GitHub Actions：fastlane 匹配无法解密存储库

Question

我目前正在尝试使用 GitHub Actions 为我们的 React Native 应用程序设置一个基本的测试运行器。我们在证书和整个部署中使用 fastlane，因此我们也期待在 GitHub Actions 上使用它。\n不过，我似乎无法获得 fastlane 匹配来解密我们的密钥存储库。这是我们目前的 GitHub 工作流程：

\n\n

name: Test app build\n\non:\n  pull_request:\n    branches:\n      - develop\n    types:\n      - opened\n      - reopened\n\njobs:\n  build:\n    name: Install dependencies, lint and build\n    runs-on: macOS-latest\n    strategy:\n      matrix:\n        destination: [\'platform=iOS Simulator,OS=13.1,name=iPhone 8\']\n        xcode: [\'/Applications/Xcode_11.1.app/Contents/Developer\']\n    steps:\n      - uses: actions/checkout@v1\n      - name: Install NPM packages\n        run: npm install\n      - name: Install pods\n        run: cd ios && pod install && cd ..\n      - name: Run ESLint\n        run: ./node_modules/.bin/eslint --ignore-path .gitignore .\n      - name: Build iOS app\n        env:\n          MATCH_REPO: ${{ secrets.MATCH_REPO }}\n          MATCH_PASSWORD: ${{ secrets.MATCH_PASS }}\n        run: cd ios && fastlane compile\n

\n\n

一切正常，直到进入 fastlane 编译步骤。这是 Fastfile 中的相应通道：

\n\n

lane :compile do |options|\n  create_keychain(\n    name: "temp",\n    password: "temp",\n    default_keychain: true,\n    unlock: true,\n    timeout: 3600,\n    lock_when_sleeps: false\n  )\n  match(\n    type: "development",\n    readonly: is_ci,\n    keychain_name: "temp",\n    keychain_password: "temp"\n  )\n  gym(\n    scheme: "teledoctor24",\n    workspace: "teledoctor24.xcworkspace",\n    include_bitcode: false,\n    include_symbols: true\n  )\nend\n

\n\n

和匹配文件：

\n\n

git_url("[correct_git_repo]")\nstorage_mode("git")\ntype("development") # The default type, can be: appstore, adhoc, enterprise or development\n\napp_identifier(["[bundle_identifier_here]", "[another_bundle_identifier_here]"])\nusername("[our_apple_id]") # Your Apple Developer Portal username\nteam_id("[and_team_id]")\n

\n\n

在 GitHub 机密中，我使用密钥创建了适当的 MATCH_PASS 机密。这是我从 fastlane 得到的输出：

\n\n

2019-11-29T22:21:47.7610500Z [22:21:47]: [32m-------------------[0m\n2019-11-29T22:21:47.7689970Z [22:21:47]: [32m--- Step: match ---[0m\n2019-11-29T22:21:47.7737070Z [22:21:47]: [32m-------------------[0m\n2019-11-29T22:21:48.1363230Z [22:21:48]: [32mSuccessfully loaded \'/Users/runner/runners/2.161.0/work/-snip-/ios/fastlane/Matchfile\' \xc3\xb0\xc5\xb8\xe2\x80\x9c\xe2\x80\x9e[0m\n2019-11-29T22:21:48.1425100Z \n2019-11-29T22:21:48.1527450Z +----------------+--------------------------------------------------------------------------------------+\n2019-11-29T22:21:48.1610580Z |                              Detected Values from \'./fastlane/Matchfile\'                              |\n2019-11-29T22:21:48.1665820Z +----------------+--------------------------------------------------------------------------------------+\n2019-11-29T22:21:48.1766260Z | git_url        | ***.git                        |\n2019-11-29T22:21:48.6854830Z | storage_mode   | git                                                                                  |\n2019-11-29T22:21:48.6855260Z | type           | development                                                                          |\n2019-11-29T22:21:48.6888820Z | app_identifier | ["-snip-", "-snip-"] |\n2019-11-29T22:21:48.6933090Z | username       | -snip-                                                          |\n2019-11-29T22:21:48.7014240Z | team_id        | -snip-                                                                          |\n2019-11-29T22:21:48.7070520Z +----------------+--------------------------------------------------------------------------------------+\n2019-11-29T22:21:48.7090450Z \n2019-11-29T22:21:48.7116850Z \n2019-11-29T22:21:48.7150930Z +----------------------------+--------------------------------------------------------------------------------------+\n2019-11-29T22:21:48.7154140Z |                                             [32mSummary for match 2.136.0[0m                                             |\n2019-11-29T22:21:48.7155200Z +----------------------------+--------------------------------------------------------------------------------------+\n2019-11-29T22:21:48.7155770Z | type                       | development                                                                          |\n2019-11-29T22:21:48.7156270Z | readonly                   | true                                                                                 |\n2019-11-29T22:21:48.7156810Z | keychain_name              | temp                                                                                 |\n2019-11-29T22:21:48.7157930Z | keychain_password          | ********                                                                             |\n2019-11-29T22:21:48.7158420Z | generate_apple_certs       | true                                                                                 |\n2019-11-29T22:21:48.7158900Z | skip_provisioning_profiles | false                                                                                |\n2019-11-29T22:21:48.7159380Z | app_identifier             | ["-snip-", "-snip-"] |\n2019-11-29T22:21:48.7160310Z | username                   | -snip-                                                               |\n2019-11-29T22:21:48.7160870Z | team_id                    | -snip-                                                                      |\n2019-11-29T22:21:48.7161360Z | storage_mode               | git                                                                                  |\n2019-11-29T22:21:48.7192360Z | git_url                    | ***.git                        |\n2019-11-29T22:21:48.7293660Z | git_branch                 | master                                                                               |\n2019-11-29T22:21:48.7360410Z | shallow_clone              | false                                                                                |\n2019-11-29T22:21:48.7440240Z | clone_branch_directly      | false                                                                                |\n2019-11-29T22:21:48.7477690Z | force                      | false                                                                                |\n2019-11-29T22:21:48.7616380Z | force_for_new_devices      | false                                                                                |\n2019-11-29T22:21:48.7738290Z | skip_confirmation          | false                                                                                |\n2019-11-29T22:21:48.7801240Z | skip_docs                  | false                                                                                |\n2019-11-29T22:21:48.7831490Z | platform                   | ios                                                                                  |\n2019-11-29T22:21:48.7838660Z | verbose                    | false                                                                                |\n2019-11-29T22:21:48.7871780Z +----------------------------+--------------------------------------------------------------------------------------+\n2019-11-29T22:21:48.7928100Z [31m\n2019-11-29T22:21:48.7928210Z \n2019-11-29T22:21:48.7964740Z [!] Error cloning certificates git repo, please make sure you have access to the repository - see instructions above[0m\n2019-11-29T22:21:48.7965000Z [22:21:48]: Cloning remote git repo...\n2019-11-29T22:21:48.8016850Z [22:21:48]: If cloning the repo takes too long, you can use the `clone_branch_directly` option in match.\n2019-11-29T22:21:48.8048690Z Cloning into \'/var/folders/24/8k48jl6d249_n_qfxwsl6xvm0000gn/T/d20191129-2206-1hk3yku\'...\n2019-11-29T22:21:48.8120130Z fatal: could not read Username for \'https://github.com\': terminal prompts disabled\n2019-11-29T22:21:48.8180330Z [22:21:48]: [31mExit status: 128[0m\n2019-11-29T22:21:48.8223350Z [22:21:48]: [31mError cloning certificates repo, please make sure you have read access to the repository you want to use[0m\n2019-11-29T22:21:48.8290970Z [22:21:48]: [31mRun the following command manually to make sure you\'re properly authenticated:[0m\n2019-11-29T22:21:48.8333210Z [22:21:48]: [36m$ git clone ***.git /var/folders/24/8k48jl6d249_n_qfxwsl6xvm0000gn/T/d20191129-2206-1hk3yku[0m\n

\n\n

该通道在我的本地计算机上运行良好，并且已经设置了匹配。\n有什么想法吗？

\n

Answer 1

Github Action 只能访问当前存储库。如果您尝试结帐另一项，则需要指定个人访问令牌。

这在这里很可能是不可能的。

相反，您可以尝试启动 ssh-agent：

对于以下示例，密钥的名称应为 SSH_PRIVATE_KEY。然后，看一下以下工作流定义：

# .github/workflows/my-workflow.yml
# ... other config here
jobs:
    build:
        runs-on: ubuntu-18.04
        steps:
            -   uses: actions/checkout@v1
            -   name: Setup SSH Keys and known_hosts
                env:
                    SSH_AUTH_SOCK: /tmp/ssh_agent.sock
                run: |
                    mkdir -p ~/.ssh
                    ssh-keyscan github.com >> ~/.ssh/known_hosts
                    ssh-agent -a $SSH_AUTH_SOCK > /dev/null
                    ssh-add - <<< " $"
            -   name: Run fastlane
                env:
                    SSH_AUTH_SOCK: /tmp/ssh_agent.sock
                run: ...

这个例子来自这里。他们还发布了一个Github Action。