refreshcerts.yaml

name: Refreshcerts
on:
  workflow_dispatch:
  schedule:
    - cron: '39 7 15 * *' # At 0739 on the 15th day of every month

permissions:  # added using https://github.com/step-security/secure-workflows
  contents: read

jobs:
  refresh-ACME-cert:
    runs-on: ubuntu-24.04
    name: SSL Renewal for vip.ve.atsign.zone
    steps:
      - name: setup certinfo
        uses: atsign-company/certinfo-action@e33db584f27bbbc0260af9916aeaefbec0db8ef4 # v1.0.1
      # checkout at_server code
      - name: checkout repo content
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      # Pull ACME script
      - name: Pull ACME script
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: atsign-company/secondaries-scripts
          path: secondaries-scripts
          token: ${{ secrets.MY_GITHUB_TOKEN }}
          ref: trunk
      # Create required directory, and copy keys files from secrets
      - name: Create required directory and pull secrets
        run: |-
          sudo mkdir -p /gluster/@/api/keys
          sudo chmod -R 777 /gluster/@/api/keys
          echo "${{secrets.LETSENCRYPT_PRIVKEY}}" > /gluster/@/api/keys/letsencrypt.key
          echo "${{secrets.ZEROSSL_PRIVKEY}}" > /gluster/@/api/keys/zerossl.key
          echo "${{secrets.GOOGLE_PRIVKEY}}" > /gluster/@/api/keys/google.key
      # Install Python Libraries and run Python ACME script
      - name: Install uv
        uses: astral-sh/setup-uv@887a942a15af3a7626099df99e897a18d9e5ab3a # v5.1.0
        with:
          version: "0.5.15"
      - name: Install Python Libraries, run create_cert script then copy certs to right place
        run: |-
          chmod -R 777 secondaries-scripts
          sudo apt-get install python3-poetry-plugin-export
          cd tools
          uv venv
          . .venv/bin/activate
          poetry export --format requirements.txt --output requirements.txt
          uv pip install --require-hashes -r requirements.txt
          cd ../secondaries-scripts/sec_ops && ./create_cert_workflow.sh vip.ve.atsign.zone
          cp cert.pem ../../tools/build_virtual_environment/ve_base/contents/atsign/root/certs/cert.pem
          cp privkey.pem ../../tools/build_virtual_environment/ve_base/contents/atsign/root/certs/privkey.pem
          cp fullchain.pem ../../tools/build_virtual_environment/ve_base/contents/atsign/root/certs/fullchain.pem
          cp ../../tools/build_virtual_environment/ve_base/contents/atsign/root/certs/*.pem \
            ../../tools/build_virtual_environment/ve_base/contents/atsign/secondary/base/certs/
          cd ../.. && rm -rf  vip.ve.atsign.zone* secondaries-scripts
        env:
          DO_KEY: ${{ secrets.DO_KEY }}
          gChat_url: ${{ secrets.GOOGLE_CHAT_WEBHOOK }}
      # create PR with renewed certificates
      - name: Create Pull Request
        id: cpr
        uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f # v7.0.6
        with:
          token: ${{ secrets.MY_GITHUB_TOKEN }}
          commit-message: 'chore: New certificates for at_server'
          committer: library-action[bot] <41898282+github-actions[bot]@users.noreply.github.com>
          author: library-action[bot] <41898282+github-actions[bot]@users.noreply.github.com>
          signoff: false
          add-paths: ./tools/build_virtual_environment
          branch: bot-new-certs
          delete-branch: true
          title: 'chore: New certificates generated'
          body: |
            Fresh certificates generated.
          labels: |
            operations
          assignees: cpswan
          reviewers: gkc
          draft: false