Skip to content

Commit 474816b

Browse files
stephybunstephybun
authored
Merge pull request #1689 from hashicorp/f/onboard-crt
tooling: Onboard to CRT
2 parents 70b2a42 + 6ee7b72 commit 474816b

File tree

6 files changed

+313
-1
lines changed

6 files changed

+313
-1
lines changed

‎.github/workflows/build.yml‎

Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
# This workflow builds the product for all supported platforms and uploads the resulting
2+
# binaries as Actions artifacts. The workflow also uploads a build metadata file
3+
# (metadata.json) -- and a Terraform Registry manifest file (terraform-registry-manifest.json).
4+
#
5+
# Reference: https://github.com/hashicorp/terraform-provider-crt-example/blob/main/.github/workflows/README.md
6+
7+
name: build
8+
9+
# We default to running this workflow on every push to every branch.
10+
# This provides fast feedback when build issues occur, so they can be
11+
# fixed prior to being merged to the main branch.
12+
#
13+
# If you want to opt out of this, and only run the build on certain branches
14+
# please refer to the documentation on branch filtering here:
15+
#
16+
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onpushbranchestagsbranches-ignoretags-ignore
17+
#
18+
on: [workflow_dispatch, push]
19+
20+
env:
21+
PKG_NAME: "terraform-provider-azuread"
22+
23+
jobs:
24+
# Detects the Go toolchain version to use for product builds.
25+
#
26+
# The implementation is inspired by envconsul -- https://go.hashi.co/get-go-version-example
27+
get-go-version:
28+
name: "Detect Go toolchain version"
29+
runs-on: ubuntu-latest
30+
outputs:
31+
go-version: ${{ steps.get-go-version.outputs.go-version }}
32+
steps:
33+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
34+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
35+
with:
36+
go-version-file: 'go.mod'
37+
- name: Detect Go version
38+
id: get-go-version
39+
run: |
40+
version="$(go list -f {{.GoVersion}} -m)"
41+
echo "go-version=$version" >> "$GITHUB_OUTPUT"
42+
43+
# Parses the version/VERSION file. Reference: https://github.com/hashicorp/actions-set-product-version/blob/main/README.md
44+
#
45+
# > This action should be implemented in product repo `build.yml` files. The action is intended to grab the version
46+
# > from the version file at the beginning of the build, then passes those versions (along with metadata, where
47+
# > necessary) to any workflow jobs that need version information.
48+
set-product-version:
49+
name: "Parse version file"
50+
runs-on: ubuntu-latest
51+
outputs:
52+
product-version: ${{ steps.set-product-version.outputs.product-version }}
53+
product-base-version: ${{ steps.set-product-version.outputs.base-product-version }}
54+
product-prerelease-version: ${{ steps.set-product-version.outputs.prerelease-product-version }}
55+
product-minor-version: ${{ steps.set-product-version.outputs.minor-product-version }}
56+
steps:
57+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
58+
- name: Set variables
59+
id: set-product-version
60+
uses: hashicorp/actions-set-product-version@v2
61+
62+
# Creates metadata.json file containing build metadata for consumption by CRT workflows.
63+
#
64+
# Reference: https://github.com/hashicorp/actions-generate-metadata/blob/main/README.md
65+
generate-metadata-file:
66+
needs: set-product-version
67+
runs-on: ubuntu-latest
68+
outputs:
69+
filepath: ${{ steps.generate-metadata-file.outputs.filepath }}
70+
steps:
71+
- name: "Checkout directory"
72+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
73+
- name: Generate metadata file
74+
id: generate-metadata-file
75+
uses: hashicorp/actions-generate-metadata@v1
76+
with:
77+
version: ${{ needs.set-product-version.outputs.product-version }}
78+
product: ${{ env.PKG_NAME }}
79+
repositoryOwner: "hashicorp"
80+
- uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
81+
with:
82+
name: metadata.json
83+
path: ${{ steps.generate-metadata-file.outputs.filepath }}
84+
85+
# Uploads an Actions artifact named terraform-registry-manifest.json.zip.
86+
#
87+
# The artifact contains a single file with a filename that Terraform Registry expects
88+
# (example: terraform-provider-crt-example_2.3.6-alpha1_manifest.json). The file contents
89+
# are identical to the terraform-registry-manifest.json file in the source repository.
90+
upload-terraform-registry-manifest-artifact:
91+
needs: set-product-version
92+
runs-on: ubuntu-latest
93+
steps:
94+
- name: "Checkout directory"
95+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
96+
with:
97+
path: ${{ env.PKG_NAME }}
98+
- name: "Copy manifest from checkout directory to a file with the desired name"
99+
id: terraform-registry-manifest
100+
run: |
101+
name="${{ env.PKG_NAME }}"
102+
version="${{ needs.set-product-version.outputs.product-version }}"
103+
104+
source="${name}/terraform-registry-manifest.json"
105+
destination="${name}_${version}_manifest.json"
106+
107+
cp "$source" "$destination"
108+
echo "filename=$destination" >> "$GITHUB_OUTPUT"
109+
- uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
110+
with:
111+
name: terraform-registry-manifest.json
112+
path: ${{ steps.terraform-registry-manifest.outputs.filename }}
113+
if-no-files-found: error
114+
115+
# Builds the product for all platforms except macOS.
116+
#
117+
# With `reproducible: report`, this job also reports whether the build is reproducible,
118+
# but does not enforce it.
119+
#
120+
# Reference: https://github.com/hashicorp/actions-go-build/blob/main/README.md
121+
build:
122+
needs:
123+
- get-go-version
124+
- set-product-version
125+
runs-on: ubuntu-latest
126+
strategy:
127+
fail-fast: true
128+
# TODO: Customize `matrix` for your provider. Compare to existing .goreleaser.yml.
129+
# Verify expected Artifacts list for a workflow run.
130+
matrix:
131+
goos: [freebsd, windows, linux, darwin]
132+
goarch: ["386", "amd64", "arm", "arm64"]
133+
exclude:
134+
- goos: darwin
135+
goarch: arm
136+
- goos: darwin
137+
goarch: "386"
138+
- goos: freebsd
139+
goarch: arm64
140+
- goos: windows
141+
goarch: arm64
142+
- goos: windows
143+
goarch: arm
144+
145+
name: Go ${{ needs.get-go-version.outputs.go-version }} ${{ matrix.goos }} ${{ matrix.goarch }} build
146+
steps:
147+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
148+
- uses: hashicorp/actions-go-build@v1
149+
env:
150+
CGO_ENABLED: 0
151+
BASE_VERSION: ${{ needs.set-product-version.outputs.product-base-version }}
152+
PRERELEASE_VERSION: ${{ needs.set-product-version.outputs.product-prerelease-version}}
153+
METADATA_VERSION: ${{ env.METADATA }}
154+
with:
155+
# Protocol v6 providers should omit the `_x5` suffix.
156+
bin_name: "${{ env.PKG_NAME }}_v${{ needs.set-product-version.outputs.product-version }}_x5"
157+
product_name: ${{ env.PKG_NAME }}
158+
product_version: ${{ needs.set-product-version.outputs.product-version }}
159+
go_version: ${{ needs.get-go-version.outputs.go-version }}
160+
os: ${{ matrix.goos }}
161+
arch: ${{ matrix.goarch }}
162+
reproducible: report
163+
instructions: |
164+
go build \
165+
-o "$BIN_PATH" \
166+
-trimpath \
167+
-buildvcs=false \
168+
-ldflags "-s -w -X 'main.version=${{ needs.set-product-version.outputs.product-version }}'"
169+
cp LICENSE "$TARGET_DIR/LICENSE.txt"
170+
171+
whats-next:
172+
needs:
173+
- build
174+
- generate-metadata-file
175+
- upload-terraform-registry-manifest-artifact
176+
runs-on: ubuntu-latest
177+
name: "What's next?"
178+
steps:
179+
- name: "Write a helpful summary"
180+
run: |
181+
github_dot_com="${{ github.server_url }}"
182+
owner_with_name="${{ github.repository }}"
183+
ref="${{ github.ref }}"
184+
185+
echo "### What's next?" >> "$GITHUB_STEP_SUMMARY"
186+
echo "#### For a release branch (see \`.release/ci.hcl\`)" >> $GITHUB_STEP_SUMMARY
187+
echo "After this \`build\` workflow run completes succesfully, you can expect the CRT \`prepare\` workflow to begin momentarily." >> "$GITHUB_STEP_SUMMARY"
188+
echo "To find the \`prepare\` workflow run, [view the checks for this commit]($github_dot_com/$owner_with_name/commits/$ref)" >> "$GITHUB_STEP_SUMMARY"

‎.release/ci.hcl‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
// Reference: https://github.com/hashicorp/crt-core-helloworld/blob/main/.release/ci.hcl (private repository)
2+
//
3+
// One way to validate this file, with a local build of the orchestrator (an internal repo):
4+
//
5+
// $ GITHUB_TOKEN="not-used" orchestrator parse config -use-v2 -local-config=.release/ci.hcl
6+
7+
schema = "2"
8+
9+
project "terraform-provider-azuread" {
10+
// team is currently unused and has no meaning
11+
// but is required to be non-empty by CRT orchestator
12+
team = "_UNUSED_"
13+
14+
slack {
15+
notification_channel = "C7T8GB62H" // #tech-azure
16+
}
17+
18+
github {
19+
organization = "hashicorp"
20+
repository = "terraform-provider-azuread"
21+
release_branches = ["main"]
22+
}
23+
}
24+
25+
event "merge" {
26+
}
27+
28+
event "build" {
29+
action "build" {
30+
depends = ["merge"]
31+
32+
organization = "hashicorp"
33+
repository = "terraform-provider-azuread"
34+
workflow = "build"
35+
}
36+
}
37+
38+
event "prepare" {
39+
# `prepare` is the Common Release Tooling (CRT) artifact processing workflow.
40+
# It prepares artifacts for potential promotion to staging and production.
41+
# For example, it scans and signs artifacts.
42+
43+
depends = ["build"]
44+
45+
action "prepare" {
46+
organization = "hashicorp"
47+
repository = "crt-workflows-common"
48+
workflow = "prepare"
49+
depends = ["build"]
50+
}
51+
52+
notification {
53+
on = "fail"
54+
}
55+
}
56+
57+
event "trigger-staging" {
58+
}
59+
60+
event "promote-staging" {
61+
action "promote-staging" {
62+
organization = "hashicorp"
63+
repository = "crt-workflows-common"
64+
workflow = "promote-staging"
65+
depends = null
66+
config = "release-metadata.hcl"
67+
}
68+
69+
depends = ["trigger-staging"]
70+
71+
notification {
72+
on = "always"
73+
}
74+
}
75+
76+
event "trigger-production" {
77+
}
78+
79+
event "promote-production" {
80+
action "promote-production" {
81+
organization = "hashicorp"
82+
repository = "crt-workflows-common"
83+
workflow = "promote-production"
84+
depends = null
85+
config = ""
86+
}
87+
88+
depends = ["trigger-production"]
89+
90+
notification {
91+
on = "always"
92+
}
93+
}

‎.release/release-metadata.hcl‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
# Copyright (c) HashiCorp, Inc.
22
# SPDX-License-Identifier: MPL-2.0
33

4-
url_source_repository = "https://github.com/hashicorp/terraform-provider-azuread"
54
url_license = "https://github.com/hashicorp/terraform-provider-azuread/blob/main/LICENSE"
5+
url_project_website = "https://registry.terraform.io/providers/hashicorp/azuread"
6+
url_release_notes = "https://github.com/hashicorp/terraform-provider-azuread/blob/main/CHANGELOG.md"
7+
url_source_repository = "https://github.com/hashicorp/terraform-provider-azuread"

‎.release/security-scan.hcl‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Reference: https://github.com/hashicorp/security-scanner/blob/main/CONFIG.md#binary (private repository)
2+
3+
binary {
4+
secrets {
5+
all = true
6+
}
7+
go_modules = true
8+
osv = true
9+
oss_index = false
10+
nvd = false
11+
}

‎.release/terraform-provider-azuread-artifacts.hcl‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
schema = 1
2+
artifacts {
3+
# This should match the `matrix` in .github/workflows/build.yml
4+
zip = [
5+
"terraform-provider-azuread_${version}_darwin_amd64.zip",
6+
"terraform-provider-azuread_${version}_darwin_arm64.zip",
7+
"terraform-provider-azuread_${version}_freebsd_386.zip",
8+
"terraform-provider-azuread_${version}_freebsd_amd64.zip",
9+
"terraform-provider-azuread_${version}_freebsd_arm.zip",
10+
"terraform-provider-azuread_${version}_linux_386.zip",
11+
"terraform-provider-azuread_${version}_linux_amd64.zip",
12+
"terraform-provider-azuread_${version}_linux_arm.zip",
13+
"terraform-provider-azuread_${version}_linux_arm64.zip",
14+
"terraform-provider-azuread_${version}_windows_386.zip",
15+
"terraform-provider-azuread_${version}_windows_amd64.zip",
16+
]
17+
}

‎version/VERSION‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
3.3.0

0 commit comments

Comments
 (0)