From 388cefab0420f87dcc097db970d6b7cd76ef16f8 Mon Sep 17 00:00:00 2001
From: Jagandeep Brar <me@jagandeepbrar.io>
Date: Wed, 19 Jan 2022 01:29:09 -0500
Subject: [PATCH] fix(ci): Do not pass values via environment to prevent
 leakage

---
 .github/workflows/all_platforms.yml  | 30 ++++++++++++----------------
 .github/workflows/deploy_android.yml |  6 ++----
 .github/workflows/deploy_ios.yml     |  4 +---
 .github/workflows/deploy_macos.yml   |  4 +---
 4 files changed, 17 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/all_platforms.yml b/.github/workflows/all_platforms.yml
index b2fcd242..0ff0050d 100644
--- a/.github/workflows/all_platforms.yml
+++ b/.github/workflows/all_platforms.yml
@@ -41,20 +41,16 @@ on:
         description: 'Deploy to Store Fronts?'
         default: "true"
 
-env:
-  VERSION: ${{ (github.event.inputs || inputs).flavor }}-${{ github.sha }}
-  FLAVOR: ${{ github.event.inputs.flavor || 'internal' }}
-
-jobs:
+jobs:    
   build_android:
     if: ${{ (github.event.inputs.android || 'true') == 'true' }}
     uses: CometTools/LunaSea/.github/workflows/build_android.yml@master
     secrets:
-      FLAVOR: ${{ env.FLAVOR }}
+      FLAVOR: ${{ github.event.inputs.flavor || 'internal' }}
       GOOGLE_SERVICES_JSON: ${{ secrets.GOOGLE_SERVICES_JSON }}
       KEY_JKS: ${{ secrets.KEY_JKS }}
       KEY_PROPERTIES: ${{ secrets.KEY_PROPERTIES }}
-      VERSION: ${{ env.VERSION }}
+      VERSION: ${{ github.event.inputs.flavor || 'internal' }}-${{ github.sha }}
 
   build_ios:
     if: ${{ (github.event.inputs.ios || 'true') == 'true' }}
@@ -63,13 +59,13 @@ jobs:
       APPLE_ID: ${{ secrets.APPLE_ID }}
       APPLE_ITC_TEAM_ID: ${{ secrets.APPLE_ITC_TEAM_ID }}
       APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-      FLAVOR: ${{ env.FLAVOR }}
+      FLAVOR: ${{ github.event.inputs.flavor || 'internal' }}
       GOOGLE_SERVICE_INFO_PLIST: ${{ secrets.GOOGLE_SERVICE_INFO_PLIST }}
       MATCH_KEYCHAIN_NAME: ${{ secrets.MATCH_KEYCHAIN_NAME }}
       MATCH_KEYCHAIN_PASSWORD: ${{ secrets.MATCH_KEYCHAIN_PASSWORD }}
       MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
       MATCH_SSH_PRIVATE_KEY: ${{ secrets.MATCH_SSH_PRIVATE_KEY }}
-      VERSION: ${{ env.VERSION }}
+      VERSION: ${{ github.event.inputs.flavor || 'internal' }}-${{ github.sha }}
 
   build_macos:
     if: ${{ (github.event.inputs.macos || 'true') == 'true' }}
@@ -78,22 +74,22 @@ jobs:
       APPLE_ID: ${{ secrets.APPLE_ID }}
       APPLE_ITC_TEAM_ID: ${{ secrets.APPLE_ITC_TEAM_ID }}
       APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-      FLAVOR: ${{ env.FLAVOR }}
+      FLAVOR: ${{ github.event.inputs.flavor || 'internal' }}
       GOOGLE_SERVICE_INFO_PLIST: ${{ secrets.GOOGLE_SERVICE_INFO_PLIST }}
       MATCH_KEYCHAIN_NAME: ${{ secrets.MATCH_KEYCHAIN_NAME }}
       MATCH_KEYCHAIN_PASSWORD: ${{ secrets.MATCH_KEYCHAIN_PASSWORD }}
       MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
       MATCH_SSH_PRIVATE_KEY: ${{ secrets.MATCH_SSH_PRIVATE_KEY }}
-      VERSION: ${{ env.VERSION }}
+      VERSION: ${{ github.event.inputs.flavor || 'internal' }}-${{ github.sha }}
 
   deploy_android:
     needs: build_android
     if: ${{ (github.event.inputs.deploy || 'true') == 'true' }}
     uses: CometTools/LunaSea/.github/workflows/deploy_android.yml@master
     secrets:
-      FLAVOR: ${{ env.FLAVOR }}
+      FLAVOR: ${{ github.event.inputs.flavor || 'internal' }}
       GOOGLE_PLAY_API: ${{ secrets.GOOGLE_PLAY_API }}
-      VERSION: ${{ env.VERSION }}
+      VERSION: ${{ github.event.inputs.flavor || 'internal' }}-${{ github.sha }}
 
   deploy_ios:
     needs: build_ios
@@ -107,8 +103,8 @@ jobs:
       APPLE_STORE_CONNECT_KEY_ID: ${{ secrets.APPLE_STORE_CONNECT_KEY_ID }}
       APPLE_STORE_CONNECT_ISSUER_ID: ${{ secrets.APPLE_STORE_CONNECT_ISSUER_ID }}
       APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-      FLAVOR: ${{ env.FLAVOR }}
-      VERSION: ${{ env.VERSION }}
+      FLAVOR: ${{ github.event.inputs.flavor || 'internal' }}
+      VERSION: ${{ github.event.inputs.flavor || 'internal' }}-${{ github.sha }}
 
   deploy_macos:
     needs: build_macos
@@ -122,5 +118,5 @@ jobs:
       APPLE_STORE_CONNECT_KEY_ID: ${{ secrets.APPLE_STORE_CONNECT_KEY_ID }}
       APPLE_STORE_CONNECT_ISSUER_ID: ${{ secrets.APPLE_STORE_CONNECT_ISSUER_ID }}
       APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-      FLAVOR: ${{ env.FLAVOR }}
-      VERSION: ${{ env.VERSION }}
+      FLAVOR: ${{ github.event.inputs.flavor || 'internal' }}
+      VERSION: ${{ github.event.inputs.flavor || 'internal' }}-${{ github.sha }}
diff --git a/.github/workflows/deploy_android.yml b/.github/workflows/deploy_android.yml
index 05d035dd..0700a3ef 100644
--- a/.github/workflows/deploy_android.yml
+++ b/.github/workflows/deploy_android.yml
@@ -14,8 +14,6 @@ jobs:
   deploy:
     name: 'Deploy to Play Store'
     runs-on: macos-latest
-    env:
-      VERSION_NAME: android-${{ secrets.VERSION }}
 
     steps:
       - name: Checkout Repository
@@ -27,7 +25,7 @@ jobs:
       - name: Download App Bundle Artifact
         uses: actions/download-artifact@v2
         with:
-          name: ${{ env.VERSION_NAME }}
+          name: android-${{ secrets.VERSION }}
           path: ${{ github.workspace }}
 
       - name: Install Secret Keys
@@ -44,4 +42,4 @@ jobs:
           SUPPLY_JSON_KEY: ${{ github.workspace }}/.fastlane-android-auth.json
         run: |
           bundle install
-          bundle exec fastlane deploy track:${{ secrets.FLAVOR }} aab:${{ github.workspace }}/app-release.aab version_name:${{ env.VERSION_NAME }}
+          bundle exec fastlane deploy track:${{ secrets.FLAVOR }} aab:${{ github.workspace }}/app-release.aab version_name:android-${{ secrets.VERSION }}
diff --git a/.github/workflows/deploy_ios.yml b/.github/workflows/deploy_ios.yml
index 339d69e9..2a6f7dba 100644
--- a/.github/workflows/deploy_ios.yml
+++ b/.github/workflows/deploy_ios.yml
@@ -26,8 +26,6 @@ jobs:
   deploy:
     name: 'Deploy to App Store'
     runs-on: macos-latest
-    env:
-      VERSION_NAME: android-${{ secrets.VERSION }}
 
     steps:
       - name: Checkout Repository
@@ -39,7 +37,7 @@ jobs:
       - name: Download App Package Artifact
         uses: actions/download-artifact@v2
         with:
-          name: ${{ env.VERSION_NAME }}
+          name: ios-${{ secrets.VERSION }}
           path: ${{ github.workspace }}
 
       - name: Install Secret Keys
diff --git a/.github/workflows/deploy_macos.yml b/.github/workflows/deploy_macos.yml
index 6d1a5cc8..b96527f9 100644
--- a/.github/workflows/deploy_macos.yml
+++ b/.github/workflows/deploy_macos.yml
@@ -26,8 +26,6 @@ jobs:
   deploy:
     name: 'Deploy to App Store'
     runs-on: macos-latest
-    env:
-      VERSION_NAME: macos-${{ secrets.VERSION }}
 
     steps:
       - name: Checkout Repository
@@ -39,7 +37,7 @@ jobs:
       - name: Download App Package Artifact
         uses: actions/download-artifact@v2
         with:
-          name: ${{ env.VERSION_NAME }}
+          name: macos-${{ secrets.VERSION }}
           path: ${{ github.workspace }}
 
       - name: Install Secret Keys