Merge branch 'arduino:master' into master

Author: bmitov

.dependabot/config.yml

@@ -19,6 +19,6 @@ indent_size = 4
 indent_style = space
 indent_size = 2
 
-[*.sh]
-indent_style = tab
-indent_size = 4
+[*.{bash,sh}]
+indent_size = 2
+indent_style = space

.editorconfig

@@ -1,9 +1,14 @@
-# TODO: move this to pyproject.toml when supported: https://gitlab.com/pycqa/flake8/merge_requests/245
+# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/check-python/.flake8
+# See: https://flake8.pycqa.org/en/latest/user/configuration.html
+# The code style defined in this file is the official standardized style to be used in all Arduino tooling projects and
+# should not be modified.
 
 [flake8]
-max-line-length = 120
+doctests = True
 ignore =
     E741,
-    # W503 and W504 are mutually exclusive, so one or the other must be ignored.
-    # PEP 8 recommends line break before, so we keep W504.
+    # W503 and W504 are mutually exclusive. PEP 8 recommends line break before.
     W503
+max-complexity = 10
+max-line-length = 120
+select = E,W,F,C,N

.flake8

@@ -0,0 +1,13 @@
+# See: https://docs.github.com/en/code-security/supply-chain-security/configuration-options-for-dependency-updates#about-the-dependabotyml-file
+version: 2
+
+updates:
+  # Configure check for outdated GitHub Actions actions in workflows.
+  # Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/assets/dependabot/README.md
+  # See: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-actions-up-to-date-with-dependabot
+  - package-ecosystem: github-actions
+    directory: / # Check the repository's workflows under /.github/workflows/
+    schedule:
+      interval: daily
+    labels:
+      - "topic: dependencies"

.github/dependabot.yml

@@ -14,7 +14,7 @@
 
 set -euo pipefail
 
-! read -r -d '' query << EOM
+! read -r -d '' query <<EOM
 select
 replace(url_extract_path("d.url"), '/arduino-cli/arduino-cli_', '') as flavor,
 count("id") as gauge
@@ -27,40 +27,42 @@ group by 1
 EOM
 
 queryExecutionId=$(
-aws athena start-query-execution \
---query-string "${query}" \
---query-execution-context "Database=demo_books" \
---result-configuration "OutputLocation=${AWS_ATHENA_OUTPUT_LOCATION}" \
---region us-east-1 | jq -r ".QueryExecutionId"
+  aws athena start-query-execution \
+    --query-string "${query}" \
+    --query-execution-context "Database=demo_books" \
+    --result-configuration "OutputLocation=${AWS_ATHENA_OUTPUT_LOCATION}" \
+    --region us-east-1 | jq -r ".QueryExecutionId"
 )
 
 echo "QueryExecutionId is ${queryExecutionId}"
 for i in $(seq 1 120); do
-  queryState=$( aws athena get-query-execution \
-  --query-execution-id "${queryExecutionId}"  \
-  --region us-east-1 | jq -r ".QueryExecution.Status.State"
-  );
+  queryState=$(
+    aws athena get-query-execution \
+      --query-execution-id "${queryExecutionId}" \
+      --region us-east-1 | jq -r ".QueryExecution.Status.State"
+  )
 
   if [[ "${queryState}" == "SUCCEEDED" ]]; then
-      break;
-  fi;
+    break
+  fi
 
   echo "QueryExecutionId ${queryExecutionId} - state is ${queryState}"
 
   if [[ "${queryState}" == "FAILED" ]]; then
-      exit 1;
-  fi;
+    exit 1
+  fi
 
   sleep 2
 done
 
 echo "Query succeeded. Processing data"
-queryResult=$( aws athena get-query-results \
---query-execution-id "${queryExecutionId}" \
---region us-east-1 | jq --compact-output
-);
+queryResult=$(
+  aws athena get-query-results \
+    --query-execution-id "${queryExecutionId}" \
+    --region us-east-1 | jq --compact-output
+)
 
-! read -r -d '' jsonTemplate << EOM
+! read -r -d '' jsonTemplate <<EOM
 {
 "type": "gauge",
 "name": "arduino.downloads.total",
@@ -78,8 +80,8 @@ EOM
 
 datapoints="["
 for row in $(echo "${queryResult}" | jq 'del(.ResultSet.Rows[0])' | jq -r '.ResultSet.Rows[] | .Data' --compact-output); do
-  value=$(jq -r ".[1].VarCharValue" <<< "${row}")
-  tag=$(jq -r ".[0].VarCharValue" <<< "${row}")
+  value=$(jq -r ".[1].VarCharValue" <<<"${row}")
+  tag=$(jq -r ".[0].VarCharValue" <<<"${row}")
   # Some splitting to obtain 0.6.0, Windows, 32bit elements from string 0.6.0_Windows_32bit.zip
   split=($(echo "$tag" | tr '_' '\n'))
   if [[ ${#split[@]} -ne 3 ]]; then
@@ -90,4 +92,4 @@ for row in $(echo "${queryResult}" | jq 'del(.ResultSet.Rows[0])' | jq -r '.Resu
 done
 datapoints="${datapoints::-1}]"
 
-echo "::set-output name=result::$(jq --compact-output <<< "${datapoints}")"
+echo "::set-output name=result::$(jq --compact-output <<<"${datapoints}")"

.github/tools/fetch_athena_stats.sh

@@ -1,37 +1,46 @@
-name: Check for issues with signing certificates
+# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-certificates.md
+name: Check Certificates
 
+# See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows
 on:
+  push:
+    paths:
+      - ".github/workflows/check-certificates.ya?ml"
+  pull_request:
+    paths:
+      - ".github/workflows/check-certificates.ya?ml"
   schedule:
-    # run every 10 hours
+    # Run every 10 hours.
     - cron: "0 */10 * * *"
-  # workflow_dispatch event allows the workflow to be triggered manually.
-  # This could be used to run an immediate check after updating certificate secrets.
-  # See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows#workflow_dispatch
   workflow_dispatch:
+  repository_dispatch:
 
 env:
-  # Begin notifications when there are less than this many days remaining before expiration
+  # Begin notifications when there are less than this many days remaining before expiration.
   EXPIRATION_WARNING_PERIOD: 30
 
 jobs:
   check-certificates:
-    # This workflow would fail in forks that don't have the certificate secrets defined
-    if: github.repository == 'arduino/arduino-cli'
+    name: ${{ matrix.certificate.identifier }}
+    # Only run when the workflow will have access to the certificate secrets.
+    if: >
+      (github.event_name != 'pull_request' && github.repository == 'arduino/arduino-cli') ||
+      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == 'arduino/arduino-cli')
     runs-on: ubuntu-latest
-
     strategy:
       fail-fast: false
 
       matrix:
         certificate:
-          - identifier: macOS signing certificate # Text used to identify the certificate in notifications
-            certificate-secret: INSTALLER_CERT_MAC_P12 # The name of the secret that contains the certificate
-            password-secret: INSTALLER_CERT_MAC_PASSWORD # The name of the secret that contains the certificate password
+          # Additional certificate definitions can be added to this list.
+          - identifier: macOS signing certificate # Text used to identify certificate in notifications.
+            certificate-secret: INSTALLER_CERT_MAC_P12 # Name of the secret that contains the certificate.
+            password-secret: INSTALLER_CERT_MAC_PASSWORD # Name of the secret that contains the certificate password.
 
     steps:
       - name: Set certificate path environment variable
         run: |
-          # See: https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-commands-for-github-actions#setting-an-environment-variable
+          # See: https://docs.github.com/en/actions/reference/workflow-commands-for-github-actions#setting-an-environment-variable
           echo "CERTIFICATE_PATH=${{ runner.temp }}/certificate.p12" >> "$GITHUB_ENV"
 
       - name: Decode certificate
@@ -53,18 +62,17 @@ jobs:
             exit 1
           )
 
-      # See: https://github.com/rtCamp/action-slack-notify
       - name: Slack notification of certificate verification failure
         if: failure()
-        uses: rtCamp/action-slack-notify@v2.1.0
         env:
-          SLACK_WEBHOOK: ${{ secrets.TEAM_TOOLING_CHANNEL_SLACK_WEBHOOK }}
+          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
           SLACK_MESSAGE: |
             :warning::warning::warning::warning:
             WARNING: ${{ github.repository }} ${{ matrix.certificate.identifier }} verification failed!!!
             :warning::warning::warning::warning:
           SLACK_COLOR: danger
           MSG_MINIMAL: true
+        uses: rtCamp/action-slack-notify@v2
 
       - name: Get days remaining before certificate expiration date
         env:
@@ -93,7 +101,7 @@ jobs:
 
           DAYS_BEFORE_EXPIRATION="$((($(date --utc --date="$EXPIRATION_DATE" +%s) - $(date --utc +%s)) / 60 / 60 / 24))"
 
-          # Display the expiration information in the log
+          # Display the expiration information in the log.
           echo "Certificate expiration date: $EXPIRATION_DATE"
           echo "Days remaining before expiration: $DAYS_BEFORE_EXPIRATION"
 
@@ -108,14 +116,14 @@ jobs:
           fi
 
       - name: Slack notification of pending certificate expiration
-        # Don't send spurious expiration notification if verification fails
+        # Don't send spurious expiration notification if verification fails.
         if: failure() && steps.check-expiration.outcome == 'failure'
-        uses: rtCamp/action-slack-notify@v2.1.0
         env:
-          SLACK_WEBHOOK: ${{ secrets.TEAM_TOOLING_CHANNEL_SLACK_WEBHOOK }}
+          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
           SLACK_MESSAGE: |
             :warning::warning::warning::warning:
             WARNING: ${{ github.repository }} ${{ matrix.certificate.identifier }} will expire in ${{ steps.get-days-before-expiration.outputs.days }} days!!!
             :warning::warning::warning::warning:
           SLACK_COLOR: danger
           MSG_MINIMAL: true
+        uses: rtCamp/action-slack-notify@v2