From 1392ea5ca6d9f08b38fa07d21b3a80089f46b09d Mon Sep 17 00:00:00 2001
From: Georges Basile Stavracas Neto <georges.stavracas@gmail.com>
Date: Sat, 30 Oct 2021 22:42:33 -0300
Subject: [PATCH] CI: Enable services on Flatpak builds

The flatpak-builder tool now supports passing secrets options to the
build system. These options are not printed during the build, nor
added to the resolved manifest after build, so they don't leak env
vars from CI.

Make secret variables part of the Flatpak workflow environment, like
the main workflow. Pass the various services hashes and clientids to
the build system using the new "secret-opts" key.
---
 .github/workflows/flatpak.yml         | 10 ++++++++++
 CI/flatpak/com.obsproject.Studio.json | 10 ++++++++++
 2 files changed, 20 insertions(+)

diff --git a/.github/workflows/flatpak.yml b/.github/workflows/flatpak.yml
index aa33755bc..d2d5e29e7 100644
--- a/.github/workflows/flatpak.yml
+++ b/.github/workflows/flatpak.yml
@@ -8,6 +8,16 @@ on:
     paths-ignore: ['**.md']
     branches: [master]
 
+env:
+  TWITCH_CLIENTID: ${{ secrets.TWITCH_CLIENT_ID }}
+  TWITCH_HASH: ${{ secrets.TWITCH_HASH }}
+  RESTREAM_CLIENTID: ${{ secrets.RESTREAM_CLIENTID }}
+  RESTREAM_HASH: ${{ secrets.RESTREAM_HASH }}
+  YOUTUBE_CLIENTID: ${{ secrets.YOUTUBE_CLIENTID }}
+  YOUTUBE_CLIENTID_HASH: ${{ secrets.YOUTUBE_CLIENTID_HASH }}
+  YOUTUBE_SECRET: ${{ secrets.YOUTUBE_SECRET }}
+  YOUTUBE_SECRET_HASH: ${{ secrets.YOUTUBE_SECRET_HASH }}
+
 jobs:
   flatpak_builder:
     name: Bundle
diff --git a/CI/flatpak/com.obsproject.Studio.json b/CI/flatpak/com.obsproject.Studio.json
index 0cb70926d..9cf6c2e87 100644
--- a/CI/flatpak/com.obsproject.Studio.json
+++ b/CI/flatpak/com.obsproject.Studio.json
@@ -259,6 +259,16 @@
         "-DENABLE_PULSEAUDIO=ON",
         "-DWITH_RTMPS=ON"
       ],
+      "secret-opts": [
+        "-DRESTREAM_CLIENTID=$RESTREAM_CLIENTID",
+        "-DRESTREAM_HASH=$RESTREAM_HASH",
+        "-DTWITCH_CLIENTID=$TWITCH_CLIENTID",
+        "-DTWITCH_HASH=$TWITCH_HASH",
+        "-DYOUTUBE_CLIENTID=$YOUTUBE_CLIENTID",
+        "-DYOUTUBE_CLIENTID_HASH=$YOUTUBE_CLIENTID_HASH",
+        "-DYOUTUBE_SECRET=$YOUTUBE_SECRET",
+        "-DYOUTUBE_SECRET_HASH=$YOUTUBE_SECRET_HASH"
+      ],
       "sources": [
         {
           "type": "dir",