists: ${{ steps.branch-check.outputs.rc_branch_exists }}
      release_branch_exists: ${{ steps.branch-check.outputs.release_branch_exists }}
    steps:
      - name: Checkout repo
        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f  # v2.3.4

      - name: Check if special branches exist
        id: branch-check
        run: |
          if [[ $(git ls-remote --heads origin rc) ]]; then
            echo "::set-output name=rc_branch_exists::1"
          else
            echo "::set-output name=rc_branch_exists::0"
          fi

          if [[ $(git ls-remote --heads origin release) ]]; then
            echo "::set-output name=release_branch_exists::1"
          else
            echo "::set-output name=release_branch_exists::0"
          fi
        shell: bash


  android:
    name: Android
    runs-on: windows-2019
    needs: setup
    steps:
      - name: Set up MSBuild
        uses: microsoft/setup-msbuild@c26a08ba26249b81327e26f6ef381897b6a8754d  # v1

      - name: Print environment
        run: |
          nuget help | grep Version
          msbuild -version
          dotnet --info
          echo "GitHub ref: $GITHUB_REF"
          echo "GitHub event: $GITHUB_EVENT"

      - name: Checkout repo
        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f  # v2.3.4

      - name: Decrypt secrets
        env:
          DECRYPT_FILE_PASSWORD: ${{ secrets.DECRYPT_FILE_PASSWORD }}
        run: |
          mkdir -p ~/secrets

          gpg --quiet --batch --yes --decrypt --passphrase="$DECRYPT_FILE_PASSWORD" \
            --output ./src/Android/app_play-keystore.jks ./.github/secrets/app_play-keystore.jks.gpg
          gpg --quiet --batch --yes --decrypt --passphrase="$DECRYPT_FILE_PASSWORD" \
            --output ./src/Android/app_upload-keystore.jks ./.github/secrets/app_upload-keystore.jks.gpg
          gpg --quiet --batch --yes --decrypt --passphrase="$DECRYPT_FILE_PASSWORD" \
            --output ./src/Android/google-services.json ./.github/secrets/google-services.json.gpg
          gpg --quiet --batch --yes --decrypt --passphrase="$DECRYPT_FILE_PASSWORD" \
            --output $HOME/secrets/play_creds.json ./.github/secrets/play_creds.json.gpg
        shell: bash

      - name: Increment version
        run: |
          BUILD_NUMBER=$((3000 + $GITHUB_RUN_NUMBER))

          echo "########################################"
          echo "##### Setting Version Code $BUILD_NUMBER"
          echo "########################################"

          sed -i "s/android:versionCode=\"1\"/android:versionCode=\"$BUILD_NUMBER\"/" \
            ./src/Android/Properties/AndroidManifest.xml
        shell: bash

      - name: Restore packages
        run: nuget restore

      - name: Run Core tests
        run: dotnet test test/Core.Test/Core.Test.csproj

      - name: Build Play Store publisher
        run: dotnet build ./store/google/Publisher/Publisher.csproj -p:Configuration=Release

      - name: Build for Play Store
        run: |
          $configuration = "Release";

          Write-Output "########################################"
          Write-Output "##### Build $configuration Configuration"
          Write-Output "########################################"

          msbuild "$($env:GITHUB_WORKSPACE + "/src/Android/Android.csproj")" "/p:Configuration=$configuration"
        shell: pwsh

      - name: Sign for Play Store
        env:
          PLAY_KEYSTORE_PASSWORD: ${{ secrets.PLAY_KEYSTORE_PASSWORD }}
          UPLOAD_KEYSTORE_PASSWORD: ${{ secrets.UPLOAD_KEYSTORE_PASSWORD }}
        run: |
          $androidPath = $($env:GITHUB_WORKSPACE + "/src/Android/Android.csproj");

          Write-Output "########################################"
          Write-Output "##### Sign Google Play Bundle Release Configuration"
          Write-Output "########################################"

          msbuild "$($androidPath)" "/t:SignAndroidPackage" "/p:Configuration=Release" "/p:AndroidKeyStore=true" `
              "/p:AndroidSigningKeyAlias=upload" "/p:AndroidSigningKeyPass=$($env:UPLOAD_KEYSTORE_PASSWORD)" `
              "/p:AndroidSigningKeyStore=$("app_upload-keystore.jks")" `
              "/p:AndroidSigningStorePass=$($env:UPLOAD_KEYSTORE_PASSWORD)" "/p:AndroidPackageFormat=aab" "/v:quiet"

          Write-Output "########################################"
          Write-Output "##### Copy Google Play Bundle to project root"
          Write-Output "########################################"

          $signedAabPath = $($env:GITHUB_WORKSPACE + "/src/Android/bin/Release/com.x8bit.bitwarden-Signed.aab");
          $signedAabDestPath = $($env:GITHUB_WORKSPACE + "/com.x8bit.bitwarden.aab");

          Copy-Item $signedAabPath $signedAabDestPath

          Write-Output "########################################"
          Write-Output "##### Sign APK Release Configuration"
          Write-Output "########################################"

          msbuild "$($androidPath)" "/t:SignAndroidPackage" "/p:Configuration=Release" "/p:AndroidKeyStore=true" `
              "/p:AndroidSigningKeyAlias=bitwarden" "/p:AndroidSigningKeyPass=$($env:PLAY_KEYSTORE_PASSWORD)" `
              "/p:AndroidSigningKeyStore=$("app_play-keystore.jks")" `
              "/p:AndroidSigningStorePass=$($env:PLAY_KEYSTORE_PASSWORD)" "/v:quiet"

          Write-Output "########################################"
          Write-Output "##### Copy Release APK to project root"
          Write-Output "########################################"

          $signedApkPath = $($env:GITHUB_WORKSPACE + "/src/Android/bin/Release/com.x8bit.bitwarden-Signed.apk");
          $signedApkDestPath = $($env:GITHUB_WORKSPACE + "/com.x8bit.bitwarden.apk");

          Copy-Item $signedApkPath $signedApkDestPath
        shell: pwsh

      - name: Upload Play Store .aab artifact
        uses: actions/upload-artifact@ee69f02b3dfdecd58bb31b4d133da38ba6fe3700  # v2.2.4
        with:
          name: com.x8bit.bitwarden.aab
          path: ./com.x8bit.bitwarden.aab
          if-no-files-found: error

      - name: Upload Play Store .apk artifact
        uses: actions/upload-artifact@ee69f02b3dfdecd58bb31b4d133da38ba6fe3700  # v2.2.4
        with:
          name: com.x8bit.bitwarden.apk
          path: ./com.x8bit.bitwarden.apk
          if-no-files-found: error

      - name: Deploy to Play Store
        if: |
            (github.ref == 'refs/heads/master'
              && needs.setup.outputs.rc_branch_exists == 0
              && needs.setup.outputs.release_branch_exists == 0)
            || (github.ref == 'refs/heads/rc' && needs.setup.outputs.release_branch_exists == 0)
            || github.ref == 'refs/heads/release'
        run: |
          PUBLISHER_PATH="$GITHUB_WORKSPACE/store/google/Publisher/bin/Release/netcoreapp2.0/Publisher.dll"
          CREDS_PATH="$HOME/secrets/play_creds.json"
          AAB_PATH="$GITHUB_WORKSPACE/com.x8bit.bitwarden.aab"
          TRACK="internal"

          dotnet $PUBLISHER_PATH $CREDS_PATH $AAB_PATH $TRACK
        shell: bash


  f-droid:
    name: F-Droid Build
    runs-on: windows-2019
    steps:
      - name: Set up MSBuild
        uses: microsoft/setup-msbuild@c26a08ba26249b81327e26f6ef381897b6a8754d  # v1

      - name: Print environment
        run: |
          nuget help | grep Version
          msbuild -version
          dotnet --info
          echo "GitHub ref: $GITHUB_REF"
          echo "GitHub event: $GITHUB_EVENT"

      - name: Checkout repo
        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f  # v2.3.4

      - name: Decrypt secrets
        env:
          DECRYPT_FILE_PASSWORD: ${{ secrets.DECRYPT_FILE_PASSWORD }}
        run: |
          mkdir -p ~/secrets

          gpg --quiet --batch --yes --decrypt --passphrase="$DECRYPT_FILE_PASSWORD" \
            --output ./src/Android/app_fdroid-keystore.jks ./.github/secrets/app_fdroid-keystore.jks.gpg
        shell: bash

      - name: Increment version
        run: |
          BUILD_NUMBER=$((3000 + $GITHUB_RUN_NUMBER))

          echo "########################################"
          echo "##### Setting Version Code $BUILD_NUMBER"
          echo "########################################"

          sed "s/android:versionCode=\"1\"/android:versionCode=\"$BUILD_NUMBER\"/" \
            ./src/Android/Properties/AndroidManifest.xml
        shell: bash

      - name: Clean for F-Droid
        run: |
          $androidPath = $($env:GITHUB_WORKSPACE + "/src/Android/Android.csproj");
          $appPath = $($env:GITHUB_WORKSPACE + "/src/App/App.csproj");

          $androidManifest = $($env:GITHUB_WORKSPACE + "/src/Android/Properties/AndroidManifest.xml");

          Write-Output "########################################"
          Write-Output "##### Clean Android and App"
          Write-Output "########################################"

          msbuild "$($androidPath)" "/t:Clean" "/p:Configuration=FDroid"
          msbuild "$($appPath)" "/t:Clean" "/p:Configuration=FDroid"

          Write-Output "########################################"
          Write-Output "##### Backup project files"
          Write-Output "########################################"

          Copy-Item $androidManifest $($androidManifest + ".original");
          Copy-Item $androidPath $($androidPath + ".original");
          Copy-Item $appPath $($appPath + ".original");

          Write-Output "########################################"
          Write-Output "##### Cleanup Android Manifest"
          Write-Output "########################################"

          $xml=New-Object XML;
          $xml.Load($androidManifest);

          $nsAndroid=New-Object System.Xml.XmlNamespaceManager($xml.NameTable);
          $nsAndroid.AddNamespace("android", "http://schemas.android.com/apk/res/android");

          $xml.Save($androidManifest);

          Write-Output "########################################"
          Write-Output "##### Uninstall from Android.csproj"
          Write-Output "########################################"

          $xml=New-Object XML;
          $xml.Load($androidPath);

          $ns=New-Object System.Xml.XmlNamespaceManager($xml.NameTable);
          $ns.AddNamespace("ns", $xml.DocumentElement.NamespaceURI);

          $firebaseNode=$xml.SelectSingleNode(`
              "/ns:Project/ns:ItemGroup/ns:PackageReference[@Include='Xamarin.Firebase.Messaging']", $ns);
          $firebaseNode.ParentNode.RemoveChild($firebaseNode);

          $daggerNode=$xml.SelectSingleNode(`
              "/ns:Project/ns:ItemGroup/ns:PackageReference[@Include='Xamarin.Google.Dagger']", $ns);
          $daggerNode.ParentNode.RemoveChild($daggerNode);

          $safetyNetNode=$xml.SelectSingleNode(`
              "/ns:Project/ns:ItemGroup/ns:PackageReference[@Include='Xamarin.GooglePlayServices.SafetyNet']", $ns);
          $safetyNetNode.ParentNode.RemoveChild($safetyNetNode);

          $xml.Save($androidPath);

          Write-Output "########################################"
          Write-Output "##### Uninstall from App.csproj"
          Write-Output "########################################"

          $xml=New-Object XML;
          $xml.Load($appPath);

          $appCenterNode=$xml.SelectSingleNode("/Project/ItemGroup/PackageReference[@Include='Microsoft.AppCenter.Crashes']");
          $appCenterNode.ParentNode.RemoveChild($appCenterNode);

          $xml.Save($appPath);
        shell: pwsh

      - name: Restore packages
        run: nuget restore

      - name: Build for F-Droid
        run: |
          $configuration = "FDroid";

          Write-Output "########################################"
          Write-Output "##### Build $configuration Configuration"
          Write-Output "########################################"

          msbuild "$($env:GITHUB_WORKSPACE + "/src/Android/Android.csproj")" "/p:Configuration=$configuration"
        shell: pwsh

      - name: Sign for F-Droid
        env:
          FDROID_KEYSTORE_PASSWORD: ${{ secrets.FDROID_KEYSTORE_PASSWORD }}
        run: |
          Write-Output "########################################"
          Write-Output "##### Sign FDroid Configuration"
          Write-Output "########################################"

          msbuild "$($env:GITHUB_WORKSPACE + "/src/Android/Android.csproj")" `
            "/t:SignAndroidPackage" "/p:Configuration=FDroid" "/p:AndroidKeyStore=true" `
            "/p:AndroidSigningKeyAlias=bitwarden" "/p:AndroidSigningKeyPass=$($env:FDROID_KEYSTORE_PASSWORD)" `
            "/p:AndroidSigningKeyStore=$("app_fdroid-keystore.jks")" `
            "/p:AndroidSigningStorePass=$($env:FDROID_KEYSTORE_PASSWORD)" "/v:quiet"

          Write-Output "########################################"
          Write-Output "##### Copy FDroid apk to project root"
          Write-Output "########################################"

          $signedApkPath = $($env:GITHUB_WORKSPACE + "/src/Android/bin/FDroid/com.x8bit.bitwarden-Signed.apk");
          $signedApkDestPath = $($env:GITHUB_WORKSPACE + "/com.x8bit.bitwarden-fdroid.apk");

          Copy-Item $signedApkPath $signedApkDestPath
        shell: pwsh

      - name: Upload F-Droid .apk artifact
        uses: actions/upload-artifact@ee69f02b3dfdecd58bb31b4d133da38ba6fe3700  # v2.2.4
        with:
          name: com.x8bit.bitwarden-fdroid.apk
          path: ./com.x8bit.bitwarden-fdroid.apk
          if-no-files-found: error


  ios:
    name: Apple iOS
    runs-on: macos-11
    needs: setup
    steps:
      - name: Print environment
        run: |
          nuget help | grep Version
          msbuild -version
          dotnet --info
          echo "GitHub ref: $GITHUB_REF"
          echo "GitHub event: $GITHUB_EVENT"

      - name: Checkout repo
        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f  # v2.3.4

      - name: Decrypt secrets
        env:
          DECRYPT_FILE_PASSWORD: ${{ secrets.DECRYPT_FILE_PASSWORD }}
        run: |
          mkdir -p ~/secrets

          gpg --quiet --batch --yes --decrypt --passphrase="$DECRYPT_FILE_PASSWORD" \
            --output $HOME/secrets/bitwarden-mobile-key.p12 ./.github/secrets/bitwarden-mobile-key.p12.gpg
          gpg --quiet --batch --yes --decrypt --passphrase="$DECRYPT_FILE_PASSWORD" \
            --output $HOME/secrets/iphone-distribution-cert.p12 ./.github/secrets/iphone-distribution-cert.p12.gpg
          gpg --quiet --batch --yes --decrypt --passphrase="$DECRYPT_FILE_PASSWORD" \
            --output $HOME/secrets/dist_autofill.mobileprovision ./.github/secrets/dist_autofill.mobileprovision.gpg
          gpg --quiet --batch --yes --decrypt --passphrase="$DECRYPT_FILE_PASSWORD" \
            --output $HOME/secrets/dist_bitwarden.mobileprovision ./.github/secrets/dist_bitwarden.mobileprovision.gpg
          gpg --quiet --batch --yes --decrypt --passphrase="$DECRYPT_FILE_PASSWORD" \
            --output $HOME/secrets/dist_extension.mobileprovision ./.github/secrets/dist_extension.mobileprovision.gpg
        shell: bash

      - name: Increment version
        run: |
          BUILD_NUMBER=$((100 + $GITHUB_RUN_NUMBER))

          echo "########################################"
          echo "##### Setting CFBundleVersion $BUILD_NUMBER"
          echo "########################################"

          perl -0777 -pi.bak -e 's/<key>CFBundleVersion<\/key>\s*<string>1<\/string>/<key>CFBundleVersion<\/key>\n\t<string>'"$BUILD_NUMBER"'<\/string>/' ./src/iOS/Info.plist
          perl -0777 -pi.bak -e 's/<key>CFBundleVersion<\/key>\s*<string>1<\/string>/<key>CFBundleVersion<\/key>\n\t<string>'"$BUILD_NUMBER"'<\/string>/' ./src/iOS.Extension/Info.plist
          perl -0777 -pi.bak -e 's/<key>CFBundleVersion<\/key>\s*<string>1<\/string>/<key>CFBundleVersion<\/key>\n\t<string>'"$BUILD_NUMBER"'<\/string>/' ./src/iOS.Autofill/Info.plist
        shell: bash

      - name: Set up Keychain
        env:
          KEYCHAIN_PASSWORD: ${{ secrets.IOS_KEYCHAIN_PASSWORD }}
          MOBILE_KEY_PASSWORD: ${{ secrets.IOS_KEY_PASSWORD }}
          DIST_CERT_PASSWORD: ${{ secrets.IOS_DIST_CERT_PASSWORD }}
        run: |
          security create-keychain -p $KEYCHAIN_PASSWORD build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p $KEYCHAIN_PASSWORD build.keychain
          security set-keychain-settings -lut 1200 build.keychain
          security import ~/secrets/bitwarden-mobile-key.p12 -k build.keychain -P $MOBILE_KEY_PASSWORD \
            -T /usr/bin/codesign -T /usr/bin/security
          security import ~/secrets/iphone-distribution-cert.p12 -k build.keychain -P $DIST_CERT_PASSWORD \
            -T /usr/bin/codesign -T /usr/bin/security
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $KEYCHAIN_PASSWORD build.keychain
        shell: bash

      - name: Set up provisioning profiles
        run: |
          AUTOFILL_PROFILE_PATH=$HOME/secrets/dist_autofill.mobileprovision
          BITWARDEN_PROFILE_PATH=$HOME/secrets/dist_bitwarden.mobileprovision
          EXTENSION_PROFILE_PATH=$HOME/secrets/dist_extension.mobileprovision
          PROFILES_DIR_PATH=$HOME/Library/MobileDevice/Provisioning\ Profiles

          mkdir -p "$PROFILES_DIR_PATH"

          AUTOFILL_UUID=$(grep UUID -A1 -a $AUTOFILL_PROFILE_PATH | grep -io "[-A-F0-9]\{36\}")
          cp $AUTOFILL_PROFILE_PATH "$PROFILES_DIR_PATH/$AUTOFILL_UUID.mobileprovision"

          BITWARDEN_UUID=$(grep UUID -A1 -a $BITWARDEN_PROFILE_PATH | grep -io "[-A-F0-9]\{36\}")
          cp $BITWARDEN_PROFILE_PATH "$PROFILES_DIR_PATH/$BITWARDEN_UUID.mobileprovision"

          EXTENSION_UUID=$(grep UUID -A1 -a $EXTENSION_PROFILE_PATH | grep -io "[-A-F0-9]\{36\}")
          cp $EXTENSION_PROFILE_PATH "$PROFILES_DIR_PATH/$EXTENSION_UUID.mobileprovision"
        shell: bash

      - name: Restore packages
        run: nuget restore

      - name: Archive Build for App Store
        run: |
          $configuration = "AppStore";
          $platform = "iPhone";

          Write-Output "########################################"
          Write-Output "##### Archive $configuration Configuration for $platform Platform"
          Write-Output "########################################"
          msbuild "$($env:GITHUB_WORKSPACE + "/src/iOS/iOS.csproj")" "/p:Platform=$platform" `
            "/p:Configuration=$configuration" "/p:ArchiveOnBuild=true" "/t:`"Build`""

          Write-Output "########################################"
          Write-Output "##### Done"
          Write-Output "########################################"
          ls ~/Library/Developer/Xcode/Archives
        shell: pwsh

      - name: Export .ipa for App Store
        run: |
          EXPORT_OPTIONS_PATH="./.github/resources/export-options-app-store.plist"
          ARCHIVE_PATH="$HOME/Library/Developer/Xcode/Archives/*/*.xcarchive"
          EXPORT_PATH="./bitwarden-export"

          xcodebuild -exportArchive -archivePath $ARCHIVE_PATH -exportPath $EXPORT_PATH \
            -exportOptionsPlist $EXPORT_OPTIONS_PATH
        shell: bash

      - name: Upload App Store .ipa artifact
        uses: actions/upload-artifact@ee69f02b3dfdecd58bb31b4d133da38ba6fe3700  # v2.2.4
        with:
          name: Bitwarden.ipa
          path: ./bitwarden-export/Bitwarden.ipa
          if-no-files-found: error

      - name: Deploy to App Store
        if: |
            (github.ref == 'refs/heads/master'
              && needs.setup.outputs.rc_branch_exists == 0
              && needs.setup.outputs.release_branch_exists == 0)
            || (github.ref == 'refs/heads/rc' && needs.setup.outputs.release_branch_exists == 0)
            || github.ref == 'refs/heads/release'
        env:
          APPLE_ID_USERNAME: ${{ secrets.APPLE_ID_USERNAME }}
          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
        run: |
          xcrun altool --upload-app --type ios --file "./bitwarden-export/Bitwarden.ipa" \
              --username "$APPLE_ID_USERNAME" --password "$APPLE_ID_PASSWORD"
        shell: bash


  check-failures:
    name: Check for failures
    if: always()
    runs-on: ubuntu-20.04
    needs:
      - cloc
      - android
      - f-droid
      - ios
    steps:
      - name: Check if any job failed
        if: ${{ (github.ref == 'refs/heads/master') || (github.ref == 'refs/heads/rc') }}
        env:
          CLOC_STATUS: ${{ needs.cloc.result }}
          ANDROID_STATUS: ${{ needs.android.result }}
          F_DROID_STATUS: ${{ needs.f-droid.result }}
          IOS_STATUS: ${{ needs.ios.result }}
        run: |
          if [ "$CLOC_STATUS" = "failure" ]; then
              exit 1
          elif [ "$ANDROID_STATUS" = "failure" ]; then
              exit 1
          elif [ "$F_DROID_STATUS" = "failure" ]; then
              exit 1
          elif [ "$IOS_STATUS" = "failure" ]; then
              exit 1
          fi

      - name: Login to Azure - Prod Subscription
        uses: Azure/login@77f1b2e3fb80c0e8645114159d17008b8a2e475a
        if: failure()
        with:
          creds: ${{ secrets.AZURE_PROD_KV_CREDENTIALS }}

      - name: Retrieve secrets
        id: retrieve-secrets
        uses: Azure/get-keyvault-secrets@80ccd3fafe5662407cc2e55f202ee34bfff8c403
        if: failure()
        with:
          keyvault: "bitwarden-prod-kv"
          secrets: "devops-alerts-slack-webhook-url"

      - name: Notify Slack on failure
        uses: act10ns/slack@e4e71685b9b239384b0f676a63c32367f59c2522  # v1.2.2
        if: failure()
        env:
          SLACK_WEBHOOK_URL: ${{ steps.retrieve-secrets.outputs.devops-alerts-slack-webhook-url }}
        with:
          status: ${{ job.status }}