[pull] develop from duckduckgo:develop

.github/PULL_REQUEST_TEMPLATE.md

@@ -60,4 +60,3 @@ Using a simulator where a physical device is unavailable is acceptable.
 ###### Internal references:
 [Software Engineering Expectations](https://app.asana.com/0/59792373528535/199064865822552)
 [Technical Design Template](https://app.asana.com/0/59792373528535/184709971311943)
-**When ready for review, remember to post the PR in MM**

.github/workflows/adhoc.yml

@@ -0,0 +1,90 @@
+name: Make ad-hoc build
+
+on:
+  workflow_dispatch:
+    inputs:
+      suffix:
+        description: "Text to append at the end of the build name"
+        required: false
+      asana-task-url:
+        description: "Asana task URL"
+        required: false
+        type: string
+
+jobs:
+  make-adhoc:
+    runs-on: macos-13
+    name: Make ad-hoc build
+
+    steps:
+
+      - name: Register SSH keys for access to certificates
+        uses: webfactory/[email protected]
+        with:
+          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY_FASTLANE_MATCH }}
+
+      - name: Check out the code
+        uses: actions/checkout@v3
+        with:
+          submodules: recursive
+
+      - name: Select Xcode
+        run: sudo xcode-select -s /Applications/Xcode_$(<.xcode-version).app/Contents/Developer
+
+      - name: Prepare fastlane
+        run: bundle install
+
+      - name: Archive and upload the app
+        env:
+          APPLE_API_KEY_BASE64: ${{ secrets.APPLE_API_KEY_BASE64 }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_KEY_ISSUER: ${{ secrets.APPLE_API_KEY_ISSUER }}
+          MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
+        run: |
+          if [[ -n "${{ github.event.inputs.suffix }}" ]]; then
+            bundle exec fastlane adhoc suffix:${{ github.event.inputs.suffix }}
+          else
+            bundle exec fastlane adhoc
+          fi
+
+      - name: Set filenames
+        run: |
+          echo "ipa_filename=${{ env.output_name }}.ipa" >> $GITHUB_ENV
+          echo "dsyms_filename=${{ env.output_name }}.app.dSYM.zip" >> $GITHUB_ENV
+
+      - name: Set paths
+        run: |
+          echo "ipa_path=${{ github.workspace }}/${{ env.ipa_filename }}" >> $GITHUB_ENV
+          echo "dsyms_path=${{ github.workspace }}/${{ env.dsyms_filename }}" >> $GITHUB_ENV
+
+      - name: Upload IPA artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: ${{ env.ipa_filename }}
+          path: ${{ env.ipa_path }}
+
+      - name: Upload dSYMs artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: ${{ env.dsyms_filename }}
+          path: ${{ env.dsyms_path }}
+
+      - name: Get Asana Task ID
+        id: get-task-id
+        if: github.event.inputs.asana-task-url
+        run: |
+          task_url_regex='^https://app.asana.com/[0-9]/[0-9]*/([0-9]*)/f$'
+          if [[ "${{ github.event.inputs.asana-task-url }}" =~ ${task_url_regex} ]]; then
+            echo "task_id=${BASH_REMATCH[1]}" >> $GITHUB_OUTPUT
+          else
+            echo "::error::Asana Task URL has incorrect format (attempted to match ${task_url_regex})."
+          fi
+
+      - name: Upload IPA to Asana
+        if: github.event.inputs.asana-task-url
+        env:
+          ASANA_ACCESS_TOKEN: ${{ secrets.ASANA_ACCESS_TOKEN }}
+        run: |
+          curl -s "https://app.asana.com/api/1.0/tasks/${{ steps.get-task-id.outputs.task_id }}/attachments" \
+            -H "Authorization: Bearer ${{ secrets.ASANA_ACCESS_TOKEN }}" \
+            --form "file=@${{ env.ipa_path }};type=application/zip"

.github/workflows/alpha.yml

@@ -0,0 +1,114 @@
+name: Make TestFlight Alpha Build
+
+on:
+  workflow_dispatch:
+    inputs:
+      destination:
+        description: "TestFlight Group"
+        required: true
+        default: "Latest Alpha Group"
+        type: string
+  workflow_call:
+    inputs:
+      destination:
+        description: "TestFlight Group"
+        required: true
+        default: "Latest Alpha Group"
+        type: string
+    secrets:
+      SSH_PRIVATE_KEY_FASTLANE_MATCH:
+        required: true
+      APPLE_API_KEY_BASE64:
+        required: true
+      APPLE_API_KEY_ID:
+        required: true
+      APPLE_API_KEY_ISSUER:
+        required: true
+      MATCH_PASSWORD:
+        required: true
+      ASANA_ACCESS_TOKEN:
+        required: true
+
+jobs:
+  make-alpha:
+    runs-on: macos-13
+    name: Make TestFlight Alpha Build
+
+    env:
+      destination: ${{ github.event.inputs.destination || inputs.destination }}
+
+    steps:
+
+    - name: Assert develop branch
+      run: |
+        case "${{ github.ref }}" in
+          *develop) ;;
+          *) echo "👎 Not develop branch"; exit 1 ;;
+        esac
+
+    - name: Register SSH keys for access to certificates
+      uses: webfactory/[email protected]
+      with:
+        ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY_FASTLANE_MATCH }}
+
+    - name: Check out the code
+      uses: actions/checkout@v3
+      with:
+        submodules: recursive
+
+    - name: Set cache key hash
+      run: |
+         has_only_tags=$(jq '[ .object.pins[].state | has("version") ] | all' DuckDuckGo.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved)
+         if [[ "$has_only_tags" == "true" ]]; then
+           echo "cache_key_hash=${{ hashFiles('DuckDuckGo.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved') }}" >> $GITHUB_ENV
+         else
+           echo "Package.resolved contains dependencies specified by branch or commit, skipping cache."
+         fi
+
+    - name: Cache SPM
+      if: env.cache_key_hash
+      uses: actions/cache@v3
+      with:
+        path: DerivedData/SourcePackages
+        key: ${{ runner.os }}-spm-${{ env.cache_key_hash }}
+        restore-keys: |
+          ${{ runner.os }}-spm-
+
+      # Using Xcode 15 as the alpha build uses iOS 17 APIs
+    - name: Select Xcode
+      run: sudo xcode-select -s /Applications/Xcode_15.0.1.app/Contents/Developer
+
+    - name: Prepare fastlane
+      run: bundle install
+
+    - name: Archive and upload the app
+      env:
+        APPLE_API_KEY_BASE64: ${{ secrets.APPLE_API_KEY_BASE64 }}
+        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+        APPLE_API_KEY_ISSUER: ${{ secrets.APPLE_API_KEY_ISSUER }}
+        MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
+      run: |
+        app_version="$(cut -d ' ' -f 3 < Configuration/Version.xcconfig)"
+        bundle exec fastlane increment_build_number_for_version version:$app_version app_identifier:"com.duckduckgo.mobile.ios.alpha"
+        bundle exec fastlane release_alpha groups:["${{ env.destination }}"]
+        build_version="$(xcodebuild -configuration Alpha -showBuildSettings | grep CURRENT_PROJECT_VERSION | tr -d 'CURRENT_PROJECT_VERSION =')"
+        echo "dsyms_path=${{ github.workspace }}/DuckDuckGo-Alpha.app.dSYM.zip" >> $GITHUB_ENV
+        echo "app_version=${app_version}" >> $GITHUB_ENV
+        echo "build_version=${build_version}" >> $GITHUB_ENV
+
+    - name: Upload dSYMs artifact
+      uses: actions/upload-artifact@v3
+      with:
+        name: DuckDuckGo-Alpha-dSYM-${{ env.app_version }}
+        path: ${{ env.dsyms_path }}
+
+    - name: Upload debug symbols to Asana
+      env:
+        ASANA_ACCESS_TOKEN: ${{ secrets.ASANA_ACCESS_TOKEN }}
+      run: |
+        asana_dsyms_path="${{ github.workspace }}/DuckDuckGo-Alpha-${{ env.app_version }}(${{ env.build_version }})-dSYM.zip"
+        mv -f "${{ env.dsyms_path }}" "$asana_dsyms_path"
+
+        curl -s "https://app.asana.com/api/1.0/tasks/1205344386326139/attachments" \
+          -H "Authorization: Bearer ${{ secrets.ASANA_ACCESS_TOKEN }}" \
+          --form "file=@${asana_dsyms_path};type=application/zip"

.github/workflows/codeql.yml

@@ -0,0 +1,50 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  schedule:
+    - cron: '0 2 * * *' # Run at 2 AM UTC
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: macos-13
+    timeout-minutes: 60
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: 'swift'
+
+    - name: Select Xcode
+      run: sudo xcode-select -s /Applications/Xcode_$(<.xcode-version).app/Contents/Developer
+
+    - name: Build
+      run: |
+        xcodebuild clean build \
+        -target "DuckDuckGo" \
+        -scheme "DuckDuckGo" \
+        -destination "platform=iOS Simulator,name=iPhone 14,OS=16.4"
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2
+      with:
+        category: "/language:swift"

.github/workflows/danger.yml

@@ -10,7 +10,7 @@ jobs:
     steps:
       - uses: actions/checkout@v1
       - name: Danger
-        uses: danger/[email protected].0
+        uses: danger/[email protected].6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/end-to-end.yml

@@ -0,0 +1,88 @@
+name: End-to-End tests
+
+on:
+  schedule:
+    - cron: '0 4 * * *' # run at 4 AM UTC
+
+jobs:
+  end-to-end-tests:
+    name: End to end Tests
+    runs-on: macos-13
+
+    steps:
+    - name: Check out the code
+      uses: actions/checkout@v3
+      with:
+        submodules: recursive
+
+    - name: Set cache key hash
+      run: |
+         has_only_tags=$(jq '[ .object.pins[].state | has("version") ] | all' DuckDuckGo.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved)
+         if [[ "$has_only_tags" == "true" ]]; then
+           echo "cache_key_hash=${{ hashFiles('DuckDuckGo.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved') }}" >> $GITHUB_ENV
+         else
+           echo "Package.resolved contains dependencies specified by branch or commit, skipping cache."
+         fi
+
+    - name: Cache SPM
+      if: env.cache_key_hash
+      uses: actions/cache@v3
+      with:
+        path: DerivedData/SourcePackages
+        key: ${{ runner.os }}-spm-${{ env.cache_key_hash }}
+        restore-keys: |
+          ${{ runner.os }}-spm-
+
+    - name: Select Xcode
+      run: sudo xcode-select -s /Applications/Xcode_$(<.xcode-version).app/Contents/Developer
+
+    - name: Build for tests
+      run: |
+        set -o pipefail && xcodebuild \
+          -scheme "DuckDuckGo" \
+          -destination "platform=iOS Simulator,name=iPhone 14,OS=16.4" \
+          -derivedDataPath "DerivedData" \
+        | tee xcodebuild.log
+
+    - name: Release tests
+      uses: mobile-dev-inc/[email protected]
+      with:
+        api-key: ${{ secrets.MAESTRO_CLOUD_API_KEY }}
+        app-file: DerivedData/Build/Products/Debug-iphonesimulator/DuckDuckGo.app
+        workspace: .maestro
+        include-tags: release
+
+    - name: Privacy tests
+      uses: mobile-dev-inc/[email protected]
+      with:
+        api-key: ${{ secrets.MAESTRO_CLOUD_API_KEY }}
+        app-file: DerivedData/Build/Products/Debug-iphonesimulator/DuckDuckGo.app
+        workspace: .maestro
+        include-tags: privacy
+
+    - name: Ad Click Detection Flow tests
+      uses: mobile-dev-inc/[email protected]
+      with:
+        api-key: ${{ secrets.MAESTRO_CLOUD_API_KEY }}
+        app-file: DerivedData/Build/Products/Debug-iphonesimulator/DuckDuckGo.app
+        workspace: .maestro
+        include-tags: adClick
+
+    - name: Create Asana task when workflow failed
+      if: ${{ failure() }}
+      run: |
+        curl -s "https://app.asana.com/api/1.0/tasks" \
+          --header "Accept: application/json" \
+          --header "Authorization: Bearer ${{ secrets.ASANA_ACCESS_TOKEN }}" \
+          --header "Content-Type: application/json" \
+          --data ' { "data": { "name": "GH Workflow Failure - End to end tests", "workspace": "${{ vars.GH_ASANA_WORKSPACE_ID }}", "projects": [ "${{ vars.GH_ASANA_IOS_APP_PROJECT_ID }}" ], "notes" : "The end to end workflow has failed. See https://github.com/duckduckgo/iOS/actions/runs/${{ github.run_id }}" } }'
+
+    - name: Upload logs when workflow failed
+      uses: actions/upload-artifact@v3
+      if: failure()
+      with:
+        name: BuildLogs
+        path: |
+          xcodebuild.log
+          DerivedData/Logs/Test/*.xcresult
+        retention-days: 7