6.4.10

.github/workflows/beta.build-push.yml

@@ -9,6 +9,8 @@ on:
 
   workflow_dispatch:
 
+permissions: {}
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"
@@ -27,6 +29,9 @@ jobs:
       EXPORT_OPTIONS_CATALYST_APPSTORE: "../scripts/exportOptions/Stable_Catalyst_ExportOptions.plist"
       EXPORT_OPTIONS_CATALYST_APP_EXPORT: "../scripts/exportOptions/Beta_Catalyst_ExportOptions.plist"
       EXPORT_OPTIONS_IOS: "../scripts/exportOptions/Beta_iOS_ExportOptions.plist"
+    permissions:
+      actions: write # needed to upload artifacts
+      contents: write # needed for git push
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       - uses: actions/checkout@v4
@@ -39,9 +44,16 @@ jobs:
           lfs: true
       - name: Checkout submodules
         run: git submodule update -f --init --remote
+      - name: Check for proper semantic versioning
+        run: |
+          version="$(git log -n 1 --merges --pretty=format:%s | sed -E 's/^[\t\n ]*([^\n\t ]+)[\t\n ]+\(([^\n\t ]+)\)[\t\n ]*$/\1/g')"
+          if ! [[ "$version" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-((0|[1-9][0-9]*|[0-9]*[a-zA-Z-][0-9a-zA-Z-]*)(\.(0|[1-9][0-9]*|[0-9]*[a-zA-Z-][0-9a-zA-Z-]*))*))?(\+([0-9a-zA-Z-]+(\.[0-9a-zA-Z-]+)*))?$ ]]; then
+            echo "Invalid semver: '$version'!"
+            exit 1
+          fi
       - name: Get last build tag and increment it
         run: |
-          oldBuildNumber=$(git tag --sort="v:refname" |grep "Build_iOS" | tail -n1 | sed 's/Build_iOS_//g')
+          oldBuildNumber=$(git tag --sort="v:refname" | grep "Build_iOS" | grep -v "Quicksy_Build_iOS" | tail -n1 | sed 's/Build_iOS_//g')
           buildNumber=$(expr $oldBuildNumber + 1)
           echo "New buildNumber is $buildNumber"
           git tag Build_iOS_$buildNumber
@@ -64,7 +76,10 @@ jobs:
                   printf("\n")
               }'
           }
-          buildNumber="$(git tag --sort="v:refname" | grep "Build_iOS" | tail -n1 | sed 's/Build_iOS_//g')"
+          function replace_unwanted_chars {
+            sed -e 's/>=/greater or equal than/g' -e 's/<=/lower or equal than/g' -e 's/>/greater than/g' -e 's/</lower than/g'
+          }
+          buildNumber="$(git tag --sort="v:refname" | grep "Build_iOS" | grep -v "Quicksy_Build_iOS" | tail -n1 | sed 's/Build_iOS_//g')"
           version="$(git log -n 1 --merges --pretty=format:%s | sed -E 's/^[\t\n ]*([^\n\t ]+)[\t\n ]+\(([^\n\t ]+)\)[\t\n ]*$/\1/g')"
           mkdir -p /Users/ci/releases
           OUTPUT_FILE="/Users/ci/releases/$buildNumber.output"
@@ -83,11 +98,11 @@ jobs:
           echo "__EOF__" | tee /dev/stderr >> "$OUTPUT_FILE"
 
           echo "notes_ios<<__EOF__" | tee /dev/stderr >> "$OUTPUT_FILE"
-          echo "$(git log -n 1 --merges --pretty=format:%b)" | repairNotes | grep -v '^[\t\n ]*MACOS_ONLY.*$' | sed -E 's/^[\t\n ]*IOS_ONLY[\t\n ]?(.*)$/\1/g' | tee /dev/stderr >> "$OUTPUT_FILE"
+          echo "$(git log -n 1 --merges --pretty=format:%b)" | repairNotes | grep -v '^[\t\n ]*MACOS_ONLY.*$' | sed -E 's/^[\t\n ]*IOS_ONLY[\t\n ]?(.*)$/\1/g' | replace_unwanted_chars | tee /dev/stderr >> "$OUTPUT_FILE"
           echo "__EOF__" | tee /dev/stderr >> "$OUTPUT_FILE"
 
           echo "notes_macos<<__EOF__" | tee /dev/stderr >> "$OUTPUT_FILE"
-          echo "$(git log -n 1 --merges --pretty=format:%b)" | repairNotes | grep -v '^[\t\n ]*IOS_ONLY.*$' | sed -E 's/^[\t\n ]*MACOS_ONLY[\t\n ]?(.*)$/\1/g' | tee /dev/stderr >> "$OUTPUT_FILE"
+          echo "$(git log -n 1 --merges --pretty=format:%b)" | repairNotes | grep -v '^[\t\n ]*IOS_ONLY.*$' | sed -E 's/^[\t\n ]*MACOS_ONLY[\t\n ]?(.*)$/\1/g' | replace_unwanted_chars | tee /dev/stderr >> "$OUTPUT_FILE"
           echo "__EOF__" | tee /dev/stderr >> "$OUTPUT_FILE"
 
           cat "$OUTPUT_FILE" >> "$GITHUB_OUTPUT"
@@ -124,14 +139,65 @@ jobs:
         run: xcrun altool --validate-app --file ./Monal/build/ipa/Monal.ipa --type ios --asc-provider S8D843U34Y -u "$(cat /Users/ci/apple_connect_upload_mail.txt)" -p "$(cat /Users/ci/apple_connect_upload_secret.txt)"
       - name: Push beta tag to repo
         run: |
-          buildNumber=$(git tag --sort="v:refname" | grep "Build_iOS" | tail -n1 | sed 's/Build_iOS_//g')
+          buildNumber=$(git tag --sort="v:refname" | grep "Build_iOS" | grep -v "Quicksy_Build_iOS" | tail -n1 | sed 's/Build_iOS_//g')
           git push origin Build_iOS_$buildNumber
+#       - name: Create fastlane whatsNew hash in environment
+#         id: buildinfo
+#         env:
+#           CHANGELOG_IOS: ${{ steps.releasenotes.outputs.notes_ios }}
+#           CHANGELOG_MACOS: ${{ steps.releasenotes.outputs.notes_macos }}
+#         run: |
+#           get_changelog() {
+#             local escaped=$(printf '%s\n' "$1" | jq -sRr @json)
+#             local json="{\"default\": {\"whats_new\": $escaped},"
+#             # for dir in ./appstore_metadata/*/; do
+#             #   dir="$(basename "$dir")"
+#             #   if [[ -d "./appstore_metadata/$dir" ]]; then
+#             #     json="$json\"${dir%/}\": {\"whats_new\": $escaped},"
+#             #   fi
+#             # done
+#             json="${json%,}}"
+#             echo "$json"
+#           }
+#           echo "buildinfo_ios<<__EOF__" | tee /dev/stderr >> "$GITHUB_OUTPUT"
+#           echo "$(get_changelog "$CHANGELOG_IOS")" | tee /dev/stderr >> "$GITHUB_OUTPUT"
+#           echo "__EOF__" | tee /dev/stderr >> "$GITHUB_OUTPUT"
+#           
+#           echo "buildinfo_macos<<__EOF__" | tee /dev/stderr >> "$GITHUB_OUTPUT"
+#           echo "$(get_changelog "$CHANGELOG_MACOS")" | tee /dev/stderr >> "$GITHUB_OUTPUT"
+#           echo "__EOF__" | tee /dev/stderr >> "$GITHUB_OUTPUT"
+      - name: Create fastlane localized_app_info hash in environment
+        id: appinfo
+        run: |
+          build_appinfo_entry() {
+            local escaped_marketing_url=$(cat ./appstore_metadata/$1/marketing_url.txt | jq -sRr @json)
+            local escaped_privacy_policy_url=$(cat ./appstore_metadata/$1/privacy_url.txt | jq -sRr @json)
+            local escaped_description=$(cat ./appstore_metadata/$1/description.txt | jq -sRr @json)
+            local json="{\"feedback_email\": \"[email protected]\", \"marketing_url\": $escaped_marketing_url, \"privacy_policy_url\": $escaped_privacy_policy_url, \"description\": $escaped_description}"
+            echo "$json"
+          }
+
+          json="{"
+          json="$json\"default\": $(build_appinfo_entry "en-US"),"
+          for dir in ./appstore_metadata/*/; do
+            dir="$(basename "$dir")"
+            if [[ -d "./appstore_metadata/$dir" ]]; then
+              json="$json\"${dir%/}\": $(build_appinfo_entry "${dir%/}"),"
+            fi
+          done
+          json="${json%,}}"
+
+          echo "appinfo<<__EOF__" | tee /dev/stderr >> "$GITHUB_OUTPUT"
+          echo "$json" | tee /dev/stderr >> "$GITHUB_OUTPUT"
+          echo "__EOF__" | tee /dev/stderr >> "$GITHUB_OUTPUT"
       - name: Publish ios to appstore connect
         #run: xcrun altool --upload-app -f ./Monal/build/ipa/Monal.ipa --type ios --asc-provider S8D843U34Y --team-id S8D843U34Y -u "$(cat /Users/ci/apple_connect_upload_mail.txt)" -p "$(cat /Users/ci/apple_connect_upload_secret.txt)"
         env:
+          #PILOT_LOCALIZED_BUILD_INFO: ${{ steps.buildinfo.outputs.buildinfo_ios }}
+          PILOT_LOCALIZED_APP_INFO: ${{ steps.appinfo.outputs.appinfo }}
           PILOT_CHANGELOG: ${{ steps.releasenotes.outputs.notes_ios }}
         run: |
-          fastlane run upload_to_testflight api_key_path:"/Users/ci/appstoreconnect/key.json" team_id:"S8D843U34Y" ipa:"./Monal/build/ipa/Monal.ipa" distribute_external:true groups:"Internal Pre-Beta Testers","Public Beta" reject_build_waiting_for_review:true submit_beta_review:true
+          fastlane run upload_to_testflight api_key_path:"/Users/ci/appstoreconnect/key.json" team_id:"S8D843U34Y" ipa:"./Monal/build/ipa/Monal.ipa" distribute_external:true notify_external_testers:true groups:"Internal Pre-Beta Testers","Public Beta" reject_build_waiting_for_review:true submit_beta_review:true
       - name: Notarize catalyst
         run: xcrun notarytool submit ./Monal/build/app/Monal.zip --wait --team-id S8D843U34Y --key "/Users/ci/appstoreconnect/apiKey.p8" --key-id "$(cat /Users/ci/appstoreconnect/apiKeyId.txt)" --issuer "$(cat /Users/ci/appstoreconnect/apiIssuerId.txt)"
       - name: staple
@@ -152,13 +218,18 @@ jobs:
           path: Monal/build/app/Monal.pkg
           if-no-files-found: error
       - name: Upload new catalyst beta to monal-im.org
-        run: ./scripts/uploadNonAlpha.sh beta
+        env:
+          UPLOAD_TYPE: beta
+          buildNumber: ${{ steps.releasenotes.outputs.buildNumber }}
+        run: ./scripts/uploadNonAlpha.sh
       - name: Publish catalyst to appstore connect
         #run:  xcrun altool --upload-app --file ./Monal/build/app/Monal.pkg --type macos --asc-provider S8D843U34Y -u "$(cat /Users/ci/apple_connect_upload_mail.txt)" -p "$(cat /Users/ci/apple_connect_upload_secret.txt)" --primary-bundle-id org.monal-im.prod.catalyst.monal
         env:
+          #PILOT_LOCALIZED_BUILD_INFO: ${{ steps.buildinfo.outputs.buildinfo_macos }}
+          PILOT_LOCALIZED_APP_INFO: ${{ steps.appinfo.outputs.appinfo }}
           PILOT_CHANGELOG: ${{ steps.releasenotes.outputs.notes_macos }}
         run: |
-          fastlane run upload_to_testflight api_key_path:"/Users/ci/appstoreconnect/key.json" team_id:"S8D843U34Y" pkg:"./Monal/build/app/Monal.pkg" distribute_external:true groups:"Internal Pre-Beta Testers","Public Beta" reject_build_waiting_for_review:true submit_beta_review:true
+          fastlane run upload_to_testflight api_key_path:"/Users/ci/appstoreconnect/key.json" team_id:"S8D843U34Y" pkg:"./Monal/build/app/Monal.pkg" distribute_external:true notify_external_testers:true groups:"Internal Pre-Beta Testers","Public Beta" reject_build_waiting_for_review:true submit_beta_review:true
       - name: Release
         uses: softprops/action-gh-release@v2
         with:
@@ -184,6 +255,8 @@ jobs:
       APP_NAME: "Monal"
       APP_DIR: "Monal.app"
       BUILD_TYPE: "Beta"
+    permissions:
+      contents: write # needed for git push in updateLocalization
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       - uses: actions/checkout@v4

.github/workflows/create-stable-pr.yml

@@ -0,0 +1,135 @@
+name: Create Pull Request from Beta to Stable
+
+on:
+  push:
+    branches: [ beta ]
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  create-pull-request:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Checkout Beta Branch
+        uses: actions/checkout@v4
+        with:
+          clean: true
+          submodules: true
+          fetch-depth: 100
+          fetch-tags: true
+          show-progress: true
+          lfs: true
+          ref: beta
+      - name: Checkout Stable Branch
+        run: |
+          git fetch --all
+          git checkout stable
+          git branch
+      - name: Get Merge Commits from Beta not in Stable
+        id: get_commits
+        run: |
+          function repairNotes {
+              sed 's/\r//g' | awk '{
+                  if (NR == 1) {
+                      printf("%s", $0)
+                  } else {
+                      if ($0 ~ /^[\t ]*(-|IOS_ONLY[\t ]*-|MACOS_ONLY[\t ]*-).*$/) {
+                          printf("\n%s", $0)
+                      } else {
+                          printf(" %s", $0)
+                      }
+                  }
+              }
+              END {
+                  printf("\n")
+              }'
+          }
+          echo "Extracting merge commit texts..."
+          version="$(git log beta -n 1 --merges --pretty=format:%s | sed -E 's/^[\t\n ]*([^\n\t ]+)[\t\n ]+\(([^\n\t ]+)\)[\t\n ]*$/\1/g')"
+          echo "version=$version" | tee /dev/stderr >> "$GITHUB_OUTPUT"
+          echo "buildVersion=$(echo "$version" | grep -oE '^[0-9]+(\.[0-9]+){0,2}')" | tee /dev/stderr >> "$GITHUB_OUTPUT"
+          echo "description<<__EOF__" | tee /dev/stderr >> "$GITHUB_OUTPUT"
+          echo "$(git log stable..beta --merges --pretty=format:%b)" | repairNotes | tee /dev/stderr >> "$GITHUB_OUTPUT"
+          echo "__EOF__" | tee /dev/stderr >> "$GITHUB_OUTPUT"
+      - name: Find Existing Pull Request
+        id: find_pr
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const [owner, repo] = process.env.GITHUB_REPOSITORY.split("/");
+            const { data: pullRequests } = await github.rest.pulls.list({
+              owner,
+              repo,
+              state: 'open',
+              head: 'beta',
+              base: 'stable'
+            });
+            const existingPR = pullRequests.find(pr => pr.labels.some(label => label.name === 'automated-pr'));
+            console.log(`Existing PR: `, existingPR);
+            if(existingPR)
+              return existingPR.number;
+            else
+              return null;
+      - name: Create or Update Pull Request
+        id: create_or_update_pr
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const [owner, repo] = process.env.GITHUB_REPOSITORY.split("/");
+            const prNumber = ${{ steps.find_pr.outputs.result }};
+            let pullRequest;
+            if(prNumber)
+            {
+              console.log(`Updating old PR #${prNumber}...`);
+              pullRequest = await github.rest.pulls.update({
+                owner,
+                repo,
+                pull_number: prNumber,
+                title: `${{ steps.get_commits.outputs.buildVersion }}`,
+                body: `${{ steps.get_commits.outputs.description }}`,
+              });
+              console.log(`Updated pull request #${prNumber}`);
+            }
+            else
+            {
+              console.log(`Creating new PR...`);
+              pullRequest = await github.rest.pulls.create({
+                owner,
+                repo,
+                head: 'beta',
+                base: 'stable',
+                draft: false,
+                title: `${{ steps.get_commits.outputs.buildVersion }}`,
+                body: `${{ steps.get_commits.outputs.description }}`,
+              });
+              console.log(`Created pull request #${pullRequest.data.number}`);
+              //update pr after creation to trigger our pr-semver-title workflow
+              pullRequest = await github.rest.pulls.update({
+                owner,
+                repo,
+                pull_number: pullRequest.data.number,
+                title: `${{ steps.get_commits.outputs.buildVersion }}`,
+                body: `${{ steps.get_commits.outputs.description }}`,
+              });
+              console.log(`Updated pull request #${pullRequest.data.number}`);
+            }
+            return pullRequest.data.number;
+      - name: Add Label to Pull Request
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const [owner, repo] = process.env.GITHUB_REPOSITORY.split("/");
+            const pullNumber = ${{ steps.create_or_update_pr.outputs.result }};
+            await github.rest.issues.addLabels({
+              owner,
+              repo,
+              issue_number: pullNumber,
+              labels: ['automated-pr']
+            });
+            console.log(`Added label to pull request #${pullNumber}`);

.github/workflows/develop-push.yml

@@ -9,6 +9,8 @@ on:
 
   workflow_dispatch:
 
+permissions: {}
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"
@@ -27,6 +29,8 @@ jobs:
       ALPHA_UPLOAD_SECRET: ${{ secrets.ALPHA_UPLOAD_SECRET }}
       EXPORT_OPTIONS_CATALYST_APP_EXPORT: "../scripts/exportOptions/Alpha_Catalyst_ExportOptions.plist"
       EXPORT_OPTIONS_IOS: "../scripts/exportOptions/Alpha_iOS_ExportOptions.plist"
+    permissions:
+      actions: write # needed to upload artifacts
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       - uses: actions/checkout@v4

.github/workflows/pr-semver-title.yml

@@ -0,0 +1,54 @@
+name: Check PR title for proper semver
+
+on:
+  pull_request:
+    branches:
+      - beta
+      - stable
+
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: "Pull request number to check"
+        required: true
+        type: number
+
+permissions: {}
+
+jobs:
+  check-pr-semver-title:
+    runs-on: ubuntu-latest
+    name: Validate PR Title
+
+    steps:
+      - name: Get PR details
+        id: find_pr
+        run: |
+          if [ -z "${{ github.event.inputs.pr_number }}" ]; then
+            prNumber=${{ github.event.pull_request.number }}
+          else
+            prNumber=${{ github.event.inputs.pr_number }}
+          fi
+          echo "prNumber=$prNumber" | tee /dev/stderr >> "$GITHUB_OUTPUT"
+      - name: Fetch pull request title
+        id: pr_title
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const [owner, repo] = process.env.GITHUB_REPOSITORY.split("/");
+            const prNumber = ${{ steps.find_pr.outputs.prNumber }};
+            const { data: pull_request } = await github.rest.pulls.get({
+              owner: owner,
+              repo: repo,
+              pull_number: prNumber
+            });
+            return pull_request.title;
+      - name: Check PR title format
+        run: |
+          version="${{ steps.pr_title.outputs.result }}"
+          if ! [[ "$version" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-((0|[1-9][0-9]*|[0-9]*[a-zA-Z-][0-9a-zA-Z-]*)(\.(0|[1-9][0-9]*|[0-9]*[a-zA-Z-][0-9a-zA-Z-]*))*))?(\+([0-9a-zA-Z-]+(\.[0-9a-zA-Z-]+)*))?$ ]]; then
+            echo "Invalid semver: '$version'!"
+            exit 1
+          fi
+          echo "Version is proper semver: $version"
+