ci(workflows): pin build container images #68
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Go embedded lib" | |
| # Builds the per-platform cdylib the Go SDK embeds (go:embed, behind the | |
| # `embed_lib` build tag) and verifies the embedded build works with no | |
| # SECRETSPEC_FFI_LIB set. Linux builds use a manylinux_2_28 baseline, so the | |
| # release assets work on older glibc distributions. The libraries are uploaded | |
| # as artifacts and attached to GitHub releases for users who want a | |
| # self-contained `-tags embed_lib` build; they are never committed to the repo | |
| # (the Go module proxy does not carry binary assets — see RELEASE.md). | |
| on: | |
| workflow_call: | |
| inputs: | |
| release_tag: | |
| description: Existing GitHub Release tag to upload artifacts to | |
| required: false | |
| type: string | |
| default: "" | |
| workflow_dispatch: | |
| inputs: | |
| release_tag: | |
| description: Existing GitHub Release tag to upload artifacts to | |
| required: false | |
| type: string | |
| default: "" | |
| push: | |
| tags: | |
| - v** | |
| # PR runs are scoped to changes in the Go SDK or this workflow. Core | |
| # resolver and FFI changes are verified on PRs by the devenv-based test.yml, | |
| # sdks.yml, and ffi-build.yml; the full matrix here still runs on tags and | |
| # manual dispatch. | |
| pull_request: | |
| paths: | |
| - "secretspec-go/**" | |
| - "secretspec-ffi/**" | |
| - ".github/workflows/go-embed.yml" | |
| - "scripts/check-linux-portability.sh" | |
| jobs: | |
| embed: | |
| name: ${{ matrix.target }} | |
| runs-on: ${{ matrix.runner }} | |
| container: ${{ matrix.container || null }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - target: linux_amd64 | |
| runner: ubuntu-latest | |
| container: quay.io/pypa/manylinux_2_28_x86_64:2026.08.05-1@sha256:e0b40ace8e818e96026eb47714b01998cbca022a6995797d0905474ce3e82ae8 | |
| - target: linux_arm64 | |
| runner: ubuntu-24.04-arm | |
| container: quay.io/pypa/manylinux_2_28_aarch64:2026.08.05-1@sha256:f766b402889e40f439e7a3ee5788eef1aa3ef399d0110107d27419fa2ba9d905 | |
| - { target: darwin_arm64, runner: macos-latest } | |
| - { target: windows_amd64, runner: windows-latest } | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install rustup (the manylinux container ships none) | |
| if: matrix.container | |
| run: | | |
| curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | | |
| sh -s -- -y --default-toolchain none | |
| echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" | |
| - name: Install Rust (pinned by rust-toolchain.toml) | |
| run: rustup toolchain install | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.23" | |
| - name: Stage the embedded cdylib | |
| shell: bash | |
| run: bash secretspec-go/scripts/stage-cdylib.sh | |
| - name: Verify Linux portability (glibc <= 2.28, no dynamic libdbus) | |
| if: matrix.container | |
| shell: bash | |
| run: >- | |
| bash scripts/check-linux-portability.sh | |
| "secretspec-go/lib/secretspec_ffi_${{ matrix.target }}.so" | |
| - name: Build and smoke test the embedded SDK (no SECRETSPEC_FFI_LIB) | |
| shell: bash | |
| run: | | |
| smoke="$RUNNER_TEMP/embedsmoke" | |
| mkdir -p "$smoke" | |
| cat > "$smoke/main.go" <<'EOF' | |
| package main | |
| import ( | |
| "fmt" | |
| secretspec "github.com/cachix/secretspec/secretspec-go" | |
| ) | |
| func main() { | |
| v, err := secretspec.ABIVersion() | |
| if err != nil { panic(err) } | |
| fmt.Println("abi", v) | |
| } | |
| EOF | |
| cat > "$smoke/go.mod" <<EOF | |
| module example.com/embedsmoke | |
| go 1.23 | |
| require github.com/cachix/secretspec/secretspec-go v0.0.0 | |
| replace github.com/cachix/secretspec/secretspec-go => $GITHUB_WORKSPACE/secretspec-go | |
| EOF | |
| cd "$smoke" | |
| go mod tidy | |
| unset SECRETSPEC_FFI_LIB | |
| # -linkmode=external: Go's internal linker doesn't emit a Mach-O | |
| # LC_UUID load command (https://github.com/golang/go/issues/68678), | |
| # and macOS 15+'s dyld refuses to load a binary without one ("missing | |
| # LC_UUID load command", abort trap). The system linker (used when | |
| # external linking) does emit it. Only valid building natively on | |
| # macOS, which this job does. | |
| go build -tags embed_lib -ldflags="-linkmode=external" -o embedsmoke . | |
| ./embedsmoke | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: go-embed-${{ matrix.target }} | |
| path: secretspec-go/lib/* | |
| release: | |
| name: Publish Go release | |
| needs: embed | |
| if: >- | |
| (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) || | |
| inputs.release_tag != '' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: go-embed-* | |
| path: staged | |
| merge-multiple: true | |
| - name: Attach embedded libraries to the GitHub Release | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASE_TAG: ${{ inputs.release_tag || github.ref_name }} | |
| run: | | |
| set -euo pipefail | |
| mapfile -t assets < <(find staged -type f -name 'secretspec_ffi_*' -print | sort) | |
| if [[ "${#assets[@]}" -ne 4 ]]; then | |
| printf 'expected 4 embedded libraries, found %s\n' "${#assets[@]}" >&2 | |
| printf '%s\n' "${assets[@]}" >&2 | |
| exit 1 | |
| fi | |
| bash scripts/upload-release-asset.sh \ | |
| "$RELEASE_TAG" "${assets[@]}" | |
| - name: Publish the Go module tag | |
| if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| module_tag="secretspec-go/${GITHUB_REF_NAME}" | |
| if git fetch origin "refs/tags/${module_tag}:refs/tags/${module_tag}"; then | |
| existing_commit="$(git rev-list -n 1 "$module_tag")" | |
| if [[ "$existing_commit" != "$GITHUB_SHA" ]]; then | |
| echo "${module_tag} already points to ${existing_commit}, expected ${GITHUB_SHA}" >&2 | |
| exit 1 | |
| fi | |
| echo "${module_tag} already points to ${GITHUB_SHA}" | |
| exit 0 | |
| fi | |
| git config user.name github-actions[bot] | |
| git config user.email 41898282+github-actions[bot]@users.noreply.github.com | |
| git tag -a "$module_tag" "$GITHUB_SHA" \ | |
| -m "Release Go SDK ${GITHUB_REF_NAME#v}" | |
| git push origin "refs/tags/${module_tag}" |