Validate repository secrets

[billybooth]

Adds rudimentary support for validation of repository secrets used in GitHub Actions + Fastlane build workflows.

A shared validate_secrets.yml has been added as a dependency of the other workflows to validate secrets prior to adding identifiers, creating certificates, or building Loop. It can also be run independently via standard workflow dispatch.

The workflow should be pretty self-explanatory, but each required repository secret is checked to verify that it is set and non-empty, then secondary validation is done upon the GH_PAT (via the GitHub CLI client) to ensure write permissions on the Match-Secrets repository and FASTLANE_ secrets (via a new validate_secrets lane) to ensure that an App Store Connect API authorization with the repository secrets is successful.

I'd considered numbering the workflows, since they should be run sequentially, but I didn't want to force @marionbarker to update all of her existing screenshots in the docs, i.e.:

1. Validate Secrets
2. Add Identifiers
3. Create Certificates
4. Build Loop

Here is an example where Validate Secrets is run as a dependency of Add Identifiers and causes it to fail:

[marionbarker]

I will happily update docs. I think adding numbers is a great improvement.

[billybooth]

Don't merge this just yet. I need to update the workflow to validate the FASTLANE_KEY as an unencrypted pkcs8 in the morning, and I intend to add step numbers to the workflow names.

[billybooth]

Still chewing on this a bit. I definitely like that the numbering of workflow names encourages sequential execution and looks good in the actions pane on the left, but the numbering of the names really bothers me in the runs pane on the right. I am withholding the numbering change and awaiting feedback, but this PR is otherwise functionally complete and ready to merge.

[mkellerman]

You can use the 'run-name: ' without the number. So what you see on the left is different than on the right.

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#name

'''
run-name

The name for workflow runs generated from the workflow. GitHub displays the workflow run name in the list of workflow runs on your repository's "Actions" tab. If run-name is omitted or is only whitespace, then the run name is set to event-specific information for the workflow run. For example, for a workflow triggered by a push or pull_request event, it is set as the commit message.

This value can include expressions and can reference the github and inputs contexts.
'''

[billybooth]

Brilliant, @mkellerman! As far as I'm concerned this is good to go now.

[mkellerman]

If you want more help with GA's.. ping me on Zulip. I have some suggestions, but dont want to over-step.

[billybooth]

@mkellerman said：

If you want more help with GA's.. ping me on Zulip. I have some suggestions, but dont want to over-step.

In the interest of getting this right, by all means share any suggestions you have (here or on Zulip).

[mkellerman]

One of the suggestions is wether we can keep the certificates as build artifacts, instead of a seperate repo? Removing as many steps as possible to the setup process.

Or, if it can't be done, then have the GA create the repo for us if it doesn't exists. but i would suggest renaming it, and making it dynamic. <my repo name>-secrets

[ps2]

@mkellerman That change sounds like it could help make setup easier for people. If you are able, please submit it as a separate PR. Thanks!

[ps2]

Thanks @billybooth!