Add Codemagic App Previews (Android & iOS) for Pull Requests

[nilsreichardt]

Description

We are already using the Deploy to Firebase action to deploy our web to a temporary url, when opening a new pull request.

codemagic_app_preview does the same for iOS and Android. Just scan the QR with your phone, install the app and review the changes 👍

Currently, I'm not able to build a iOS and macOS with one Codemagic workflow. Therefore, we are not building the macOS app at the moment. When I fixed this, I will make a new PR for adding support for macOS 👍

Google Sign In & Dynamic Links are not working at the moment for the Android version, because the dev Firebase project does not contain the SHA1 & SHA256 values of the code signing key (see #289).

[github-actions]

Visit the preview URL for this PR (updated for commit e6bdb84):

https://sharezone-test--pr257-codemagic-app-previe-fbsx5wxw.web.app

_{(expires Wed, 05 Oct 2022 23:13:25 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

[nilsreichardt]

⬇️ Generated builds by Codemagic for commit e6bdb84 ⬇️

Note: Only Sharezone team members are able to install the iOS app.

iOS	Android
Download link	Download link

[Jonas-Sander]

Hey, this is just a quick thought written down, not a review yet.

Since the codemagic.yaml code uses some secretes for signing that are very important - might there be some way for an external "attacker" to read them by forking our repository and proposing a PR with changes inside codemagic.yaml which will send the secrets to the attacker?

So under which conditions does the codemagic.yaml get executed? If an external user were to propose changes do we need to manually approve running the codemagic.yaml? (couldn't the user still do the same pwning-changes after manual approval?)

I read this article today which talks about something similar: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

[Jonas-Sander]

Can this somehow be read from the fvm config or pubspec,yaml, right?

[nilsreichardt]

Technically, this should be possible, but it would take an overhead of ~1-2 minutes.

What Codemagic does:

1. Download specified Flutter version
2. Clone the repository

Therefore, we would need to this:

1. Codemagic downloads the specified (or the default one) Flutter version
2. Codemagic clones the repository
3. We read out the Flutter version specified in the fvm_config.json
4. Download the Flutter version
5. Update the environment variables

[Jonas-Sander]

Hm that kinda sucks. Do we have a document "update the flutter version" or sth where we can for now at least have the places written down where we would need to update the version string?

[nilsreichardt]

Using FVM seems to be a good option 👍 The overhead is roundabout 1 min

[nilsreichardt]

Good point about the security. I tried out to print a secret and it was easily possible. I asked the Codemagic support what you can to do to protect your secrets.

[nilsreichardt]

@Jonas-Sander I added a few things. Can you re-review? You can simply use the feature "show changes since last review"

[Jonas-Sander]

LGTM 🙌