Test Quickstarts in GHA (#5134)

.github/workflows/firestore.yml

@@ -150,3 +150,22 @@ jobs:
         scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb FirebaseFirestore.podspec \
             --platforms=ios \
             --allow-warnings
+
+  quickstart:
+    runs-on: macOS-latest
+    steps:
+    - uses: actions/checkout@v2
+    - name: Setup quickstart
+      run: scripts/setup_quickstart.sh firestore
+    - name: Install Secret GoogleService-Info.plist
+      env:
+         plist_secret: ${{ secrets.QsFirestorePlistSecret }}
+      run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-firestore.plist.gpg \
+          quickstart-ios/firestore/GoogleService-Info.plist "$plist_secret"
+    - name: Install Secret FIREGSignInInfo.h
+      env:
+         signin_secret: ${{ secrets.QsSignInSecret }}
+      run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/FIREGSignInInfo.h.gpg \
+          quickstart-ios/TestUtils/FIREGSignInInfo.h "$signin_secret"
+    - name: Test quickstart
+      run: scripts/third_party/travis/retry.sh scripts/test_quickstart.sh Firestore

.github/workflows/messaging.yml

@@ -36,6 +36,25 @@ jobs:
     - name: Setup project and Build Catalyst
       run: scripts/test_catalyst.sh FirebaseMessaging build
 
+  quickstart:
+    runs-on: macOS-latest
+    steps:
+    - uses: actions/checkout@v2
+    - name: Setup quickstart
+      run: scripts/setup_quickstart.sh messaging
+    - name: Install Secret GoogleService-Info.plist
+      env:
+         plist_secret: ${{ secrets.QsMessagingPlistSecret }}
+      run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-messaging.plist.gpg \
+          quickstart-ios/messaging/GoogleService-Info.plist "$plist_secret"
+    - name: Install Secret FIREGSignInInfo.h
+      env:
+         signin_secret: ${{ secrets.QsSignInSecret }}
+      run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/FIREGSignInInfo.h.gpg \
+          quickstart-ios/TestUtils/FIREGSignInInfo.h "$signin_secret"
+    - name: Test quickstart
+      run: scripts/third_party/travis/retry.sh scripts/test_quickstart.sh Messaging
+
   pod-lib-lint-watchos:
     runs-on: macOS-latest
 

.github/workflows/storage.yml

@@ -34,6 +34,25 @@ jobs:
       # Only run the unit tests on Catalyst
       run: scripts/test_catalyst.sh FirebaseStorage test FirebaseStorage-Unit-unit
 
+  quickstart:
+    runs-on: macOS-latest
+    steps:
+    - uses: actions/checkout@v2
+    - name: Setup quickstart
+      run: scripts/setup_quickstart.sh storage
+    - name: Install Secret GoogleService-Info.plist
+      env:
+         plist_secret: ${{ secrets.QsStoragePlistSecret }}
+      run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-storage.plist.gpg \
+          quickstart-ios/storage/GoogleService-Info.plist "$plist_secret"
+    - name: Install Secret FIREGSignInInfo.h
+      env:
+         signin_secret: ${{ secrets.QsSignInSecret }}
+      run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/FIREGSignInInfo.h.gpg \
+          quickstart-ios/TestUtils/FIREGSignInInfo.h "$signin_secret"
+    - name: Test quickstart
+      run: scripts/third_party/travis/retry.sh scripts/test_quickstart.sh Storage
+
   pod-lib-lint:
     runs-on: macOS-latest
 

.travis.yml

@@ -207,17 +207,6 @@ jobs:
       script:
         - travis_retry ./scripts/if_changed.sh ./scripts/pod_lib_lint.rb FirebaseDynamicLinks.podspec
 
-    - stage: test
-      env:
-        - PROJECT=Messaging METHOD=pod-lib-lint QUICKSTART=messaging
-      before_install:
-        - ./scripts/if_changed.sh ./scripts/install_prereqs.sh
-      script:
-        - travis_retry ./scripts/if_changed.sh ./scripts/pod_lib_lint.rb FirebaseMessaging.podspec --platforms=ios
-        - travis_retry ./scripts/if_changed.sh ./scripts/test_quickstart.sh Messaging
-        - travis_retry ./scripts/if_changed.sh ./scripts/pod_lib_lint.rb FirebaseMessaging.podspec --platforms=tvos
-        - travis_retry ./scripts/if_changed.sh ./scripts/pod_lib_lint.rb FirebaseMessaging.podspec --platforms=macos
-
     - stage: test
       osx_image: xcode10.3
       env:
@@ -270,14 +259,6 @@ jobs:
         - travis_retry  ./scripts/pod_lib_lint.rb FirebaseRemoteConfig.podspec --use-modular-headers --platforms=tvos
         - travis_retry  ./scripts/pod_lib_lint.rb FirebaseRemoteConfig.podspec --use-modular-headers --platforms=macos
 
-    - stage: test
-      env:
-        - PROJECT=Storage PLATFORM=all METHOD=xcodebuild QUICKSTART=storage
-      before_install:
-        - ./scripts/if_changed.sh ./scripts/install_prereqs.sh
-      script:
-        - travis_retry ./scripts/if_changed.sh ./scripts/test_quickstart.sh Storage
-
     - stage: test
       osx_image: xcode10.3
       env:
@@ -368,15 +349,6 @@ jobs:
       script:
         - travis_retry ./scripts/if_changed.sh ./scripts/build.sh $PROJECT $PLATFORM
 
-    - stage: test
-      env:
-        - PROJECT=Firestore PLATFORM=iOS METHOD=xcodebuild QUICKSTART=firestore
-      before_install:
-        - ./scripts/if_changed.sh ./scripts/install_prereqs.sh
-      script:
-        - travis_retry ./scripts/if_changed.sh ./scripts/build.sh $PROJECT $PLATFORM $METHOD
-        - travis_retry ./scripts/if_changed.sh ./scripts/test_quickstart.sh Firestore
-
     - stage: test
       osx_image: xcode10.3
       env:

scripts/build.sh

@@ -86,22 +86,8 @@ case "$system" in
     ;;
 esac
 
-have_secrets=false
-
-# Travis: Secrets are available if we're not running on a fork.
-if [[ -n "${TRAVIS_PULL_REQUEST:-}" ]]; then
-  if [[ "$TRAVIS_PULL_REQUEST" == "false" ||
-      "$TRAVIS_PULL_REQUEST_SLUG" == "$TRAVIS_REPO_SLUG" ]]; then
-        have_secrets=true
-  fi
-fi
-# GitHub Actions: Secrets are available if we're not running on a fork.
-# See https://help.github.com/en/actions/automating-your-workflow-with-github-actions/using-environment-variables
-if [[ -n "${GITHUB_WORKFLOW:-}" ]]; then
-  if [[ -z "$GITHUB_HEAD_REF" ]]; then
-    have_secrets=true
-  fi
-fi
+# Source function to check if CI secrets are available.
+source scripts/check_secrets.sh
 
 # Runs xcodebuild with the given flags, piping output to xcpretty
 # If xcodebuild fails with known error codes, retries once.
@@ -308,7 +294,7 @@ case "$product-$platform-$method" in
     ;;
 
   Auth-*-xcodebuild)
-    if [[ "$have_secrets" == true ]]; then
+    if check_secrets; then
       RunXcodebuild \
         -workspace 'Example/Auth/AuthSample/AuthSample.xcworkspace' \
         -scheme "Auth_ApiTests" \
@@ -374,7 +360,7 @@ case "$product-$platform-$method" in
       build \
       test
 
-    if [[ "$have_secrets" == true ]]; then
+    if check_secrets; then
       # Integration tests are only run on iOS to minimize flake failures.
       RunXcodebuild \
         -workspace 'gen/FirebaseDatabase/FirebaseDatabase.xcworkspace' \
@@ -414,7 +400,7 @@ case "$product-$platform-$method" in
       build \
       test
 
-    if [[ "$have_secrets" == true ]]; then
+    if check_secrets; then
       # Integration tests are only run on iOS to minimize flake failures.
       RunXcodebuild \
         -workspace 'gen/FirebaseStorage/FirebaseStorage.xcworkspace' \

scripts/check_secrets.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+# Check if secrets are available for multiple CI's
+
+set -x
+echo "GITHUB_BASE_REF: ${GITHUB_BASE_REF}"
+echo "GITHUB_HEAD_REF: ${GITHUB_HEAD_REF}"
+
+check_secrets()
+{
+  # Travis: Secrets are available if we're not running on a fork.
+  if [[ -n "${TRAVIS_PULL_REQUEST:-}" ]]; then
+    if [[ "$TRAVIS_PULL_REQUEST" == "false" ||
+        "$TRAVIS_PULL_REQUEST_SLUG" == "$TRAVIS_REPO_SLUG" ]]; then
+          return 0
+    fi
+  fi
+  # GitHub Actions: Secrets are available if we're not running on a fork.
+  # See https://help.github.com/en/actions/automating-your-workflow-with-github-actions/using-environment-variables
+  # TODO- These are both set in the master repo even thought the docs say otherwise.
+  # Investigate their values in a fork.
+  if [[ -n "${GITHUB_WORKFLOW:-}" ]]; then
+    if [[ -n "$GITHUB_BASE_REF" ]]; then
+      return 0
+    fi
+  fi
+  return 1
+}

scripts/gha-encrypted/FIREGSignInInfo.h.gpg

@@ -0,0 +1,3 @@
+Œ
	 Å\· ©çëíÒé
]G4U£‘aÍ$Ùv7+@l$�|‡ìv¯ÞzÈŽ†Ž#¶SÑêdqµ‰“´»e†‰¢l–1ãê‡Å…ÑvgŠ¶WæÕq°Y…PÚB$Ô–s½ºÖë¶ÎÝU¶ÐÚÍåü3WôbÍ鬮Ë%7NŽÛé™~NÄs¼	4”©Šöþ]œÞ*™Oî,†
¦ù8�¿¨¬aªF#,’jkz5+)*
+ﯙ^úÈ3'Ç;÷¹T"ãù´´zlÓ(©
+©YvdA%U|Ò
!—¿îõݾßG’Õ›ÁyMvì¥b”„yp.<0æc0=Ðc�ž±Øèît„ÕÊÍ`äÐ�e˜Î?ȃçô«˜ƒŒ$’±sø*ŒMø´¡Ø „�»P¯LÚXªz>š-p~öðk"ÁÒ!�×0(7jw^}Ìetý*÷’òþ‘@.Âß1õüsâ&0x/g‡à¢÷»k‘x­žŠSÒ˜B
íôûÁÃDâËÑó„Wu“¯á)ÞûëÐi�"©ñIWVÒy;´?IKjFÜ£Ûç¢Oã3Usfæœ&6˜†BÍ3ÝÞGȾ™]Á@cÕ(K-Ôª…WBžçtvÖ¶•[˜iZå<ÖÉìJ£'›3^{ì&éÒ™Ÿk¶_ús9¹Cäçóv×B1�„Áš††¹®øb§¼@ÑòîÛ¾�Ö3p@û+Ý�}

scripts/gha-encrypted/README

@@ -0,0 +1,3 @@
+See https://help.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets
+
+Googlers: code search firebase/ios/Secrets to find the sources.

scripts/gha-encrypted/qs-firestore.plist.gpg

@@ -0,0 +1 @@
+Œ
	Zò¸©7îiíÒé
Üñ&jè Á¹¿Âœr¦Aûøºôf¦ä:s´Î§›H­HGUSEíЉ.·úæŸÄnÔÝÏØ¿Ó§-JB„ª©-¶@´È3¾“åbyzOXbhò>7Våt<¬WV]ÚhUšIÑHdÁ]ö‡ª&„›ô{ZèÑÙÈM�³óæ)Q5Ù{<´¸lÐB|/æH,” �ø‹•›™ìЋ¼3ˆÐï`ò¶ó•çÝ�´¹ï§´ �Ý�ÒzZ)b/\Fkˆ×™iûŠSþ§AîP¢õN¿ýA–°©oööúôÕÕ3þ”}ó¾ËŽE'üF†«~45ó6]O™IHÙãmÁ¬a-6Ükö#•(Ä/å«ÝŒ.~áï�›ŒtRþÓNåGñ��ÍeöÙö+}’”I!ЮdI«¨p¶x�Â+1î}v15l@ÂäæŠ,oÀÃ;j™¶/ræpÆÝ$�	†…-á—îyfp�§WË|ñ6¬ê˜Ì‰#“ÁÙˆ­;.F/šý<ú�FäžyëÀKÝ›PÓµ÷”rcÃñâ"{¨’ó�1Ìû³‡2öírˆôšw–Í%»qn«ÄUòÚÅôW[’ÅpÊâ’‹CQIÅMQóIð$Þš|Mv,G÷Ï/T1Þ›qün�ɾ‚˜ÅLËÃ+ˤ²ÚŒë¨@óE®ŽœGÞíH¹È«´¾fÍ­þŽyïÀžd®D-Nó^.„äÞ<ÄU2z\?ª’ç�ny€X`×ÇìF,�ú‘£Üð@Ç.y�e)}MÝa'äÇjØ;‡0Çn颌õ+b$ÚúÁŒgá‰Ð5RÌ“��{1é‚\�᥊µLS�ÇaS{FûrÖF‚¬e<Œnâi¼B•³h¢-x¨n]P^a¬

scripts/setup_bundler.sh

@@ -16,4 +16,5 @@
 
 bundle update --bundler # ensure bundler version is high enough for Gemfile.lock
 bundle install
+bundle --version
 bundle exec pod --version

scripts/setup_quickstart.sh

@@ -16,8 +16,17 @@
 # Script to run in a CI `before_install` phase to setup the quickstart repo
 # so that it can be used for integration testing.
 
-if [[ "$TRAVIS_PULL_REQUEST" == "false" ||
-      "$TRAVIS_PULL_REQUEST_SLUG" == "$TRAVIS_REPO_SLUG" ]]; then
+set -xeuo pipefail
+
+scripts_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+root_dir="$(dirname "$scripts_dir")"
+
+$scripts_dir/setup_bundler.sh
+
+# Source function to check if CI secrets are available.
+source $scripts_dir/check_secrets.sh
+
+if check_secrets; then
   SAMPLE=$1
 
   # Specify repo so the Firebase module and header can be found in a
@@ -25,18 +34,22 @@ if [[ "$TRAVIS_PULL_REQUEST" == "false" ||
   export FIREBASE_POD_REPO_FOR_DEV_POD=`pwd`
 
   git clone https://github.com/firebase/quickstart-ios.git
-  ./scripts/localize_podfile.swift quickstart-ios/"$SAMPLE"/Podfile
+  $scripts_dir/localize_podfile.swift quickstart-ios/"$SAMPLE"/Podfile
   cd quickstart-ios/"$SAMPLE"
 
   # To test a branch, uncomment the following line
   # git checkout {BRANCH_NAME}
 
+  bundle update --bundler
+  bundle install
   bundle exec pod install
-  TRAVIS_PULL_REQUEST="$TRAVIS_PULL_REQUEST" TRAVIS_PULL_REQUEST_SLUG=$"TRAVIS_PULL_REQUEST_SLUG" \
-    ../scripts/install_prereqs/"$SAMPLE".sh
+  ../scripts/install_prereqs/"$SAMPLE".sh
+
   # Secrets are repo specific, so we need to override with the firebase-ios-sdk
-  # version.
-  cp ../../Secrets/quickstart-ios/"$SAMPLE"/GoogleService-Info.plist ./
-  cp ../../Secrets/quickstart-ios/TestUtils/FIREGSignInInfo.h ../TestUtils/
+  # version. GHA manages the secrets in its action script.
+  if [[ -n "${TRAVIS_PULL_REQUEST:-}" ]]; then
+    cp $root_dir/Secrets/quickstart-ios/"$SAMPLE"/GoogleService-Info.plist ./
+    cp $root_dir/Secrets/quickstart-ios/TestUtils/FIREGSignInInfo.h ../TestUtils/
+  fi
   cd -
 fi

scripts/test_quickstart.sh

@@ -16,11 +16,14 @@
 # Run a CI `script` phase to build the associated quickstart
 # sample and run its tests.
 
-if [[ "$TRAVIS_PULL_REQUEST" == "false" ||
-      "$TRAVIS_PULL_REQUEST_SLUG" == "$TRAVIS_REPO_SLUG" ]]; then
+set -xeuo pipefail
+
+sample="$1"
+
+# Source function to check if CI secrets are available.
+source scripts/check_secrets.sh
+
+if check_secrets; then
   cd quickstart-ios
-  TRAVIS_PULL_REQUEST="$TRAVIS_PULL_REQUEST" \
-  TRAVIS_PULL_REQUEST_SLUG="$TRAVIS_PULL_REQUEST_SLUG" \
-  TRAVIS_REPO_SLUG="$TRAVIS_REPO_SLUG" \
-    SAMPLE="$1" ./scripts/test.sh
+  have_secrets=true SAMPLE="$sample" ./scripts/test.sh
 fi