diff --git a/.github/workflows/build_enterprise.yml b/.github/workflows/build_enterprise.yml index c176864b46c..c760647f0a3 100644 --- a/.github/workflows/build_enterprise.yml +++ b/.github/workflows/build_enterprise.yml @@ -2,7 +2,9 @@ name: Enterprise APK Build on: workflow_dispatch: - pull_request: + workflow_run: + workflows: ["APK Build"] + types: [completed] merge_group: push: branches: [ develop ] @@ -15,18 +17,31 @@ env: CI_GRADLE_ARG_PROPERTIES: --stacktrace -Dsonar.gradle.skipCompile=true --no-configuration-cache jobs: + check-secret: + name: Check Enterprise Deploy Key + runs-on: ubuntu-latest + outputs: + has_key: ${{ steps.check.outputs.has_key }} + steps: + - id: check + run: echo "has_key=${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}" >> $GITHUB_OUTPUT build: name: Build Enterprise APKs runs-on: ubuntu-latest - # Skip in forks - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }} + needs: check-secret + # Skip if the enterprise deploy key is not set, or if triggered via workflow_run but not from a PR or a failed run + if: > + needs.check-secret.outputs.has_key == 'true' && + (github.event_name != 'workflow_run' || + (github.event.workflow_run.conclusion == 'success' && + github.event.workflow_run.event == 'pull_request')) strategy: matrix: variant: [debug, release, nightly] fail-fast: false # Allow all jobs on develop. Just one per PR. concurrency: - group: ${{ github.ref == 'refs/heads/develop' && format('build-develop-enterprise-{0}-{1}', matrix.variant, github.sha) || format('build-enterprise-{0}-{1}', matrix.variant, github.ref) }} + group: ${{ github.ref == 'refs/heads/develop' && format('build-develop-enterprise-{0}-{1}', matrix.variant, github.sha) || github.event_name == 'workflow_run' && format('build-enterprise-{0}-{1}', matrix.variant, github.event.workflow_run.head_sha) || format('build-enterprise-{0}-{1}', matrix.variant, github.ref) }} cancel-in-progress: true steps: - name: Free Disk Space (Ubuntu) @@ -47,7 +62,7 @@ jobs: with: # Ensure we are building the branch and not the branch after being merged on develop # https://github.com/actions/checkout/issues/881 - ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }} + ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.ref }} persist-credentials: false - name: Add SSH private keys for submodule repositories uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 diff --git a/.github/workflows/danger.yml b/.github/workflows/danger.yml index a8bf7b623a3..394febca5f5 100644 --- a/.github/workflows/danger.yml +++ b/.github/workflows/danger.yml @@ -5,9 +5,18 @@ on: [pull_request, merge_group] permissions: {} jobs: + check-secret: + name: Check Enterprise Deploy Key + runs-on: ubuntu-latest + outputs: + has_key: ${{ steps.check.outputs.has_key }} + steps: + - id: check + run: echo "has_key=${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}" >> $GITHUB_OUTPUT build: runs-on: ubuntu-latest name: Danger main check + needs: check-secret # Skip in forks, it doesn't work even with the fallback token if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }} steps: @@ -15,11 +24,12 @@ jobs: with: persist-credentials: false - name: Add SSH private keys for submodule repositories + if: ${{ needs.check-secret.outputs.has_key == 'true' }} uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 with: ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }} - name: Clone submodules - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }} + if: ${{ needs.check-secret.outputs.has_key == 'true' }} run: git submodule update --init --recursive - run: | npm install --save-dev @babel/plugin-transform-flow-strip-types diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index c2bf89a07f8..ca22f567c26 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -15,9 +15,18 @@ env: CI_GRADLE_ARG_PROPERTIES: --stacktrace --no-daemon -Dsonar.gradle.skipCompile=true --no-configuration-cache jobs: + check-secret: + name: Check Enterprise Deploy Key + runs-on: ubuntu-latest + outputs: + has_key: ${{ steps.check.outputs.has_key }} + steps: + - id: check + run: echo "has_key=${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}" >> $GITHUB_OUTPUT checkScript: name: Search for forbidden patterns runs-on: ubuntu-latest + needs: check-secret steps: - name: Free Disk Space (Ubuntu) uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be @@ -38,11 +47,11 @@ jobs: persist-credentials: false - name: Add SSH private keys for submodule repositories uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }} + if: needs.check-secret.outputs.has_key == 'true' with: ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }} - name: Clone submodules - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }} + if: needs.check-secret.outputs.has_key == 'true' run: git submodule update --init --recursive - name: Run code quality check suite run: ./tools/check/check_code_quality.sh @@ -88,6 +97,7 @@ jobs: konsist: name: Konsist tests runs-on: ubuntu-latest + needs: check-secret # Allow all jobs on main and develop. Just one per PR. concurrency: group: ${{ github.ref == 'refs/heads/main' && format('check-konsist-main-{0}', github.sha) || github.ref == 'refs/heads/develop' && format('check-konsist-develop-{0}', github.sha) || format('check-konsist-{0}', github.ref) }} @@ -101,11 +111,11 @@ jobs: persist-credentials: false - name: Add SSH private keys for submodule repositories uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }} + if: needs.check-secret.outputs.has_key == 'true' with: ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }} - name: Clone submodules - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }} + if: needs.check-secret.outputs.has_key == 'true' run: git submodule update --init --recursive - name: Use JDK 21 uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0 @@ -129,6 +139,7 @@ jobs: compose: name: Compose tests runs-on: ubuntu-latest + needs: check-secret # Allow all jobs on main and develop. Just one per PR. concurrency: group: ${{ github.ref == 'refs/heads/main' && format('check-compose-main-{0}', github.sha) || github.ref == 'refs/heads/develop' && format('check-compose-develop-{0}', github.sha) || format('check-compose-{0}', github.ref) }} @@ -142,11 +153,11 @@ jobs: persist-credentials: false - name: Add SSH private keys for submodule repositories uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }} + if: needs.check-secret.outputs.has_key == 'true' with: ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }} - name: Clone submodules - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }} + if: needs.check-secret.outputs.has_key == 'true' run: git submodule update --init --recursive - name: Use JDK 21 uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0 @@ -163,6 +174,7 @@ jobs: lint: name: Android lint check runs-on: ubuntu-latest + needs: check-secret # Allow all jobs on main and develop. Just one per PR. concurrency: group: ${{ github.ref == 'refs/heads/main' && format('check-lint-main-{0}', github.sha) || github.ref == 'refs/heads/develop' && format('check-lint-develop-{0}', github.sha) || format('check-lint-{0}', github.ref) }} @@ -176,11 +188,11 @@ jobs: persist-credentials: false - name: Add SSH private keys for submodule repositories uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }} + if: needs.check-secret.outputs.has_key == 'true' with: ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }} - name: Clone submodules - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }} + if: needs.check-secret.outputs.has_key == 'true' run: git submodule update --init --recursive - name: Use JDK 21 uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0 @@ -221,11 +233,11 @@ jobs: persist-credentials: false - name: Add SSH private keys for submodule repositories uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }} + if: needs.check-secret.outputs.has_key == 'true' with: ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }} - name: Clone submodules - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }} + if: needs.check-secret.outputs.has_key == 'true' run: git submodule update --init --recursive - name: Use JDK 21 uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0 @@ -262,11 +274,11 @@ jobs: persist-credentials: false - name: Add SSH private keys for submodule repositories uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }} + if: needs.check-secret.outputs.has_key == 'true' with: ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }} - name: Clone submodules - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }} + if: needs.check-secret.outputs.has_key == 'true' run: git submodule update --init --recursive - name: Use JDK 21 uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0 @@ -303,11 +315,11 @@ jobs: persist-credentials: false - name: Add SSH private keys for submodule repositories uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }} + if: needs.check-secret.outputs.has_key == 'true' with: ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }} - name: Clone submodules - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }} + if: needs.check-secret.outputs.has_key == 'true' run: git submodule update --init --recursive - name: Run docs check # This is equivalent to `./gradlew checkDocs`, but we avoid having to install java and gradle diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fee9efb518a..8d58b2fbb83 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -13,6 +13,14 @@ env: CI_GRADLE_ARG_PROPERTIES: --stacktrace --no-daemon -Dsonar.gradle.skipCompile=true --no-configuration-cache jobs: + check-secret: + name: Check Enterprise Deploy Key + runs-on: ubuntu-latest + outputs: + has_key: ${{ steps.check.outputs.has_key }} + steps: + - id: check + run: echo "has_key=${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}" >> $GITHUB_OUTPUT gplay: name: Create App Bundle (Gplay) runs-on: ubuntu-latest @@ -66,7 +74,8 @@ jobs: enterprise: name: Create App Bundle Enterprise runs-on: ubuntu-latest - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }} + needs: check-secret + if: needs.check-secret.outputs.has_key == 'true' concurrency: group: ${{ format('build-release-main-enterprise-{0}', github.sha) }} cancel-in-progress: true @@ -76,7 +85,6 @@ jobs: persist-credentials: false - name: Add SSH private keys for submodule repositories uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }} with: ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }} - name: Clone submodules diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 5466bc80af2..adb2746c58c 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -15,10 +15,18 @@ env: CI_GRADLE_ARG_PROPERTIES: --stacktrace --no-daemon -Dsonar.gradle.skipCompile=true --no-configuration-cache jobs: + check-secret: + name: Check Enterprise Deploy Key + runs-on: ubuntu-latest + outputs: + has_key: ${{ steps.check.outputs.has_key }} + steps: + - id: check + run: echo "has_key=${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY != '' }}" >> $GITHUB_OUTPUT tests: name: Runs unit tests runs-on: ubuntu-latest - + needs: check-secret # Allow all jobs on main and develop. Just one per PR. concurrency: group: ${{ github.ref == 'refs/heads/main' && format('unit-tests-main-{0}', github.sha) || github.ref == 'refs/heads/develop' && format('unit-tests-develop-{0}', github.sha) || format('unit-tests-{0}', github.ref) }} @@ -56,11 +64,11 @@ jobs: ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }} - name: Add SSH private keys for submodule repositories uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }} + if: ${{ needs.check-secret.outputs.has_key == 'true' }} with: ssh-private-key: ${{ secrets.ELEMENT_ENTERPRISE_DEPLOY_KEY }} - name: Clone submodules - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }} + if: ${{ needs.check-secret.outputs.has_key == 'true' }} run: git submodule update --init --recursive - name: ☕️ Use JDK 21 uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0