From faf52492b67dd995b1643c49de602d82929c1e5d Mon Sep 17 00:00:00 2001
From: Jason Wen <haibin.wen3@gmail.com>
Date: Wed, 17 Jul 2024 03:26:13 +0000
Subject: [PATCH] ci: git-crypt: Decrypt prior to building

---
 ...91D8EDBE6BD70DFB803D59292470ADBDD426DEB5.gpg | Bin 0 -> 725 bytes
 .gitlab-ci.yml                                  |  16 +++++++++++-----
 2 files changed, 11 insertions(+), 5 deletions(-)
 create mode 100644 .git-crypt/keys/default/0/91D8EDBE6BD70DFB803D59292470ADBDD426DEB5.gpg

diff --git a/.git-crypt/keys/default/0/91D8EDBE6BD70DFB803D59292470ADBDD426DEB5.gpg b/.git-crypt/keys/default/0/91D8EDBE6BD70DFB803D59292470ADBDD426DEB5.gpg
new file mode 100644
index 0000000000000000000000000000000000000000..3da4a7ec9c844f8cb3701d07cb6de3987d8bf3ea
GIT binary patch
literal 725
zcmV;`0xJE50t^G?W8JRowQkM<5CFerQXytR3w@K7wZ4B*%60DzaJXzr!*q3W+4=9m
z17js$=kThC5ai4wEikaIm_X;~NdGfwLAqk*VtrXi3h7<UThSt2XZk`*dsvhUd}oVP
z5Gft2YYk+<$Tay<F3S8<G@BmQ3SHytf^=79nQH{@&H@(#BeoMAyR1e*=HIa}ZEkGV
zzV}oqUqhT&RGQDaJHS)quKhxDg6$0ubXUV*V-GVljf(wUh>v9fhF$}jmr$w}(@|UW
zCDSs`cxVBK0OX@n!pU+=3s>=PP<`7I*TgwzlW}bCJCxAdJ=4{%NGkuX2|Y$;ev}{L
z5K_5bU1AU%jBP?KVo4zu5kLdZ>i=eEjD7&CVB(9&Se)dt^i%Wd@R;T2ZC?d*n7`AV
zWZI}=|MbRfHX7&T2=1TyZJAdaN5iQH?*Z3{`z4N5Y6=`NNKGrYI!f*$v1R`6NzE=$
zQaUW|sFgpJ$pX0W)o~=x)WCHO?{R4=qJRk7)Z}YSJT&nYoyuc;14=$octKO1;nyrH
zh?nA@kC?#@x0f28qYC*srv67oHzn+DI^+(3ps`LSlfzcJ@he*!Hn*PEW{;&fCcx4B
zqTYwap!a3@OfA*S>CD|^9VJ2)+7+0f&_EVya;dcq=`$JeyO{H!VN6!XkO@SR1MjPX
z9LQDJ3%q65Zt!N@N3znu0|6YI82ww*3PRzyAIJeTfu$`dI#tndf?i0VwJCCjU#Zeg
z4-(gUMpGm7v8X7c9iP9JD(my5N%*Q2yv0j`6r9vf!p4S`EmHT5gs5-@0>f-CT&9}f
z`AuXtw#?1kk{ghL1gqZYO&3}31ZbTi23N5N1fdQh2YSxD{`dF-fEt2;y1)6ri0-mj
zn!xr}jV&Qmo;v${hx}{D(h9&5Ra}+i#}apkZbKLQI=iu;U@^hnFk;ij8&U+b<KS3p
Hwp#1!tT$$O

literal 0
HcmV?d00001

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index de50202454..1775e4ab7a 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -79,6 +79,12 @@ build:
     - "echo VERSION: ${VERSION}"
     - "echo CI_COMMIT_REF_NAME: ${CI_COMMIT_REF_NAME}"
     - git config --global --add safe.directory ${CI_PROJECT_DIR}
+    - |
+      echo "Decoding and importing GPG key..."
+      gpg -v --import <(echo "$GPG_PRIVATE_KEY_BASE64" | base64 -d)
+    - |
+      echo "Unlocking git-crypt..."
+      git-crypt unlock
   script:
     - export PYTHONPATH="$BUILD_DIR"
     - "echo Building Panda..."
@@ -146,7 +152,7 @@ build:
       when: manual
     - if: $NEW_BRANCH
       when: always
-      
+
 check no source code sent:
   image: alpine
   stage: sanity
@@ -225,13 +231,13 @@ publish to public github prebuilt:
   needs: ["build"]
   variables:
     DISCORD_HOOK: "${DISCORD_MANUAL_BUILD_WEBHOOK_URL}" # Default hook if not overriden by children
-  before_script:
+  before_script: &notify_discord_before_script
     - 'apk add curl jq envsubst'
   script:
     - echo using [${TEMPLATE}]
     - cat release/ci/${TEMPLATE} | envsubst | tee payload.json
     - 'curl -X POST -H "Content-Type: application/json" -d "$(cat payload.json)" ${DISCORD_HOOK} | jq .'
-  rules:
+  rules: &notify_discord_rules
     - if: $NEW_BRANCH
       when: on_success
     - when: never
@@ -242,7 +248,7 @@ notify pending action:
   variables:
     TEMPLATE: "discord_template_notify_dev_private.json"
   before_script:
-    - !reference [".notify_discord", "before_script"]
+    - *notify_discord_before_script
     - export AVATAR_URL=$(curl -s -X GET "https://gitlab.com/api/v4/avatar?email=${GITLAB_USER_EMAIL}" | jq -r '.avatar_url')
 
 notify new dev build:
@@ -255,4 +261,4 @@ notify new dev build:
     - if: $NEW_BRANCH == "dev-c3"
       variables:
         DISCORD_HOOK: "${DISCORD_NEW_BUILD_WEBHOOK_URL}" # Overriding hook because we know we are dev-c3
-    - !reference [".notify_discord", "rules"]
+    - *notify_discord_rules