build-macos-repo.yml

name: Build macOS Repository

on:
  workflow_call:
    inputs:
      salt-version:
        type: string
        required: true
        description: The Salt version to set prior to building packages.
      nightly-build:
        type: boolean
        default: false
      rc-build:
        type: boolean
        default: false
      environment:
        type: string
        description: On which GitHub Environment Context To Run
    secrets:
      SECRETS_KEY:
        required: true

env:
  COLUMNS: 160

jobs:
  build-repo:
    name: macOS
    environment: ${{ inputs.environment }}
    runs-on:
      - self-hosted
      - linux
      - repo-${{ inputs.environment }}
    strategy:
      fail-fast: false
      max-parallel: 2
      matrix:
        key-id:
          - "0E08A149DE57BFBE"

    steps:
      - uses: actions/checkout@v3

      - name: Setup Python Tools Scripts
        uses: ./.github/actions/setup-python-tools-scripts

      - name: Download macOS x86_64 Packages
        uses: actions/download-artifact@v3
        with:
          name: salt-${{ inputs.salt-version }}-x86_64-macos-pkgs
          path: artifacts/pkgs/incoming

      - name: Setup GnuPG
        run: |
          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
          GNUPGHOME="$(mktemp -d -p /run/gpg)"
          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
          cat <<EOF > "${GNUPGHOME}/gpg.conf"
          batch
          no-tty
          pinentry-mode loopback
          EOF

      - name: Get Secrets
        env:
          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
        run: |
          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys \
            --query SecretString --output text | jq .default_key -r \
            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
            | gpg --import -
          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys \
            --query SecretString --output text| jq .default_passphrase -r \
            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
          rm "$SECRETS_KEY_FILE"
          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"

      - name: Create Repository Path
        run: |
          mkdir -p artifacts/pkgs/repo

      - name: Download `salt-archive-keyring.gpg`
        env:
          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
        run: |
          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/salt-archive-keyring-gpg-file \
            --query SecretString --output text| jq .base64 -r | base64 -d \
            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o ~/salt-archive-keyring.gpg -d -
          rm "${SECRETS_KEY_FILE}"

      - name: Create Repository
        run: |
          tools pkg-repo macos --key-id=${{ matrix.key-id }} \
            ${{ inputs.nightly-build && '--nightly-build' || ''  }} --salt-version=${{ inputs.salt-version }} \
            ${{ inputs.rc-build && '--rc-build' || ''  }} --incoming=artifacts/pkgs/incoming \
            --repo-path=artifacts/pkgs/repo

      - name: Upload Repository As An Artifact
        uses: actions/upload-artifact@v3
        with:
          name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-repo
          path: artifacts/pkgs/repo/*
          retention-days: 7
          if-no-files-found: error