ldap-manager/.github/workflows/release.yml at fa34dacae0ca3fedc556c452a03313c785b7181d · netresearch/ldap-manager · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
name: Release

# Single-build release pipeline for go-app.
#
# Go binaries are cross-compiled ONCE by the `binaries` matrix, uploaded
# to the GitHub Release as user-facing artifacts, and then re-downloaded
# into `bin/` where the Dockerfile's `COPY bin/<name>-linux-*` stage
# picks the correct one per TARGETARCH/TARGETVARIANT. No `go build`
# runs inside Docker.
#
# Convention for frontend-embedding repos: ship `bun run build:assets`
# in package.json; this workflow invokes it before `go build` so assets
# exist when `go:embed` resolves them. No-op when package.json is
# absent, so non-frontend repos use this identical workflow unchanged.
#
# This file is template-managed — per-repo differences live in the
# Dockerfile and (optionally) the package.json build:assets script.
# Naming is derived from github.event.repository.name so the workflow
# is byte-identical across consumers.

on:
  push:
    tags: ['v*']
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to (re)build (e.g. v1.2.3)."
        required: true
        type: string

permissions:
  contents: read

jobs:
  create-release:
    name: Create GitHub Release
    uses: netresearch/.github/.github/workflows/create-release.yml@main
    permissions:
      contents: write
    with:
      tag: ${{ inputs.tag || github.ref_name }}

  binaries:
    name: Build ${{ matrix.target }}
    needs: create-release
    strategy:
      fail-fast: false
      matrix:
        include:
          - { target: linux-386,     goos: linux,   goarch: "386" }
          - { target: linux-amd64,   goos: linux,   goarch: amd64 }
          - { target: linux-arm64,   goos: linux,   goarch: arm64 }
          - { target: linux-armv6,   goos: linux,   goarch: arm,   goarm: "6" }
          - { target: linux-armv7,   goos: linux,   goarch: arm,   goarm: "7" }
          - { target: darwin-amd64,  goos: darwin,  goarch: amd64 }
          - { target: darwin-arm64,  goos: darwin,  goarch: arm64 }
          - { target: windows-amd64, goos: windows, goarch: amd64 }
    uses: netresearch/.github/.github/workflows/build-go-attest.yml@main
    permissions:
      contents: write
      id-token: write
      attestations: write
    with:
      binary-name: ${{ github.event.repository.name }}-${{ matrix.target }}
      # Resolve after checkout (see build-go-attest.yml). `auto` picks
      # `.` when ./main.go exists, else `./cmd/<repo-name>` when that
      # main.go exists, else fails. Keeps this template file byte-
      # identical regardless of whether the consumer uses a root-main
      # or cmd/ layout.
      main-package: auto
      goos: ${{ matrix.goos }}
      goarch: ${{ matrix.goarch }}
      goarm: ${{ matrix.goarm || '' }}
      # Fleet ldflag convention: repos that want to surface release
      # metadata declare `var version, build, buildTime string` in their
      # main package. Each repo decides which to forward into its own
      # version package (ofelia uses main.* directly; ldap-manager
      # forwards into internal/version.*). Empty values are a silent
      # no-op for repos that don't declare the corresponding var.
      # main.buildTime is injected via auto-build-timestamp (below)
      # so it stays populated on workflow_dispatch backfills where
      # github.event.head_commit is absent.
      ldflags: >-
        -s -w
        -X main.version=${{ needs.create-release.outputs.tag }}
        -X main.build=${{ needs.create-release.outputs.sha }}
      auto-build-timestamp: true
      ref: ${{ needs.create-release.outputs.tag }}
      release-tag: ${{ needs.create-release.outputs.tag }}
      sbom: true
      # setup-bun runs unconditionally. `hashFiles()` in the caller's `with:`
      # is evaluated BEFORE the reusable workflow's checkout, so the caller
      # workspace is empty and any guard would have always returned false.
      # The bun install/run commands below are `-f package.json`-gated, so
      # non-frontend repos (ofelia, raybeam) pay only the ~10s Bun install
      # overhead per matrix entry — no actual bun work happens.
      setup-bun: true
      pre-build-command: |
        if [ -f package.json ]; then
          bun install --frozen-lockfile
          bun run build:assets
        fi

  container:
    name: Build container image
    needs: [create-release, binaries]
    uses: netresearch/.github/.github/workflows/build-container.yml@main
    permissions:
      contents: read
      packages: write
      security-events: write
      id-token: write
      attestations: write
    with:
      image-name: ${{ github.event.repository.name }}
      ref: ${{ needs.create-release.outputs.tag }}
      platforms: "linux/386,linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64"
      sign: true
      attest: true
      pre-build-command: |
        set -euo pipefail
        mkdir -p bin
        for suffix in linux-386 linux-amd64 linux-arm64 linux-armv6 linux-armv7; do
          gh release download "${{ needs.create-release.outputs.tag }}" \
            --pattern "${{ github.event.repository.name }}-${suffix}" --dir bin
          chmod +x "bin/${{ github.event.repository.name }}-${suffix}"
        done

  finalize:
    name: Finalize release (checksums, cosign, notes)
    needs: [create-release, binaries, container]
    uses: netresearch/.github/.github/workflows/finalize-release.yml@main
    permissions:
      contents: write
      id-token: write
      attestations: write
    with:
      tag: ${{ needs.create-release.outputs.tag }}
      image-ref: ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}