<commit_before>name: release

on:
  push:
    tags:
      - "[0-9]+.[0-9]+.[0-9]+*"

jobs:
  # The build job is responsible for: configuring the environment, testing and compiling process
  build:
    strategy:
      matrix:
        include:
        - operating-system: ubuntu-18.04
        - operating-system: windows-2019
          arch: -386
        - operating-system: windows-2019
          arch: -amd64
        - operating-system: macos-10.15

    runs-on: ${{ matrix.operating-system }}

    steps:
      - name: Disable EOL conversions
        run: git config --global core.autocrlf false

      - name: Checkout
        uses: actions/checkout@v2

      - name: Install Go
        uses: actions/setup-go@v2
        with:
          go-version: "1.14"

        # dependencies used for compiling the GUI
      - name: Install Dependencies (Linux)
        run: sudo apt update && sudo apt install -y --no-install-recommends build-essential libgtk-3-dev libwebkit2gtk-4.0-dev libappindicator3-dev
        if: matrix.operating-system == 'ubuntu-18.04'

      - name: Install Go deps
        # Since 10/23/2019 pwsh is the default shell
        # on Windows, but pwsh fails to install protoc-gen-go so
        # we force bash as default shell for all OSes in this task
        run: |
          go get github.com/golangci/govet
          go get golang.org/x/lint/golint
        shell: bash

      - name: Install Taskfile
        uses: arduino/actions/setup-taskfile@master
        with:
          version: '3.x'
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Check the code is good
        run: task check

      - name: Run unit tests
        run: task test-unit

      - name: Build the Agent for linux
        run: task build TAG_VERSION=${GITHUB_REF##*/} 
        if: matrix.operating-system == 'ubuntu-18.04'

        # build the agent without GUI support (no tray icon)
      - name: Build the Agent-cli
        run: task build-cli TAG_VERSION=${GITHUB_REF##*/}
        if: matrix.operating-system == 'ubuntu-18.04'

        # the manifest is required by windows GUI apps, otherwise the binary will crash with: "Unable to create main window: TTM_ADDTOOL failed" (for reference https://github.com/lxn/walk/issues/28)
        # rsrc will produce a *.syso file that should get automatically recognized by go build command and linked into an executable.
      - name: Download tool to embed manifest in win binary
        run: go get github.com/akavel/rsrc
        if: matrix.operating-system == 'windows-2019'

        # building the agent for win requires a different task because of an extra flag
      - name: Build the Agent for win32
        env:
          GOARCH: 386  # 32bit architecture (for support)
          GO386: 387  # support old instruction sets without MMX (used in the Pentium 4) (will be deprecated in GO > 1.15 https://golang.org/doc/go1.15)
        run: task build-win TAG_VERSION=${GITHUB_REF##*/}
        if: matrix.operating-system == 'windows-2019' && matrix.arch == '-386'

      - name: Build the Agent for win64
        run: task build-win TAG_VERSION=${GITHUB_REF##*/} # GOARCH=amd64 by default on the runners
        if: matrix.operating-system == 'windows-2019' && matrix.arch == '-amd64'

      - name: Build the Agent for macos
        env:
          MACOSX_DEPLOYMENT_TARGET: 10.11 # minimum supported version for mac
          CGO_CFLAGS: -mmacosx-version-min=10.11
          CGO_LDFLAGS: -mmacosx-version-min=10.11
        run: task build TAG_VERSION=${GITHUB_REF##*/}
        if: matrix.operating-system == 'macos-10.15'

        # config.ini is required by the executable when it's run
      - name: Upload artifacts
        uses: actions/upload-artifact@v2
        with:
          name: arduino-create-agent-${{ matrix.operating-system }}${{ matrix.arch }}
          path: |
            arduino-create-agent*
            config.ini
          if-no-files-found: error

  # The code-sign-mac-executable job will download the macos artifact from the previous job, sign e notarize the binary and re-upload it.
  code-sign-mac-executable:
    needs: build
    runs-on: macos-10.15
    env:
      RUNS_ON: macos-10.15  # used to parametrize filenames

    steps:
      - name: Download artifact
        uses: actions/download-artifact@v2
        with:
          name: arduino-create-agent-${{ env.RUNS_ON }}
          path: arduino-create-agent-${{ env.RUNS_ON }}

      - name: Import Code-Signing Certificates
        env:
          KEYCHAIN: "sign.keychain"
          INSTALLER_CERT_MAC_PATH: "/tmp/ArduinoCerts2020.p12"
        run: |
          echo "${{ secrets.INSTALLER_CERT_MAC_P12 }}" | base64 --decode > ${{ env.INSTALLER_CERT_MAC_PATH }}
          security create-keychain -p ${{ secrets.KEYCHAIN_PASSWORD }} ${{ env.KEYCHAIN }}
          security default-keychain -s ${{ env.KEYCHAIN }}
          security unlock-keychain -p ${{ secrets.KEYCHAIN_PASSWORD }} ${{ env.KEYCHAIN }}
          security import ${{ env.INSTALLER_CERT_MAC_PATH }} -k ${{ env.KEYCHAIN }} -f pkcs12 -A -T /usr/bin/codesign -P ${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}
          security set-key-partition-list -S apple-tool:,apple: -s -k ${{ secrets.KEYCHAIN_PASSWORD }} ${{ env.KEYCHAIN }}

      - name: Install gon for code signing and app notarization
        run: |
          wget -q https://github.com/mitchellh/gon/releases/download/v0.2.3/gon_macos.zip
          unzip gon_macos.zip -d /usr/local/bin

      - name: Write gon config to file
        # gon does not allow env variables in config file (https://github.com/mitchellh/gon/issues/20)
        run: |
          cat > gon.config.hcl <<EOF
          source = ["arduino-create-agent-${{ env.RUNS_ON }}/arduino-create-agent"]
          bundle_id = "cc.arduino.arduino-agent"
          sign {
            application_identity = "Developer ID Application: ARDUINO SA (7KT7ZWMCJT)"
          }
          # Ask Gon for zip output to force notarization process to take place.
          # The CI will ignore the zip output, using the signed binary only.
          zip {
            output_path = "arduino-create-agent.zip"
          }
          EOF

      - name: Code sign and notarize app
        env:
          AC_USERNAME: ${{ secrets.AC_USERNAME }}
          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
        run: |
          echo "gon will notarize executable in arduino-create-agent-${{ env.RUNS_ON }}/arduino-create-agent"
          gon -log-level=debug -log-json gon.config.hcl
        timeout-minutes: 30

        # This step will overwrite the non signed mac artifact (arduino-create-agent-${{ env.RUNS_ON }})
      - name: Upload artifact
        uses: actions/upload-artifact@v2
        with:
          name: arduino-create-agent-${{ env.RUNS_ON }}
          path: arduino-create-agent-${{ env.RUNS_ON }}
          if-no-files-found: error

  # This job is responsible for generating the installers (using installbuilder)
  package:
    needs: code-sign-mac-executable
    runs-on: ubuntu-18.04

    env:
      # vars used by installbuilder
      INSTALLBUILDER_PATH: "/opt/installbuilder-20.9.0/bin/builder"
      # INSTALLER_VARS: "project.outputDirectory=$PWD project.version=${GITHUB_REF##*/} workspace=$PWD realname=Arduino_Create_Bridge"
      # vars passed to installbuilder to install https certs automatically
      CERT_INSTALL: "ask_certificates_install=CI"  # win(edge),mac(safari)
      NO_CERT_INSTALL: "ask_certificates_install=CS"  # linux
      CHOICE_CERT_INSTALL: "ask_certificates_install=CC"  # win,mac:(ff,chrome)
      CREATE_OSX_BUNDLED_MG: 0  # tell installbuilder to not create the DMG, gon will take care of that later
      # installbuilder will read this vars automatically (defined in installer.xml):
      INSTALLER_CERT_WINDOWS_PASSWORD: ${{ secrets.INSTALLER_CERT_WINDOWS_PASSWORD }}
      INSTALLER_CERT_WINDOWS_PFX: "/tmp/ArduinoCerts2020.pfx"
      INSTALLER_CERT_MAC_PASSWORD: ${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}
      INSTALLER_CERT_MAC_P12: "/tmp/ArduinoCerts2020.p12"

    strategy:
      fail-fast: false  # if one os is failing continue nonetheless
      matrix:  # used to generate installers for different OS and not for runs-on

        include:
          - operating-system: ubuntu-18.04
            install-builder-name: linux-x64
            executable-path: artifacts/linux-amd64/
          - operating-system: windows-2019
            arch: -386
            browser: edge
            install-builder-name: windows
            executable-path: artifacts/windows/
            extension: .exe
            installer-extension: .exe
          - operating-system: windows-2019
            arch: -amd64
            browser: edge
            install-builder-name: windows
            executable-path: artifacts/windows/
            extension: .exe
            installer-extension: .exe
          - operating-system: macos-10.15
            browser: safari
            install-builder-name: osx
            executable-path: 'skel/ArduinoCreateAgent.app/Contents/MacOS/'
            installer-extension: .app

    container:
      image: floydpink/ubuntu-install-builder:20.9.0

    steps:

        # workaround to strip bugfix number from semver (only to make 1.1 release) I will change this in the future
      - name: Set version env vars
        # VERSION will be available only in the next step
        run: |
          echo "VERSION=${GITHUB_REF##*/}" >> $GITHUB_ENV

      - name: Set installer env vars
        run: |
          echo INSTALLER_VARS="project.outputDirectory=$PWD project.version=${VERSION%.*} workspace=$PWD realname=Arduino_Create_Bridge" >> $GITHUB_ENV

      - name: Checkout
        uses: actions/checkout@v2
        with:
          repository: 'bcmi-labs/arduino-create-agent-installer'  # the repo which contains install.xml
          token: ${{ secrets.ARDUINO_CREATE_AGENT_CI_PAT }}

      - name: Download artifact
        uses: actions/download-artifact@v2
        with:
          name: arduino-create-agent-${{ matrix.operating-system }}${{ matrix.arch }}
          path: ${{ matrix.executable-path }}  # path expected by installbuilder

        # zip artifacts do not mantain executable permission
      - name: Make executable
        run: chmod -v +x ${{ matrix.executable-path }}arduino-create-agent*
        if: matrix.operating-system == 'ubuntu-18.04' || matrix.operating-system == 'macos-10.15'

      - name: Rename executable to Arduino_Create_Bridge
        run: mv -v ${{ matrix.executable-path }}arduino-create-agent${{ matrix.extension }} ${{ matrix.executable-path }}Arduino_Create_Bridge${{ matrix.extension }}

      - name: Rename executable to Arduino_Create_Bridge_cli
        run: mv -v ${{ matrix.executable-path }}arduino-create-agent_cli${{ matrix.extension }} ${{ matrix.executable-path }}Arduino_Create_Bridge_cli${{ matrix.extension }}
        if: matrix.operating-system == 'ubuntu-18.04'

      - name: Save InstallBuilder license to file
        run: echo "${{ secrets.INSTALLER_LICENSE }}" > /tmp/license.xml

      - name: Save Win signing certificate to file
        run: echo "${{ secrets.INSTALLER_CERT_WINDOWS_PFX }}" | base64 --decode > ${{ env.INSTALLER_CERT_WINDOWS_PFX}}
        if: matrix.operating-system == 'windows-2019'

      - name: Save macos signing certificate to file
        run: echo "${{ secrets.INSTALLER_CERT_MAC_P12 }}" | base64 --decode  > ${{ env.INSTALLER_CERT_MAC_P12 }}
        if: matrix.operating-system == 'macos-10.15'

        # win(edge),mac(safari) -> CERT_INSTALL and win,mac:(ff,chrome) -> CHOICE_CERT_INSTALL
        # installbuilder reads the env vars with certs paths and use it to sign the installer.
      - name: Launch Bitrock installbuilder-20 with CERT_INSTALL && CHOICE_CERT_INSTALL
        run: |
          ${{ env.INSTALLBUILDER_PATH }} build installer.xml ${{ matrix.install-builder-name }} --verbose --license /tmp/license.xml  --setvars ${INSTALLER_VARS} ${{ env.CERT_INSTALL }}
          mv -v ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-CI${{matrix.installer-extension}} ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}${{ matrix.arch }}-installer-${{matrix.browser}}${{matrix.installer-extension}}
          ${{ env.INSTALLBUILDER_PATH }} build installer.xml ${{ matrix.install-builder-name }} --verbose --license /tmp/license.xml  --setvars ${INSTALLER_VARS} ${{ env.CHOICE_CERT_INSTALL }}
          cp -vr ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-CC${{matrix.installer-extension}} ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}${{ matrix.arch }}-installer-chrome${{matrix.installer-extension}}
          mv -v ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-CC${{matrix.installer-extension}} ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}${{ matrix.arch }}-installer-firefox${{matrix.installer-extension}}
          rm -r ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-C*
        if: matrix.operating-system == 'windows-2019' || matrix.operating-system == 'macos-10.15'

        # linux
      - name: Launch Bitrock installbuilder-20 with NO_CERT_INSTALL
        run: |
          ${{ env.INSTALLBUILDER_PATH }} build installer.xml ${{ matrix.install-builder-name }} --verbose --license /tmp/license.xml  --setvars ${INSTALLER_VARS} ${{ env.NO_CERT_INSTALL }}
          cp -v ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-CS.run ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-chrome.run
          mv -v ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-CS.run ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-firefox.run
          cp -v ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-CS.tar.gz ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-chrome.tar.gz
          mv -v ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-CS.tar.gz ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-firefox.tar.gz
        if: matrix.operating-system == 'ubuntu-18.04'

      - name: Upload artifacts
        uses: actions/upload-artifact@v2
        with:
          name: ArduinoCreateAgent-${{ matrix.install-builder-name }}${{ matrix.arch }}
          path: ArduinoCreateAgent*
          if-no-files-found: error

  # This job will sign and notarize mac installers
  code-sign-mac-installers:
    needs: package
    runs-on: macos-10.15

    strategy:
      matrix:
        browser: [safari, firefox, chrome]

    steps:

      - name: Download artifact
        uses: actions/download-artifact@v2
        with:
          name: ArduinoCreateAgent-osx
          path: ArduinoCreateAgent-osx

        # workaround to strip bugfix number from semver (only to make 1.1 release) I will change this in the future
      - name: Set version env vars
        # VERSION will be available only in the next step
        run: |
          echo "VERSION=${GITHUB_REF##*/}" >> $GITHUB_ENV

        # zip artifacts do not mantain executable permission
      - name: Make executable
        run: chmod -v +x ArduinoCreateAgent-osx/ArduinoCreateAgent-${VERSION%.*}-osx-installer-${{ matrix.browser }}.app/Contents/MacOS/*

      - name: Import Code-Signing Certificates
        env:
          KEYCHAIN: "sign.keychain"
          INSTALLER_CERT_MAC_PATH: "/tmp/ArduinoCerts2020.p12"
        run: |
          echo "${{ secrets.INSTALLER_CERT_MAC_P12 }}" | base64 --decode > ${{ env.INSTALLER_CERT_MAC_PATH }}
          security create-keychain -p ${{ secrets.KEYCHAIN_PASSWORD }} ${{ env.KEYCHAIN }}
          security default-keychain -s ${{ env.KEYCHAIN }}
          security unlock-keychain -p ${{ secrets.KEYCHAIN_PASSWORD }} ${{ env.KEYCHAIN }}
          security import ${{ env.INSTALLER_CERT_MAC_PATH }} -k ${{ env.KEYCHAIN }} -f pkcs12 -A -T /usr/bin/codesign -P ${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}
          security set-key-partition-list -S apple-tool:,apple: -s -k ${{ secrets.KEYCHAIN_PASSWORD }} ${{ env.KEYCHAIN }}

      - name: Install gon for code signing and app notarization
        run: |
          wget -q https://github.com/mitchellh/gon/releases/download/v0.2.3/gon_macos.zip
          unzip gon_macos.zip -d /usr/local/bin

      - name: Write gon config to file
        # gon does not allow env variables in config file (https://github.com/mitchellh/gon/issues/20)
        run: |
          cat > gon.config_installer.hcl <<EOF
          source = ["ArduinoCreateAgent-osx/ArduinoCreateAgent-${VERSION%.*}-osx-installer-${{ matrix.browser }}.app"]
          bundle_id = "cc.arduino.arduino-agent-installer"

          sign {
            application_identity = "Developer ID Application: ARDUINO SA (7KT7ZWMCJT)"
          }

          dmg {
            output_path = "ArduinoCreateAgent-${VERSION%.*}-osx-installer-${{ matrix.browser }}.dmg"
            volume_name = "ArduinoCreateAgent"
          }
          EOF

      - name: Code sign and notarize app
        env:
          AC_USERNAME: ${{ secrets.AC_USERNAME }}
          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
        run: |
          echo "gon will notarize executable in ArduinoCreateAgent-osx/ArduinoCreateAgent-${VERSION%.*}-osx-installer-${{ matrix.browser }}.app"
          gon -log-level=debug -log-json gon.config_installer.hcl
        timeout-minutes: 30

      #  tar dmg file to keep executable permission
      - name: Tar files to keep permissions
        run: tar -cvf ArduinoCreateAgent-${VERSION%.*}-osx-installer-${{ matrix.browser }}.tar ArduinoCreateAgent-${VERSION%.*}-osx-installer-${{ matrix.browser }}.dmg

      - name: Upload artifacts
        uses: actions/upload-artifact@v2
        with:
          name: ArduinoCreateAgent-osx
          path: ArduinoCreateAgent*.tar
          if-no-files-found: error

  create-release:
    runs-on: ubuntu-18.04
    needs: code-sign-mac-installers
    env:
      PLUGIN_TARGET: "/CreateBridgeStable/"
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

    steps:

      - name: Download artifact
        uses: actions/download-artifact@v2 # download all the artifacts

      - name: Identify Prerelease
        # This is a workaround while waiting for create-release action to implement auto pre-release based on tag
        id: prerelease
        run: |
          wget -q -P /tmp https://github.com/fsaintjacques/semver-tool/archive/3.1.0.zip
          unzip -p /tmp/3.1.0.zip semver-tool-3.1.0/src/semver >/tmp/semver && chmod +x /tmp/semver
          if [[ $(/tmp/semver get prerel ${GITHUB_REF/refs\/tags\//}) ]]; then echo "::set-output name=IS_PRE::true"; fi

      #  mandatory step because upload-release-action does not support multiple folders
      - name: prepare artifacts for the release
        run: |
          mkdir release
          chmod -v +x ArduinoCreateAgent-linux-x64/*.run
          mv -v ArduinoCreateAgent-linux-x64/* release/
          cat ArduinoCreateAgent-osx/*.tar | tar -xvf - -i -C release/
          rm -v release/._ArduinoCreateAgent*.dmg
          mv -v ArduinoCreateAgent-windows*/* release/

      - name: Create Github Release
        uses: actions/create-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ github.ref }}
          release_name: ${{ github.ref }}
          body: ""
          draft: false
          prerelease: ${{ steps.prerelease.outputs.IS_PRE }}

      - name: Upload release files on Github
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          tag: ${{ github.ref }}
          file_glob: true  # If set to true, the file argument can be a glob pattern
          file: release/*

      - name: Upload release files on Arduino downloads servers
        run: aws s3 sync release/ s3://${{ secrets.DOWNLOADS_BUCKET }}${{ env.PLUGIN_TARGET }} --include "*"
        if: steps.prerelease.outputs.IS_PRE != 'true'
<commit_msg>fix wrongly set windows version variable<commit_after>name: release

on:
  push:
    tags:
      - "[0-9]+.[0-9]+.[0-9]+*"

jobs:
  # The build job is responsible for: configuring the environment, testing and compiling process
  build:
    strategy:
      matrix:
        include:
        - operating-system: ubuntu-18.04
        - operating-system: windows-2019
          arch: -386
        - operating-system: windows-2019
          arch: -amd64
        - operating-system: macos-10.15

    runs-on: ${{ matrix.operating-system }}

    steps:
      - name: Set version
        run: echo "TAG_VERSION=${GITHUB_REF##*/}" >> $GITHUB_ENV
        shell: bash

      - name: Disable EOL conversions
        run: git config --global core.autocrlf false

      - name: Checkout
        uses: actions/checkout@v2

      - name: Install Go
        uses: actions/setup-go@v2
        with:
          go-version: "1.14"

        # dependencies used for compiling the GUI
      - name: Install Dependencies (Linux)
        run: sudo apt update && sudo apt install -y --no-install-recommends build-essential libgtk-3-dev libwebkit2gtk-4.0-dev libappindicator3-dev
        if: matrix.operating-system == 'ubuntu-18.04'

      - name: Install Go deps
        # Since 10/23/2019 pwsh is the default shell
        # on Windows, but pwsh fails to install protoc-gen-go so
        # we force bash as default shell for all OSes in this task
        run: |
          go get github.com/golangci/govet
          go get golang.org/x/lint/golint
        shell: bash

      - name: Install Taskfile
        uses: arduino/actions/setup-taskfile@master
        with:
          version: '3.x'
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Check the code is good
        run: task check

      - name: Run unit tests
        run: task test-unit

      - name: Build the Agent for linux
        run: task build
        if: matrix.operating-system == 'ubuntu-18.04'

        # build the agent without GUI support (no tray icon)
      - name: Build the Agent-cli
        run: task build-cli
        if: matrix.operating-system == 'ubuntu-18.04'

        # the manifest is required by windows GUI apps, otherwise the binary will crash with: "Unable to create main window: TTM_ADDTOOL failed" (for reference https://github.com/lxn/walk/issues/28)
        # rsrc will produce a *.syso file that should get automatically recognized by go build command and linked into an executable.
      - name: Download tool to embed manifest in win binary
        run: go get github.com/akavel/rsrc
        if: matrix.operating-system == 'windows-2019'

        # building the agent for win requires a different task because of an extra flag
      - name: Build the Agent for win32
        env:
          GOARCH: 386  # 32bit architecture (for support)
          GO386: 387  # support old instruction sets without MMX (used in the Pentium 4) (will be deprecated in GO > 1.15 https://golang.org/doc/go1.15)
        run: task build-win
        if: matrix.operating-system == 'windows-2019' && matrix.arch == '-386'

      - name: Build the Agent for win64
        run: task build-win # GOARCH=amd64 by default on the runners
        if: matrix.operating-system == 'windows-2019' && matrix.arch == '-amd64'

      - name: Build the Agent for macos
        env:
          MACOSX_DEPLOYMENT_TARGET: 10.11 # minimum supported version for mac
          CGO_CFLAGS: -mmacosx-version-min=10.11
          CGO_LDFLAGS: -mmacosx-version-min=10.11
        run: task build
        if: matrix.operating-system == 'macos-10.15'

        # config.ini is required by the executable when it's run
      - name: Upload artifacts
        uses: actions/upload-artifact@v2
        with:
          name: arduino-create-agent-${{ matrix.operating-system }}${{ matrix.arch }}
          path: |
            arduino-create-agent*
            config.ini
          if-no-files-found: error

  # The code-sign-mac-executable job will download the macos artifact from the previous job, sign e notarize the binary and re-upload it.
  code-sign-mac-executable:
    needs: build
    runs-on: macos-10.15
    env:
      RUNS_ON: macos-10.15  # used to parametrize filenames

    steps:
      - name: Download artifact
        uses: actions/download-artifact@v2
        with:
          name: arduino-create-agent-${{ env.RUNS_ON }}
          path: arduino-create-agent-${{ env.RUNS_ON }}

      - name: Import Code-Signing Certificates
        env:
          KEYCHAIN: "sign.keychain"
          INSTALLER_CERT_MAC_PATH: "/tmp/ArduinoCerts2020.p12"
        run: |
          echo "${{ secrets.INSTALLER_CERT_MAC_P12 }}" | base64 --decode > ${{ env.INSTALLER_CERT_MAC_PATH }}
          security create-keychain -p ${{ secrets.KEYCHAIN_PASSWORD }} ${{ env.KEYCHAIN }}
          security default-keychain -s ${{ env.KEYCHAIN }}
          security unlock-keychain -p ${{ secrets.KEYCHAIN_PASSWORD }} ${{ env.KEYCHAIN }}
          security import ${{ env.INSTALLER_CERT_MAC_PATH }} -k ${{ env.KEYCHAIN }} -f pkcs12 -A -T /usr/bin/codesign -P ${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}
          security set-key-partition-list -S apple-tool:,apple: -s -k ${{ secrets.KEYCHAIN_PASSWORD }} ${{ env.KEYCHAIN }}

      - name: Install gon for code signing and app notarization
        run: |
          wget -q https://github.com/mitchellh/gon/releases/download/v0.2.3/gon_macos.zip
          unzip gon_macos.zip -d /usr/local/bin

      - name: Write gon config to file
        # gon does not allow env variables in config file (https://github.com/mitchellh/gon/issues/20)
        run: |
          cat > gon.config.hcl <<EOF
          source = ["arduino-create-agent-${{ env.RUNS_ON }}/arduino-create-agent"]
          bundle_id = "cc.arduino.arduino-agent"
          sign {
            application_identity = "Developer ID Application: ARDUINO SA (7KT7ZWMCJT)"
          }
          # Ask Gon for zip output to force notarization process to take place.
          # The CI will ignore the zip output, using the signed binary only.
          zip {
            output_path = "arduino-create-agent.zip"
          }
          EOF

      - name: Code sign and notarize app
        env:
          AC_USERNAME: ${{ secrets.AC_USERNAME }}
          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
        run: |
          echo "gon will notarize executable in arduino-create-agent-${{ env.RUNS_ON }}/arduino-create-agent"
          gon -log-level=debug -log-json gon.config.hcl
        timeout-minutes: 30

        # This step will overwrite the non signed mac artifact (arduino-create-agent-${{ env.RUNS_ON }})
      - name: Upload artifact
        uses: actions/upload-artifact@v2
        with:
          name: arduino-create-agent-${{ env.RUNS_ON }}
          path: arduino-create-agent-${{ env.RUNS_ON }}
          if-no-files-found: error

  # This job is responsible for generating the installers (using installbuilder)
  package:
    needs: code-sign-mac-executable
    runs-on: ubuntu-18.04

    env:
      # vars used by installbuilder
      INSTALLBUILDER_PATH: "/opt/installbuilder-20.9.0/bin/builder"
      # INSTALLER_VARS: "project.outputDirectory=$PWD project.version=${GITHUB_REF##*/} workspace=$PWD realname=Arduino_Create_Bridge"
      # vars passed to installbuilder to install https certs automatically
      CERT_INSTALL: "ask_certificates_install=CI"  # win(edge),mac(safari)
      NO_CERT_INSTALL: "ask_certificates_install=CS"  # linux
      CHOICE_CERT_INSTALL: "ask_certificates_install=CC"  # win,mac:(ff,chrome)
      CREATE_OSX_BUNDLED_MG: 0  # tell installbuilder to not create the DMG, gon will take care of that later
      # installbuilder will read this vars automatically (defined in installer.xml):
      INSTALLER_CERT_WINDOWS_PASSWORD: ${{ secrets.INSTALLER_CERT_WINDOWS_PASSWORD }}
      INSTALLER_CERT_WINDOWS_PFX: "/tmp/ArduinoCerts2020.pfx"
      INSTALLER_CERT_MAC_PASSWORD: ${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}
      INSTALLER_CERT_MAC_P12: "/tmp/ArduinoCerts2020.p12"

    strategy:
      fail-fast: false  # if one os is failing continue nonetheless
      matrix:  # used to generate installers for different OS and not for runs-on

        include:
          - operating-system: ubuntu-18.04
            install-builder-name: linux-x64
            executable-path: artifacts/linux-amd64/
          - operating-system: windows-2019
            arch: -386
            browser: edge
            install-builder-name: windows
            executable-path: artifacts/windows/
            extension: .exe
            installer-extension: .exe
          - operating-system: windows-2019
            arch: -amd64
            browser: edge
            install-builder-name: windows
            executable-path: artifacts/windows/
            extension: .exe
            installer-extension: .exe
          - operating-system: macos-10.15
            browser: safari
            install-builder-name: osx
            executable-path: 'skel/ArduinoCreateAgent.app/Contents/MacOS/'
            installer-extension: .app

    container:
      image: floydpink/ubuntu-install-builder:20.9.0

    steps:

        # workaround to strip bugfix number from semver (only to make 1.1 release) I will change this in the future
      - name: Set version env vars
        # VERSION will be available only in the next step
        run: |
          echo "VERSION=${GITHUB_REF##*/}" >> $GITHUB_ENV

      - name: Set installer env vars
        run: |
          echo INSTALLER_VARS="project.outputDirectory=$PWD project.version=${VERSION%.*} workspace=$PWD realname=Arduino_Create_Bridge" >> $GITHUB_ENV

      - name: Checkout
        uses: actions/checkout@v2
        with:
          repository: 'bcmi-labs/arduino-create-agent-installer'  # the repo which contains install.xml
          token: ${{ secrets.ARDUINO_CREATE_AGENT_CI_PAT }}

      - name: Download artifact
        uses: actions/download-artifact@v2
        with:
          name: arduino-create-agent-${{ matrix.operating-system }}${{ matrix.arch }}
          path: ${{ matrix.executable-path }}  # path expected by installbuilder

        # zip artifacts do not mantain executable permission
      - name: Make executable
        run: chmod -v +x ${{ matrix.executable-path }}arduino-create-agent*
        if: matrix.operating-system == 'ubuntu-18.04' || matrix.operating-system == 'macos-10.15'

      - name: Rename executable to Arduino_Create_Bridge
        run: mv -v ${{ matrix.executable-path }}arduino-create-agent${{ matrix.extension }} ${{ matrix.executable-path }}Arduino_Create_Bridge${{ matrix.extension }}

      - name: Rename executable to Arduino_Create_Bridge_cli
        run: mv -v ${{ matrix.executable-path }}arduino-create-agent_cli${{ matrix.extension }} ${{ matrix.executable-path }}Arduino_Create_Bridge_cli${{ matrix.extension }}
        if: matrix.operating-system == 'ubuntu-18.04'

      - name: Save InstallBuilder license to file
        run: echo "${{ secrets.INSTALLER_LICENSE }}" > /tmp/license.xml

      - name: Save Win signing certificate to file
        run: echo "${{ secrets.INSTALLER_CERT_WINDOWS_PFX }}" | base64 --decode > ${{ env.INSTALLER_CERT_WINDOWS_PFX}}
        if: matrix.operating-system == 'windows-2019'

      - name: Save macos signing certificate to file
        run: echo "${{ secrets.INSTALLER_CERT_MAC_P12 }}" | base64 --decode  > ${{ env.INSTALLER_CERT_MAC_P12 }}
        if: matrix.operating-system == 'macos-10.15'

        # win(edge),mac(safari) -> CERT_INSTALL and win,mac:(ff,chrome) -> CHOICE_CERT_INSTALL
        # installbuilder reads the env vars with certs paths and use it to sign the installer.
      - name: Launch Bitrock installbuilder-20 with CERT_INSTALL && CHOICE_CERT_INSTALL
        run: |
          ${{ env.INSTALLBUILDER_PATH }} build installer.xml ${{ matrix.install-builder-name }} --verbose --license /tmp/license.xml  --setvars ${INSTALLER_VARS} ${{ env.CERT_INSTALL }}
          mv -v ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-CI${{matrix.installer-extension}} ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}${{ matrix.arch }}-installer-${{matrix.browser}}${{matrix.installer-extension}}
          ${{ env.INSTALLBUILDER_PATH }} build installer.xml ${{ matrix.install-builder-name }} --verbose --license /tmp/license.xml  --setvars ${INSTALLER_VARS} ${{ env.CHOICE_CERT_INSTALL }}
          cp -vr ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-CC${{matrix.installer-extension}} ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}${{ matrix.arch }}-installer-chrome${{matrix.installer-extension}}
          mv -v ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-CC${{matrix.installer-extension}} ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}${{ matrix.arch }}-installer-firefox${{matrix.installer-extension}}
          rm -r ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-C*
        if: matrix.operating-system == 'windows-2019' || matrix.operating-system == 'macos-10.15'

        # linux
      - name: Launch Bitrock installbuilder-20 with NO_CERT_INSTALL
        run: |
          ${{ env.INSTALLBUILDER_PATH }} build installer.xml ${{ matrix.install-builder-name }} --verbose --license /tmp/license.xml  --setvars ${INSTALLER_VARS} ${{ env.NO_CERT_INSTALL }}
          cp -v ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-CS.run ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-chrome.run
          mv -v ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-CS.run ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-firefox.run
          cp -v ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-CS.tar.gz ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-chrome.tar.gz
          mv -v ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-CS.tar.gz ArduinoCreateAgent-${VERSION%.*}-${{ matrix.install-builder-name }}-installer-firefox.tar.gz
        if: matrix.operating-system == 'ubuntu-18.04'

      - name: Upload artifacts
        uses: actions/upload-artifact@v2
        with:
          name: ArduinoCreateAgent-${{ matrix.install-builder-name }}${{ matrix.arch }}
          path: ArduinoCreateAgent*
          if-no-files-found: error

  # This job will sign and notarize mac installers
  code-sign-mac-installers:
    needs: package
    runs-on: macos-10.15

    strategy:
      matrix:
        browser: [safari, firefox, chrome]

    steps:

      - name: Download artifact
        uses: actions/download-artifact@v2
        with:
          name: ArduinoCreateAgent-osx
          path: ArduinoCreateAgent-osx

        # workaround to strip bugfix number from semver (only to make 1.1 release) I will change this in the future
      - name: Set version env vars
        # VERSION will be available only in the next step
        run: |
          echo "VERSION=${GITHUB_REF##*/}" >> $GITHUB_ENV

        # zip artifacts do not mantain executable permission
      - name: Make executable
        run: chmod -v +x ArduinoCreateAgent-osx/ArduinoCreateAgent-${VERSION%.*}-osx-installer-${{ matrix.browser }}.app/Contents/MacOS/*

      - name: Import Code-Signing Certificates
        env:
          KEYCHAIN: "sign.keychain"
          INSTALLER_CERT_MAC_PATH: "/tmp/ArduinoCerts2020.p12"
        run: |
          echo "${{ secrets.INSTALLER_CERT_MAC_P12 }}" | base64 --decode > ${{ env.INSTALLER_CERT_MAC_PATH }}
          security create-keychain -p ${{ secrets.KEYCHAIN_PASSWORD }} ${{ env.KEYCHAIN }}
          security default-keychain -s ${{ env.KEYCHAIN }}
          security unlock-keychain -p ${{ secrets.KEYCHAIN_PASSWORD }} ${{ env.KEYCHAIN }}
          security import ${{ env.INSTALLER_CERT_MAC_PATH }} -k ${{ env.KEYCHAIN }} -f pkcs12 -A -T /usr/bin/codesign -P ${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}
          security set-key-partition-list -S apple-tool:,apple: -s -k ${{ secrets.KEYCHAIN_PASSWORD }} ${{ env.KEYCHAIN }}

      - name: Install gon for code signing and app notarization
        run: |
          wget -q https://github.com/mitchellh/gon/releases/download/v0.2.3/gon_macos.zip
          unzip gon_macos.zip -d /usr/local/bin

      - name: Write gon config to file
        # gon does not allow env variables in config file (https://github.com/mitchellh/gon/issues/20)
        run: |
          cat > gon.config_installer.hcl <<EOF
          source = ["ArduinoCreateAgent-osx/ArduinoCreateAgent-${VERSION%.*}-osx-installer-${{ matrix.browser }}.app"]
          bundle_id = "cc.arduino.arduino-agent-installer"

          sign {
            application_identity = "Developer ID Application: ARDUINO SA (7KT7ZWMCJT)"
          }

          dmg {
            output_path = "ArduinoCreateAgent-${VERSION%.*}-osx-installer-${{ matrix.browser }}.dmg"
            volume_name = "ArduinoCreateAgent"
          }
          EOF

      - name: Code sign and notarize app
        env:
          AC_USERNAME: ${{ secrets.AC_USERNAME }}
          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
        run: |
          echo "gon will notarize executable in ArduinoCreateAgent-osx/ArduinoCreateAgent-${VERSION%.*}-osx-installer-${{ matrix.browser }}.app"
          gon -log-level=debug -log-json gon.config_installer.hcl
        timeout-minutes: 30

      #  tar dmg file to keep executable permission
      - name: Tar files to keep permissions
        run: tar -cvf ArduinoCreateAgent-${VERSION%.*}-osx-installer-${{ matrix.browser }}.tar ArduinoCreateAgent-${VERSION%.*}-osx-installer-${{ matrix.browser }}.dmg

      - name: Upload artifacts
        uses: actions/upload-artifact@v2
        with:
          name: ArduinoCreateAgent-osx
          path: ArduinoCreateAgent*.tar
          if-no-files-found: error

  create-release:
    runs-on: ubuntu-18.04
    needs: code-sign-mac-installers
    env:
      PLUGIN_TARGET: "/CreateBridgeStable/"
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

    steps:

      - name: Download artifact
        uses: actions/download-artifact@v2 # download all the artifacts

      - name: Identify Prerelease
        # This is a workaround while waiting for create-release action to implement auto pre-release based on tag
        id: prerelease
        run: |
          wget -q -P /tmp https://github.com/fsaintjacques/semver-tool/archive/3.1.0.zip
          unzip -p /tmp/3.1.0.zip semver-tool-3.1.0/src/semver >/tmp/semver && chmod +x /tmp/semver
          if [[ $(/tmp/semver get prerel ${GITHUB_REF/refs\/tags\//}) ]]; then echo "::set-output name=IS_PRE::true"; fi

      #  mandatory step because upload-release-action does not support multiple folders
      - name: prepare artifacts for the release
        run: |
          mkdir release
          chmod -v +x ArduinoCreateAgent-linux-x64/*.run
          mv -v ArduinoCreateAgent-linux-x64/* release/
          cat ArduinoCreateAgent-osx/*.tar | tar -xvf - -i -C release/
          rm -v release/._ArduinoCreateAgent*.dmg
          mv -v ArduinoCreateAgent-windows*/* release/

      - name: Create Github Release
        uses: actions/create-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ github.ref }}
          release_name: ${{ github.ref }}
          body: ""
          draft: false
          prerelease: ${{ steps.prerelease.outputs.IS_PRE }}

      - name: Upload release files on Github
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          tag: ${{ github.ref }}
          file_glob: true  # If set to true, the file argument can be a glob pattern
          file: release/*

      - name: Upload release files on Arduino downloads servers
        run: aws s3 sync release/ s3://${{ secrets.DOWNLOADS_BUCKET }}${{ env.PLUGIN_TARGET }} --include "*"
        if: steps.prerelease.outputs.IS_PRE != 'true'

{'fraction_non_alphanumeric': 0.11890032663565278, 'fraction_numerical': 0.014797584875779472, 'mean_word_length': 2.4710126256119556, 'pattern_counts': {'":': 2, '<': 11, '<?xml version=': 0, '>': 39, 'https://': 14, 'lorem ipsum': 0, 'www.': 0, 'xml': 18}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 32, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3075617', 'n_tokens_mistral': 13194, 'n_tokens_neox': 12100, 'n_words': 3009}