Skip to content

Commit 97d0707

Browse files
stephybunstephybun
committed
add CRT workflows
1 parent da6e5e6 commit 97d0707

File tree

6 files changed

+311
-0
lines changed

6 files changed

+311
-0
lines changed

‎.github/workflows/build.yml‎

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
# This workflow builds the product for all supported platforms and uploads the resulting
2+
# binaries as Actions artifacts. The workflow also uploads a build metadata file
3+
# (metadata.json) -- and a Terraform Registry manifest file (terraform-registry-manifest.json).
4+
#
5+
# Reference: https://github.com/hashicorp/terraform-provider-crt-example/blob/main/.github/workflows/README.md
6+
#
7+
# TODO comments are provided to guide you through customizing this workflow for your provider.
8+
9+
name: build
10+
11+
# We default to running this workflow on every push to every branch.
12+
# This provides fast feedback when build issues occur, so they can be
13+
# fixed prior to being merged to the main branch.
14+
#
15+
# If you want to opt out of this, and only run the build on certain branches
16+
# please refer to the documentation on branch filtering here:
17+
#
18+
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onpushbranchestagsbranches-ignoretags-ignore
19+
#
20+
on: [workflow_dispatch, push]
21+
22+
env:
23+
PKG_NAME: "terraform-provider-azuread"
24+
25+
jobs:
26+
# Detects the Go toolchain version to use for product builds.
27+
#
28+
# The implementation is inspired by envconsul -- https://go.hashi.co/get-go-version-example
29+
get-go-version:
30+
name: "Detect Go toolchain version"
31+
runs-on: ubuntu-latest
32+
outputs:
33+
go-version: ${{ steps.get-go-version.outputs.go-version }}
34+
steps:
35+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
36+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
37+
with:
38+
go-version-file: 'go.mod'
39+
- name: Detect Go version
40+
id: get-go-version
41+
run: |
42+
version="$(go list -f {{.GoVersion}} -m)"
43+
echo "go-version=$version" >> "$GITHUB_OUTPUT"
44+
45+
# Parses the version/VERSION file. Reference: https://github.com/hashicorp/actions-set-product-version/blob/main/README.md
46+
#
47+
# > This action should be implemented in product repo `build.yml` files. The action is intended to grab the version
48+
# > from the version file at the beginning of the build, then passes those versions (along with metadata, where
49+
# > necessary) to any workflow jobs that need version information.
50+
set-product-version:
51+
name: "Parse version file"
52+
runs-on: ubuntu-latest
53+
outputs:
54+
product-version: ${{ steps.set-product-version.outputs.product-version }}
55+
product-base-version: ${{ steps.set-product-version.outputs.base-product-version }}
56+
product-prerelease-version: ${{ steps.set-product-version.outputs.prerelease-product-version }}
57+
product-minor-version: ${{ steps.set-product-version.outputs.minor-product-version }}
58+
steps:
59+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
60+
- name: Set variables
61+
id: set-product-version
62+
uses: hashicorp/actions-set-product-version@v2
63+
64+
# Creates metadata.json file containing build metadata for consumption by CRT workflows.
65+
#
66+
# Reference: https://github.com/hashicorp/actions-generate-metadata/blob/main/README.md
67+
generate-metadata-file:
68+
needs: set-product-version
69+
runs-on: ubuntu-latest
70+
outputs:
71+
filepath: ${{ steps.generate-metadata-file.outputs.filepath }}
72+
steps:
73+
- name: "Checkout directory"
74+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
75+
- name: Generate metadata file
76+
id: generate-metadata-file
77+
uses: hashicorp/actions-generate-metadata@v1
78+
with:
79+
version: ${{ needs.set-product-version.outputs.product-version }}
80+
product: ${{ env.PKG_NAME }}
81+
repositoryOwner: "hashicorp"
82+
- uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
83+
with:
84+
name: metadata.json
85+
path: ${{ steps.generate-metadata-file.outputs.filepath }}
86+
87+
# Uploads an Actions artifact named terraform-registry-manifest.json.zip.
88+
#
89+
# The artifact contains a single file with a filename that Terraform Registry expects
90+
# (example: terraform-provider-crt-example_2.3.6-alpha1_manifest.json). The file contents
91+
# are identical to the terraform-registry-manifest.json file in the source repository.
92+
upload-terraform-registry-manifest-artifact:
93+
needs: set-product-version
94+
runs-on: ubuntu-latest
95+
steps:
96+
- name: "Checkout directory"
97+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
98+
with:
99+
path: ${{ env.PKG_NAME }}
100+
- name: "Copy manifest from checkout directory to a file with the desired name"
101+
id: terraform-registry-manifest
102+
run: |
103+
name="${{ env.PKG_NAME }}"
104+
version="${{ needs.set-product-version.outputs.product-version }}"
105+
106+
source="${name}/terraform-registry-manifest.json"
107+
destination="${name}_${version}_manifest.json"
108+
109+
cp "$source" "$destination"
110+
echo "filename=$destination" >> "$GITHUB_OUTPUT"
111+
- uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
112+
with:
113+
name: terraform-registry-manifest.json
114+
path: ${{ steps.terraform-registry-manifest.outputs.filename }}
115+
if-no-files-found: error
116+
117+
# Builds the product for all platforms except macOS.
118+
#
119+
# With `reproducible: report`, this job also reports whether the build is reproducible,
120+
# but does not enforce it.
121+
#
122+
# Reference: https://github.com/hashicorp/actions-go-build/blob/main/README.md
123+
build:
124+
needs:
125+
- get-go-version
126+
- set-product-version
127+
runs-on: ubuntu-latest
128+
strategy:
129+
fail-fast: true
130+
# TODO: Customize `matrix` for your provider. Compare to existing .goreleaser.yml.
131+
# Verify expected Artifacts list for a workflow run.
132+
matrix:
133+
goos: [freebsd, windows, linux, darwin]
134+
goarch: ["386", "amd64", "arm", "arm64"]
135+
exclude:
136+
- goos: freebsd
137+
goarch: arm64
138+
- goos: windows
139+
goarch: arm64
140+
- goos: windows
141+
goarch: arm
142+
143+
name: Go ${{ needs.get-go-version.outputs.go-version }} ${{ matrix.goos }} ${{ matrix.goarch }} build
144+
steps:
145+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
146+
- uses: hashicorp/actions-go-build@v1
147+
env:
148+
CGO_ENABLED: 0
149+
BASE_VERSION: ${{ needs.set-product-version.outputs.product-base-version }}
150+
PRERELEASE_VERSION: ${{ needs.set-product-version.outputs.product-prerelease-version}}
151+
METADATA_VERSION: ${{ env.METADATA }}
152+
with:
153+
# Protocol v6 providers should omit the `_x5` suffix.
154+
bin_name: "${{ env.PKG_NAME }}_v${{ needs.set-product-version.outputs.product-version }}_x5"
155+
product_name: ${{ env.PKG_NAME }}
156+
product_version: ${{ needs.set-product-version.outputs.product-version }}
157+
go_version: ${{ needs.get-go-version.outputs.go-version }}
158+
os: ${{ matrix.goos }}
159+
arch: ${{ matrix.goarch }}
160+
reproducible: report
161+
instructions: |
162+
go build \
163+
-o "$BIN_PATH" \
164+
-trimpath \
165+
-buildvcs=false \
166+
-ldflags "-s -w -X 'main.version=${{ needs.set-product-version.outputs.product-version }}'"
167+
cp LICENSE "$TARGET_DIR/LICENSE.txt"
168+
169+
whats-next:
170+
needs:
171+
- build
172+
- generate-metadata-file
173+
- upload-terraform-registry-manifest-artifact
174+
runs-on: ubuntu-latest
175+
name: "What's next?"
176+
steps:
177+
- name: "Write a helpful summary"
178+
run: |
179+
github_dot_com="${{ github.server_url }}"
180+
owner_with_name="${{ github.repository }}"
181+
ref="${{ github.ref }}"
182+
183+
echo "### What's next?" >> "$GITHUB_STEP_SUMMARY"
184+
echo "#### For a release branch (see \`.release/ci.hcl\`)" >> $GITHUB_STEP_SUMMARY
185+
echo "After this \`build\` workflow run completes succesfully, you can expect the CRT \`prepare\` workflow to begin momentarily." >> "$GITHUB_STEP_SUMMARY"
186+
echo "To find the \`prepare\` workflow run, [view the checks for this commit]($github_dot_com/$owner_with_name/commits/$ref)" >> "$GITHUB_STEP_SUMMARY"

‎.release/ci.hcl‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
// Reference: https://github.com/hashicorp/crt-core-helloworld/blob/main/.release/ci.hcl (private repository)
2+
//
3+
// One way to validate this file, with a local build of the orchestrator (an internal repo):
4+
//
5+
// $ GITHUB_TOKEN="not-used" orchestrator parse config -use-v2 -local-config=.release/ci.hcl
6+
7+
schema = "2"
8+
9+
project "terraform-provider-azuread" {
10+
// team is currently unused and has no meaning
11+
// but is required to be non-empty by CRT orchestator
12+
team = "_UNUSED_"
13+
14+
slack {
15+
notification_channel = "C7T8GB62H" // #tech-azure
16+
}
17+
18+
github {
19+
organization = "hashicorp"
20+
repository = "terraform-provider-azuread"
21+
release_branches = ["main"]
22+
}
23+
}
24+
25+
event "merge" {
26+
}
27+
28+
event "build" {
29+
action "build" {
30+
depends = ["merge"]
31+
32+
organization = "hashicorp"
33+
repository = "terraform-provider-azuread"
34+
workflow = "build"
35+
}
36+
}
37+
38+
event "prepare" {
39+
# `prepare` is the Common Release Tooling (CRT) artifact processing workflow.
40+
# It prepares artifacts for potential promotion to staging and production.
41+
# For example, it scans and signs artifacts.
42+
43+
depends = ["build"]
44+
45+
action "prepare" {
46+
organization = "hashicorp"
47+
repository = "crt-workflows-common"
48+
workflow = "prepare"
49+
depends = ["build"]
50+
}
51+
52+
notification {
53+
on = "fail"
54+
}
55+
}
56+
57+
event "trigger-staging" {
58+
}
59+
60+
event "promote-staging" {
61+
action "promote-staging" {
62+
organization = "hashicorp"
63+
repository = "crt-workflows-common"
64+
workflow = "promote-staging"
65+
depends = null
66+
config = "release-metadata.hcl"
67+
}
68+
69+
depends = ["trigger-staging"]
70+
71+
notification {
72+
on = "always"
73+
}
74+
}
75+
76+
event "trigger-production" {
77+
}
78+
79+
event "promote-production" {
80+
action "promote-production" {
81+
organization = "hashicorp"
82+
repository = "crt-workflows-common"
83+
workflow = "promote-production"
84+
depends = null
85+
config = ""
86+
}
87+
88+
depends = ["trigger-production"]
89+
90+
notification {
91+
on = "always"
92+
}
93+
}

‎.release/release-metadata.hcl‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,6 @@
22
# SPDX-License-Identifier: MPL-2.0
33

44
url_source_repository = "https://github.com/hashicorp/terraform-provider-azuread"
5+
url_project_website = "https://registry.terraform.io/providers/hashicorp/azuread"
56
url_license = "https://github.com/hashicorp/terraform-provider-azuread/blob/main/LICENSE"
7+
url_release_notes = "https://github.com/hashicorp/terraform-provider-azuread/blob/main/CHANGELOG.md"

‎.release/security-scan.hcl‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Reference: https://github.com/hashicorp/security-scanner/blob/main/CONFIG.md#binary (private repository)
2+
3+
binary {
4+
secrets {
5+
all = true
6+
}
7+
go_modules = true
8+
osv = true
9+
oss_index = false
10+
nvd = false
11+
}

‎.release/terraform-provider-azuread-artifacts.hcl‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
schema = 1
2+
artifacts {
3+
# TODO: Customize `zip` for your provider. Compare to existing .goreleaser.yml.
4+
# This should match the `matrix` in .github/workflows/build.yml
5+
zip = [
6+
"terraform-provider-azuread_${version}_darwin_amd64.zip",
7+
"terraform-provider-azuread_${version}_darwin_arm64.zip",
8+
"terraform-provider-azuread_${version}_freebsd_386.zip",
9+
"terraform-provider-azuread_${version}_freebsd_amd64.zip",
10+
"terraform-provider-azuread_${version}_freebsd_arm.zip",
11+
"terraform-provider-azuread_${version}_linux_386.zip",
12+
"terraform-provider-azuread_${version}_linux_amd64.zip",
13+
"terraform-provider-azuread_${version}_linux_arm.zip",
14+
"terraform-provider-azuread_${version}_linux_arm64.zip",
15+
"terraform-provider-azuread_${version}_windows_386.zip",
16+
"terraform-provider-azuread_${version}_windows_amd64.zip",
17+
]
18+
}

‎version/VERSION‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
v3.4.0-alpha1

0 commit comments

Comments
 (0)