motor-database/.github/workflows/update-motors.yml at main · openrocket/motor-database · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
name: Update Motor Database

on:
  schedule:
    # Run at 02:00 every Sunday.
    - cron: '0 2 * * 0'
  workflow_dispatch:

concurrency:
  group: motor-database-release
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  build-and-validate:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout Code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.10'

      - name: Preserve Previous Build Baseline
        run: cp state/last_build.json previous-build.json

      - name: Fetch New Motors
        run: python scripts/fetch_updates.py

      - name: Build Database
        run: python scripts/build_database.py

      - name: Validate Unsigned Release
        run: >-
          python scripts/validate_release.py motors.db.gz metadata.json
          --baseline previous-build.json

      - name: Commit Raw Data Changes
        # This saves downloaded motor files and state back to the repository.
        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
        with:
          commit_message: "Auto-update motor cache [skip ci]"
          file_pattern: "data/ state/"

      - name: Prepare Unsigned Release
        run: |
          mkdir unsigned-release
          cp motors.db.gz metadata.json unsigned-release/

      - name: Upload Validated Unsigned Release
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: unsigned-motor-database
          path: unsigned-release/
          if-no-files-found: error
          retention-days: 1

  sign:
    needs: build-and-validate
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout Trusted Signing Code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}

      - name: Download Validated Unsigned Release
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: unsigned-motor-database
          path: release

      - name: Revalidate Before Signing
        run: python scripts/validate_release.py release/motors.db.gz release/metadata.json

      - name: Sign Database Update
        env:
          MOTOR_DB_PRIVATE_KEY_BASE64: ${{ secrets.MOTOR_DB_PRIVATE_KEY_BASE64 }}
          MOTOR_DB_KEY_ID: ${{ secrets.MOTOR_DB_KEY_ID }}
        run: python scripts/sign_database.py release/motors.db.gz release/metadata.json

      - name: Validate Signed Release
        run: >-
          python scripts/validate_release.py release/motors.db.gz release/metadata.json
          --require-signature
          --public-key security/motor-database-signing-public-key.pem

      - name: Upload Signed Release
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: signed-motor-database
          path: release/
          if-no-files-found: error
          retention-days: 1

  publish:
    needs: sign
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout Validation Code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}

      - name: Download Signed Release
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: signed-motor-database
          path: release

      - name: Final Release Validation
        run: >-
          python scripts/validate_release.py release/motors.db.gz release/metadata.json
          --require-signature
          --public-key security/motor-database-signing-public-key.pem

      - name: Deploy Artifacts
        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          publish_dir: ./release
          force_orphan: true