From 2cec591baa4dd14e656425c0cc2bc6348f826b95 Mon Sep 17 00:00:00 2001 From: Webber Takken Date: Sat, 23 Jan 2021 11:30:46 +0100 Subject: [PATCH] Secure licenses (#202) --- .github/workflows/main.yml | 77 +++++++++++++++++++++++++++++++------- 1 file changed, 64 insertions(+), 13 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 415d5b91..8fea4512 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -1,8 +1,10 @@ name: Actions on: - pull_request: {} push: { branches: [main] } + pull_request_target: + paths-ignore: + - '.github/**' env: CODECOV_TOKEN: '2f2eb890-30e2-4724-83eb-7633832cf0de' @@ -37,14 +39,8 @@ jobs: unityVersion: - 2019.2.11f1 - 2019.3.15f1 - include: - # Please be polite; don't copy my personal licenses. - # These are here because they are needed to allowing pull requests from forks to unity-builder. - # You should be using ${{ secrets.UNITY_LICENSE_2019_3_15 }} here. - - unityVersion: 2019.2.11f1 - license: "\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \nJHdOBFmBNq2H8BrGFzir/StLoYo=aENLHd37a51RtP2/g7YU0Pexf5mx0/ENXYGtrPzqwZ8NQt2AsSdxGnl0CUB45/GuNXfJVDt2HWot\ncNYZB2OylVBn1WHQbKZlPmm8gEAMz0MYbr4Isb5i5buryBrZlmbEOjnRI+pEg1CBwlgMo6xdtjjE\n/d7cC293QIUO91kdzRXftYou1dNaUyuPL9ZH65vdB2pDXGRNxgUVD+GnnqZA7b5L2HXqNQclcWAK\n5Yd1BeF3VzR1iLw9G/SmH5oOhnpXSmqbL4qk7LVP2/mgXpFk5kP4X8VC3z47obNhBIGq40dwWyEe\nUYk5/nRAOkZawDT+tcu96e06gPC9Cxk5PdbRbA==" - - unityVersion: 2019.3.15f1 - license: "\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \nbpzWx3PZ0lqWDo1m9aLQuZ4cweo=QcDm4/qAXZuUMQbUVk63vO6u66Bp8PnqqWQcZZOcym/rGUZLj1sr66EquF3X3w1L7aqiwMGtbY2b\nkPttcalFeaBkc5NsJMrexWjuBCxQvhbmVFQnTjvC6vNS+k1wrkz7If1oPkz/XaDtCfUs8oxc9iPe\nPzzUJIVYLZoDtpPq2XbgVn9/TiVb3Zu6ldKgvtNRYUjrB3KywtvL9OcIFll3htRcBZPG43kxryJc\nDD2TL5Nw1JuX6MejBBuYTZsZNpGX9Pjop9+uFUZ4GI9h8a5g6wJUfXzsGw7j4gkvDkC9MvyWiksi\n2hNXw1QNeB6JfQsd4sAuhYh/CqTm2gCz9i9ZpA==" + unityLicense: + - ${{ secrets.UNITY_LICENSE }} targetPlatform: - StandaloneOSX # Build a macOS standalone (Intel 64-bit). - StandaloneWindows64 # Build a Windows 64-bit standalone. @@ -59,9 +55,25 @@ jobs: # - tvOS # Build to Apple's tvOS platform. # - Switch # Build a Nintendo Switch player steps: - - uses: actions/checkout@v2 + ########################### + # Checkout # + ########################### + - name: Checkout (default) + uses: actions/checkout@v2 + if: github.event.event_type != 'pull_request_target' with: lfs: true + - name: Checkout (pull_request_target) + uses: actions/checkout@v2 + if: github.event.event_type == 'pull_request_target' + with: + lfs: true + ref: ${{ github.event.pull_request.head.ref }} + repository: ${{ github.event.pull_request.head.repo.full_name }} + + ########################### + # Cache # + ########################### - uses: actions/cache@v2 with: path: ${{ matrix.projectPath }}/Library @@ -69,19 +81,28 @@ jobs: restore-keys: | Library-${{ matrix.projectPath }}- Library- + + ########################### + # Build # + ########################### - uses: ./ env: - UNITY_LICENSE: ${{ matrix.license }} + UNITY_LICENSE: ${{ matrix.unityLicense }} with: projectPath: ${{ matrix.projectPath }} unityVersion: ${{ matrix.unityVersion }} targetPlatform: ${{ matrix.targetPlatform }} customParameters: -profile SomeProfile -someBoolean -someValue exampleValue + + ########################### + # Upload # + ########################### - uses: actions/upload-artifact@v2 with: name: Build (${{ matrix.unityVersion }}) path: build retention-days: 14 + k8sBuilds: name: K8s build for ${{ matrix.targetPlatform }} on version ${{ matrix.unityVersion }} runs-on: ubuntu-latest @@ -92,16 +113,38 @@ jobs: targetPlatform: - StandaloneLinux64 - StandaloneWindows64 + unityLicense: + - ${{ secrets.UNITY_LICENSE }} steps: - - uses: actions/checkout@v2 + ########################### + # Checkout # + ########################### + - name: Checkout (default) + uses: actions/checkout@v2 + if: github.event.event_type != 'pull_request_target' with: lfs: true + - name: Checkout (pull_request_target) + uses: actions/checkout@v2 + if: github.event.event_type == 'pull_request_target' + with: + lfs: true + ref: ${{ github.event.pull_request.head.ref }} + repository: ${{ github.event.pull_request.head.repo.full_name }} + + ########################### + # Spin up # + ########################### - uses: GoogleCloudPlatform/github-actions/setup-gcloud@master with: version: '288.0.0' service_account_email: ${{ secrets.GOOGLE_SERVICE_ACCOUNT_EMAIL }} service_account_key: ${{ secrets.GOOGLE_SERVICE_ACCOUNT_KEY }} - run: ./action/bootstrapper/ApplyClusterAndAcquireLock.sh ${{ env.GKE_PROJECT }} ${{ env.GKE_CLUSTER }} ${{ env.GKE_ZONE }} + + ########################### + # Build # + ########################### - uses: frostebite/File-To-Base64@master id: read-base64 with: @@ -109,13 +152,17 @@ jobs: - uses: ./ id: k8s-unity-build env: - UNITY_LICENSE: "\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \nbpzWx3PZ0lqWDo1m9aLQuZ4cweo=QcDm4/qAXZuUMQbUVk63vO6u66Bp8PnqqWQcZZOcym/rGUZLj1sr66EquF3X3w1L7aqiwMGtbY2b\nkPttcalFeaBkc5NsJMrexWjuBCxQvhbmVFQnTjvC6vNS+k1wrkz7If1oPkz/XaDtCfUs8oxc9iPe\nPzzUJIVYLZoDtpPq2XbgVn9/TiVb3Zu6ldKgvtNRYUjrB3KywtvL9OcIFll3htRcBZPG43kxryJc\nDD2TL5Nw1JuX6MejBBuYTZsZNpGX9Pjop9+uFUZ4GI9h8a5g6wJUfXzsGw7j4gkvDkC9MvyWiksi\n2hNXw1QNeB6JfQsd4sAuhYh/CqTm2gCz9i9ZpA==" + UNITY_LICENSE: ${{ matrix.unityLicense }} with: targetPlatform: ${{ matrix.targetPlatform }} kubeConfig: ${{ steps.read-base64.outputs.base64 }} githubToken: ${{ secrets.GITHUB_TOKEN }} projectPath: test-project unityVersion: 2019.3.15f1 + + ########################### + # Upload # + ########################### - uses: frostebite/K8s-Download-Volume@master with: kubeConfig: ${{ steps.read-base64.outputs.base64 }} @@ -126,5 +173,9 @@ jobs: name: Kubernetes Build (${{ matrix.targetPlatform }}) path: k8s-volume-download retention-days: 14 + + ########################### + # Spin down # + ########################### - run: ./action/bootstrapper/ReleaseLockAndAttemptShutdown.sh ${{ env.GKE_PROJECT }} ${{ env.GKE_CLUSTER }} ${{ env.GKE_ZONE }} if: ${{ always() }}