Add support for additional profiles #16
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -51,6 +51,9 @@ inputs: | |
| keychain-password: | ||
| description: '[Device Builds] Password that will protect temporary keychain used for signing (can be a random string)' | ||
| required: false | ||
| provisioning-profiles: | ||
| description: '[Device Builds] JSON array of provisioning profiles' | ||
| required: false | ||
| rock-build-extra-params: | ||
| description: 'Extra parameters to pass to "rock build:ios"' | ||
| required: false | ||
|
|
@@ -100,32 +103,70 @@ runs: | |
| exit 1 | ||
| fi | ||
|
|
||
| # Legacy provisioning profile validation (only when not using provisioning-profiles) | ||
| if [ -z "${{ inputs.provisioning-profiles }}" ]; then | ||
| if [ -n "${{ inputs.provisioning-profile-file }}" ] && [ -n "${{ inputs.provisioning-profile-base64 }}" ]; then | ||
| echo "Cannot specify both 'provisioning-profile-file' and 'provisioning-profile-base64'. Use one or the other." | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [ -z "${{ inputs.provisioning-profile-file }}" ] && [ -z "${{ inputs.provisioning-profile-base64 }}" ]; then | ||
| echo "Either 'provisioning-profile-file' or 'provisioning-profile-base64' is required for device builds when not using 'provisioning-profiles'." | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [ -n "${{ inputs.provisioning-profile-file }}" ]; then | ||
| if [ ! -f "${{ inputs.provisioning-profile-file }}" ]; then | ||
| echo "Provisioning profile file not found: '${{ inputs.provisioning-profile-file }}'" | ||
| exit 1 | ||
| fi | ||
| fi | ||
| fi | ||
|
|
||
| # Check if either provisioning-profile-name or provisioning-profiles is provided | ||
| if [ -z "${{ inputs.provisioning-profile-name }}" ] && [ -z "${{ inputs.provisioning-profiles }}" ]; then | ||
| echo "Either 'provisioning-profile-name' or 'provisioning-profiles' is required for device builds." | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [ -n "${{ inputs.provisioning-profile-name }}" ] && [ -n "${{ inputs.provisioning-profiles }}" ]; then | ||
| echo "Cannot specify both 'provisioning-profile-name' and 'provisioning-profiles'. Use one or the other." | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [ -z "${{ inputs.keychain-password }}" ]; then | ||
| echo "Input 'keychain-password' is required for device builds." | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Validate provisioning profiles if provided | ||
| if [ -n "${{ inputs.provisioning-profiles }}" ]; then | ||
| while read -r profile; do | ||
| name=$(echo "$profile" | jq -r '.name') | ||
| file_path=$(echo "$profile" | jq -r '.file // empty') | ||
| base64_content=$(echo "$profile" | jq -r '.base64 // empty') | ||
|
|
||
| if [ -z "$name" ]; then | ||
| echo "Provisioning profile missing 'name' field" | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [ -n "$file_path" ] && [ -n "$base64_content" ]; then | ||
| echo "Cannot specify both 'file' and 'base64' for profile '$name'" | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [ -z "$file_path" ] && [ -z "$base64_content" ]; then | ||
| echo "Either 'file' or 'base64' is required for profile '$name'" | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [ -n "$file_path" ] && [ ! -f "$file_path" ]; then | ||
| echo "Provisioning profile file not found: '$file_path'" | ||
| exit 1 | ||
| fi | ||
| done < <(echo "${{ inputs.provisioning-profiles }}" | jq -c '.[]') | ||
| fi | ||
| fi | ||
| shell: bash | ||
|
|
||
|
|
@@ -223,18 +264,39 @@ runs: | |
| echo "Certificate identity: $IDENTITY" | ||
| echo "IDENTITY=$IDENTITY" >> $GITHUB_ENV | ||
|
|
||
| # Unpack provisioning profile (legacy single profile support) | ||
| PROFILE_DIR="$HOME/Library/MobileDevice/Provisioning Profiles" | ||
| mkdir -p "$PROFILE_DIR" | ||
|
|
||
| if [ -n "${{ inputs.provisioning-profile-name }}" ]; then | ||
| PROFILE_PATH="$PROFILE_DIR/${{ inputs.provisioning-profile-name }}.mobileprovision" | ||
|
|
||
| if [ -n "${{ inputs.provisioning-profile-file }}" ]; then | ||
| # Use provisioning profile file directly | ||
| cp "${{ inputs.provisioning-profile-file }}" "$PROFILE_PATH" | ||
| else | ||
| # Decode base64 provisioning profile | ||
| echo -n "${{ inputs.provisioning-profile-base64 }}" | base64 --decode -o "$PROFILE_PATH" | ||
| fi | ||
| fi | ||
|
|
||
| # Setup provisioning profiles | ||
| if [ -n "${{ inputs.provisioning-profiles }}" ]; then | ||
| while read -r profile; do | ||
| name=$(echo "$profile" | jq -r '.name') | ||
| file_path=$(echo "$profile" | jq -r '.file // empty') | ||
| base64_content=$(echo "$profile" | jq -r '.base64 // empty') | ||
thymikee marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| ADDITIONAL_PROFILE_PATH="$PROFILE_DIR/${name}.mobileprovision" | ||
|
There was a problem hiding this comment. Bug: Path Traversal Vulnerability in Profile NamingThe
Collaborator
Author
There was a problem hiding this comment. @thymikee Cursor suggest to add sanitize function for name - which removes all characters except alphanumeric, dots, underscores, and hyphens, especially removes all leading dots and
Contributor
There was a problem hiding this comment. Is it really a vulnerability?
Collaborator
Author
There was a problem hiding this comment. In theory someone could pass the name like ../../../etc/passwd so the certificate would be saved somewhere we don't have control, but as it is on CI I don't think it would be an issue |
||
|
|
||
| if [ -n "$file_path" ]; then | ||
| cp "$file_path" "$ADDITIONAL_PROFILE_PATH" | ||
| else | ||
| echo -n "$base64_content" | base64 --decode -o "$ADDITIONAL_PROFILE_PATH" | ||
| fi | ||
|
|
||
| echo "Installed provisioning profile: $name" | ||
| done < <(echo "${{ inputs.provisioning-profiles }}" | jq -c '.[]') | ||
| fi | ||
| shell: bash | ||
|
|
||
|
|
@@ -395,9 +457,23 @@ runs: | |
| CERTIFICATE_PATH=$RUNNER_TEMP/certificate.p12 | ||
| rm "$CERTIFICATE_PATH" | ||
|
|
||
| # Clean up legacy single provisioning profile | ||
| if [ -n "${{ inputs.provisioning-profile-name }}" ]; then | ||
| PROFILE_DIR="$HOME/Library/MobileDevice/Provisioning Profiles" | ||
| PROFILE_PATH="$PROFILE_DIR/${{ inputs.provisioning-profile-name }}.mobileprovision" | ||
| rm "$PROFILE_PATH" | ||
| fi | ||
|
|
||
| # Clean up provisioning profiles | ||
| if [ -n "${{ inputs.provisioning-profiles }}" ]; then | ||
| PROFILE_DIR="$HOME/Library/MobileDevice/Provisioning Profiles" | ||
| while read -r profile; do | ||
| name=$(echo "$profile" | jq -r '.name') | ||
| PROFILE_PATH="$PROFILE_DIR/${name}.mobileprovision" | ||
| rm "$PROFILE_PATH" | ||
| echo "Cleaned up additional provisioning profile: $name" | ||
| done < <(echo "${{ inputs.provisioning-profiles }}" | jq -c '.[]') | ||
| fi | ||
| shell: bash | ||
|
|
||
| - name: Cleanup Cache | ||
|
|
||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.