test-and-deploy.yml

name: Test and Deploy
on:
  push:
    branches: [ '*' ]
    tags: [ '*' ]
  pull_request:
    branches: [ main ]
  schedule:
    # Run automatically at 8AM PST Monday-Friday
    - cron: '0 15 * * 1-5'
  workflow_dispatch:

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout twilio-csharp
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Setup .NET Core SDK
        uses: actions/setup-dotnet@v3
        with:
          dotnet-version: 7.0.103

      - name: Remove faulty SDK version
        run: sudo rm -rf /usr/share/dotnet/sdk/7.0.4*

      - name: Build & Test
        run: make test

      - name: Install SonarCloud scanner and run analysis
        if: (github.event_name == 'pull_request' || github.ref_type == 'branch') && !github.event.pull_request.head.repo.fork
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          TWILIO_ACCOUNT_SID: ${{ secrets.TWILIO_ACCOUNT_SID }}
          TWILIO_API_KEY: ${{ secrets.TWILIO_CLUSTER_TEST_API_KEY }}
          TWILIO_API_SECRET: ${{ secrets.TWILIO_CLUSTER_TEST_API_KEY_SECRET }}
          TWILIO_FROM_NUMBER: ${{ secrets.TWILIO_FROM_NUMBER }}
          TWILIO_TO_NUMBER: ${{ secrets.TWILIO_TO_NUMBER }}
        run: |
          dotnet tool install --global dotnet-sonarscanner --version 5.5.3
          make cover

  import-certificate:
    runs-on: windows-latest
    steps:
     - uses: actions/checkout@v2
     - run: make install
     - name: import-certificate
       run: |
        New-Item -ItemType directory -Path certificate
        Set-Content -Path certificate\certificate.txt -Value '${{ secrets.CODE_SIGNING_CERTIFICATE }}'
        certutil -decode certificate\certificate.txt certificate\certificate.pfx

     - name: Upload Artifact
       uses: actions/upload-artifact@v3
       with:
         name: certificate.pfx
         path: certificate\certificate.pfx
         retention-days: 1

  code-signing:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v2
      - run: make install

      - name: NuGet Install
        uses: NuGet/setup-nuget@v1.0.5
        with:
          nuget-version: latest

      - name: Set up certificate
        run: |
          echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12
          cat  /d/Certificate_pkcs12.p12
        shell: bash

      - name: Set variables
        id: variables
        run: |
          dir
          echo "::set-output name=version::${GITHUB_REF#refs/tags/v}"
          echo "::set-output name=KEYPAIR_NAME::gt-standard-keypair"
          echo "::set-output name=CERTIFICATE_NAME::gt-certificate"
          echo "SM_HOST=${{ secrets.SM_HOST }}" >> "$GITHUB_ENV"
          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV"
          echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV"
          echo "C:\Program Files (x86)\Windows Kits\10\App Certification Kit" >> $GITHUB_PATH
          echo "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools" >> $GITHUB_PATH
          echo "C:\Program Files\DigiCert\DigiCert Keylocker Tools" >> $GITHUB_PATH
        shell: bash

      - name: Code signing with Software Trust Manager
        id: SSMClientToolSetup
        uses: digicert/ssm-code-signing@v0.0.2
        env:
          SM_API_KEY: ${{ env.SM_API_KEY }}
          SM_CLIENT_CERT_PASSWORD: ${{ env.SM_CLIENT_CERT_PASSWORD }}
          SM_CLIENT_CERT_FILE: ${{ env.SM_CLIENT_CERT_FILE }}
          
      - name: Debug Android Build Tools
        run: |
          ls C:\Android\android-sdk\build-tools

      - run: echo “The config file path ${{ steps.SSMClientToolSetup.outputs.PKCS11_CONFIG }}”

      - name: Setup Keylocker KSP on windows
        run: |
          curl -X GET  https://one.digicert.com/signingmanager/api-ui/v1/releases/Keylockertools-windows-x64.msi/download -H "x-api-key:%SM_API_KEY%" -o Keylockertools-windows-x64.msi 
          msiexec /i Keylockertools-windows-x64.msi /quiet /qn
          smksp_registrar.exe list 
          smctl.exe keypair ls 
          C:\Windows\System32\certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
        shell: cmd

      - name: Certificates Sync
        run: |
          smctl windows certsync
        shell: cmd

      - name: Create Signed Directory
        run: |
          mkdir D:\a\stm-github-action-demo\stm-github-action-demo\dist\
        shell: cmd

      - name: Signing using Nuget
        run: |
          copy D:\a\stm-github-action-demo\stm-github-action-demo\UNSIGNED.nupkg D:\a\stm-github-action-demo\stm-github-action-demo\dist\UNSIGNED.nupkg
          nuget sign "D:\a\stm-github-action-demo\stm-github-action-demo\dist\UNSIGNED.nupkg" -Timestamper http://timestamp.digicert.com -outputdirectory "D:\a\stm-github-action-demo\stm-github-action-demo\dist\NugetSigned" -CertificateFingerprint ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }} -HashAlgorithm SHA256 -Verbosity detailed -Overwrite
          nuget verify -All "D:\a\stm-github-action-demo\stm-github-action-demo\dist\NugetSigned\*"

      - name: Upload artifacts
        uses: actions/upload-artifact@v2
        with:
          name: windows-latest
          path: |
            dist

  deploy:
    name: Deploy
    if: success() && github.ref_type == 'tag'
    needs: [ test, import-certificate ]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout twilio-csharp
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Download code signing certificate
        uses: actions/download-artifact@v3
        with:
          name: certificate.pfx

      - name: Setup .NET Core SDK
        uses: actions/setup-dotnet@v3
        with:
          dotnet-version: '3.1.x'

      - name: Login to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_AUTH_TOKEN }}

      # The expression strips off the shortest match from the front of the string to yield just the tag name as the output
      - name: Get tagged version
        run: echo "GITHUB_TAG=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV

      - name: Create GitHub Release
        uses: sendgrid/dx-automator/actions/release@main
        with:
          footer: '**[NuGet](https://www.nuget.org/packages/Twilio/${version})**'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and Push image
        run: make docker-build docker-push

      - name: Publish package to NuGet
        run: |
          make release
          dotnet nuget sign **/*.nupkg --certificate-path certificate.pfx --certificate-password ${{ secrets.CERTIFICATE_PASSWORD }} --timestamper http://timestamp.digicert.com
          dotnet nuget push **/*.nupkg -k ${{ secrets.NUGET_API_KEY }} -s https://api.nuget.org/v3/index.json

      - name: Submit metric to Datadog
        uses: sendgrid/dx-automator/actions/datadog-release-metric@main
        env:
          DD_API_KEY: ${{ secrets.DATADOG_API_KEY }}

  notify-on-failure:
    name: Slack notify on failure
    if: failure() && github.event_name != 'pull_request' && (github.ref == 'refs/heads/main' || github.ref_type == 'tag')
    needs: [ test, deploy ]
    runs-on: ubuntu-latest
    steps:
      - uses: rtCamp/action-slack-notify@v2
        env:
          SLACK_COLOR: failure
          SLACK_ICON_EMOJI: ':github:'
          SLACK_MESSAGE: ${{ format('Test *{0}*, Deploy *{1}*, {2}/{3}/actions/runs/{4}', needs.test.result, needs.deploy.result, github.server_url, github.repository, github.run_id) }}
          SLACK_TITLE: Action Failure - ${{ github.repository }}
          SLACK_USERNAME: GitHub Actions
          SLACK_MSG_AUTHOR: twilio-dx
          SLACK_FOOTER: Posted automatically using GitHub Actions
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
          MSG_MINIMAL: true