SEC-090: Automated trusted workflow pinning (2024-05-27) (#140) #239
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: build | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: | |
| - main | |
| - 'release/*.*.x' | |
| env: | |
| PKG_NAME: "consul-telemetry-collector" | |
| BIN_NAME: "consul-telemetry-collector" | |
| jobs: | |
| get-go-version: | |
| name: "Determine Go toolchain version" | |
| runs-on: ubuntu-latest | |
| outputs: | |
| go-version: ${{ steps.get-go-version.outputs.go-version }} | |
| steps: | |
| - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 | |
| - name: Determine Go version | |
| id: get-go-version | |
| # We use .go-version as our source of truth for current Go | |
| # version, because "goenv" can react to it automatically. | |
| run: | | |
| echo "Building with Go $(cat .go-version)" | |
| echo "go-version=$(cat .go-version)" >> $GITHUB_OUTPUT | |
| set-product-version: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| product-version: ${{ steps.set-product-version.outputs.product-version }} | |
| base-product-version: ${{ steps.set-product-version.outputs.base-product-version }} | |
| prerelease-product-version: ${{ steps.set-product-version.outputs.prerelease-product-version }} | |
| steps: | |
| - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 | |
| - name: Set Product version | |
| id: set-product-version | |
| uses: hashicorp/actions-set-product-version@v2 | |
| generate-metadata-file: | |
| needs: set-product-version | |
| runs-on: ubuntu-latest | |
| outputs: | |
| filepath: ${{ steps.generate-metadata-file.outputs.filepath }} | |
| steps: | |
| - name: "Checkout directory" | |
| uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 | |
| - name: Generate metadata file | |
| id: generate-metadata-file | |
| uses: hashicorp/actions-generate-metadata@v1 | |
| with: | |
| version: ${{ needs.set-product-version.outputs.product-version }} | |
| product: ${{ env.PKG_NAME }} | |
| repositoryOwner: "hashicorp" | |
| - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 | |
| with: | |
| name: metadata.json | |
| path: ${{ steps.generate-metadata-file.outputs.filepath }} | |
| test: | |
| runs-on: ubuntu-latest | |
| needs: | |
| - get-go-version | |
| steps: | |
| - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 | |
| - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1 | |
| with: | |
| go-version: ${{ needs.get-go-version.outputs.go-version }} | |
| - name: Deps | |
| run: | | |
| make deps | |
| - name: Test | |
| run: | | |
| make go/test | |
| - name: Lint | |
| run: | | |
| export PATH=$(go env GOPATH)/bin:$PATH | |
| make go/lint | |
| build-other: | |
| needs: | |
| - get-go-version | |
| - set-product-version | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: true | |
| matrix: | |
| goos: [freebsd, netbsd, openbsd, solaris] | |
| goarch: ["386", "amd64", "arm"] | |
| exclude: | |
| - goos: solaris | |
| goarch: 386 | |
| - goos: solaris | |
| goarch: arm | |
| - goos: netbsd | |
| goarch: 386 | |
| - goos: netbsd | |
| goarch: arm | |
| name: Go ${{ needs.get-go-version.outputs.go-version }} ${{ matrix.goos }} ${{ matrix.goarch }} build | |
| steps: | |
| - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 | |
| - uses: hashicorp/actions-go-build@v1 | |
| env: | |
| BASE_VERSION: ${{ needs.set-product-version.outputs.product-base-version }} | |
| PRERELEASE_VERSION: ${{ needs.set-product-version.outputs.product-prerelease-version}} | |
| METADATA_VERSION: ${{ env.METADATA }} | |
| with: | |
| product_name: ${{ env.PKG_NAME }} | |
| product_version: ${{ needs.set-product-version.outputs.product-version }} | |
| go_version: ${{ needs.get-go-version.outputs.go-version }} | |
| os: ${{ matrix.goos }} | |
| arch: ${{ matrix.goarch }} | |
| reproducible: report | |
| instructions: | | |
| cp LICENSE $TARGET_DIR/LICENSE.txt | |
| make build | |
| build-linux: | |
| needs: | |
| - get-go-version | |
| - set-product-version | |
| - test | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| goos: [linux] | |
| goarch: ["arm", "arm64", "386", "amd64"] | |
| fail-fast: true | |
| name: Go ${{ needs.get-go-version.outputs.go-version }} ${{ matrix.goos }} ${{ matrix.goarch }} build | |
| steps: | |
| - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 | |
| - uses: hashicorp/actions-go-build@v1 | |
| with: | |
| product_name: ${{ env.PKG_NAME }} | |
| product_version: ${{ needs.set-product-version.outputs.product-version }} | |
| go_version: ${{ needs.get-go-version.outputs.go-version }} | |
| os: ${{ matrix.goos }} | |
| arch: ${{ matrix.goarch }} | |
| reproducible: assert | |
| instructions: | | |
| cp LICENSE $TARGET_DIR/LICENSE.txt | |
| make build | |
| - name: Copy license file | |
| env: | |
| LICENSE_DIR: ".release/linux/package/usr/share/doc/${{ env.PKG_NAME }}" | |
| run: | | |
| mkdir -p "$LICENSE_DIR" | |
| cp LICENSE "$LICENSE_DIR/LICENSE.txt" | |
| - name: Package | |
| if: ${{ matrix.goos == 'linux' }} | |
| uses: hashicorp/actions-packaging-linux@v1 | |
| with: | |
| name: ${{ github.event.repository.name }} | |
| description: "Consul Telemetry Collector" | |
| arch: ${{ matrix.goarch }} | |
| version: ${{ needs.set-product-version.outputs.product-version }} | |
| maintainer: "HashiCorp" | |
| homepage: "https://github.com/hashicorp/consul-telemetry-collector" | |
| license: "MPL-2.0" | |
| binary: "dist/${{ env.PKG_NAME }}" | |
| deb_depends: "openssl" | |
| rpm_depends: "openssl" | |
| config_dir: ".release/linux/package" | |
| - name: Set Package Names | |
| if: ${{ matrix.goos == 'linux' }} | |
| run: | | |
| echo "RPM_PACKAGE=$(basename out/*.rpm)" >> $GITHUB_ENV | |
| echo "DEB_PACKAGE=$(basename out/*.deb)" >> $GITHUB_ENV | |
| - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 | |
| if: ${{ matrix.goos == 'linux' }} | |
| with: | |
| name: ${{ env.RPM_PACKAGE }} | |
| path: out/${{ env.RPM_PACKAGE }} | |
| - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 | |
| if: ${{ matrix.goos == 'linux' }} | |
| with: | |
| name: ${{ env.DEB_PACKAGE }} | |
| path: out/${{ env.DEB_PACKAGE }} | |
| build-darwin: | |
| needs: | |
| - get-go-version | |
| - set-product-version | |
| - test | |
| runs-on: macos-latest | |
| strategy: | |
| matrix: | |
| goos: [darwin] | |
| goarch: ["amd64", "arm64"] | |
| fail-fast: true | |
| name: Go ${{ needs.get-go-version.outputs.go-version }} ${{ matrix.goos }} ${{ matrix.goarch }} build | |
| env: | |
| GOOS: ${{ matrix.goos }} | |
| GOARCH: ${{ matrix.goarch }} | |
| steps: | |
| - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 | |
| - uses: hashicorp/actions-go-build@v1 | |
| with: | |
| product_name: ${{ env.PKG_NAME }} | |
| product_version: ${{ needs.set-product-version.outputs.product-version }} | |
| go_version: ${{ needs.get-go-version.outputs.go-version }} | |
| os: ${{ matrix.goos }} | |
| arch: ${{ matrix.goarch }} | |
| reproducible: assert | |
| instructions: | | |
| cp LICENSE $TARGET_DIR/LICENSE.txt | |
| make build | |
| build-docker-default: | |
| name: Docker ${{ matrix.arch }} default release build | |
| needs: | |
| - set-product-version | |
| - build-linux | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| arch: ["arm", "arm64", "386", "amd64"] | |
| env: | |
| repo: ${{ github.event.repository.name }} | |
| version: ${{ needs.set-product-version.outputs.product-version }} | |
| base-version: ${{ needs.set-product-version.outputs.base-product-version }} | |
| steps: | |
| - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 | |
| - name: Docker Build (Action) | |
| uses: hashicorp/actions-docker-build@v2 | |
| with: | |
| # Add smoke test here. Below is a sample smoke test that runs the built image | |
| # and validates the version. | |
| smoke_test: | | |
| TEST_VERSION="$(docker run "${IMAGE_NAME}" --version)" | |
| if [ "${TEST_VERSION}" != "${version}" ]; then | |
| echo "Test FAILED" | |
| echo "Test Version: ${TEST_VERSION}" | |
| echo "Version: ${version}" | |
| exit 1 | |
| fi | |
| echo "Test PASSED" | |
| version: ${{ env.version }} | |
| target: release-default | |
| arch: ${{ matrix.arch }} | |
| # The ECR tag used below is to allow us to test by pushing to a private ECR registry. | |
| # If you want to pubish to ECR use the following syntax instead - public.ecr.aws/hashicorp/${{env.repo}}:${{env.version}}. | |
| # Please note - if you haven't previously been publishing to ECR you will need to reach out to team-rel-eng | |
| # - https://hashicorp.atlassian.net/wiki/spaces/RDXPOC/pages/2298218311/How+to+Push+a+Docker+image+to+ECR | |
| tags: | | |
| docker.io/hashicorp/${{ env.repo }}:${{ env.version }} | |
| public.ecr.aws/hashicorp/${{ env.repo }}:${{ env.version }} | |
| # dev_tags are tags that get automatically pushed whenever successful | |
| # builds make it to the stable channel. The intention is for these tags | |
| # to be used for early testing of new code prior to official releases | |
| # going out. The stable channel implies that all tests and scans have | |
| # completed successfully, so these images should be _stable_ but are not | |
| # intended for production use. | |
| # | |
| # Here we have two example dev tags. The first (ending -dev) is a tag | |
| # that will be updated over-and-over as new builds arrive in stable. | |
| # | |
| # The second (using the git SHA) will produce a new separate tag for | |
| # each commit that is built. (These can still be overridden if the same | |
| # commit is built successfully a second time, but that is a less likely | |
| # scenario.) These kinds of dev tags are useful if you want to be able | |
| # to use Docker images built from those specific commits. | |
| # | |
| # NOTE: dev_tags MUST publish to the 'hashicorppreview' DockerHub org, it | |
| # will fail to any other DockerHub org or registry. You can optionally | |
| # prepend docker.io | |
| dev_tags: | | |
| docker.io/hashicorppreview/${{ env.repo }}:${{ env.base-version }}-dev | |
| docker.io/hashicorppreview/${{ env.repo }}:${{ env.version }}-${{ github.sha }} | |
| # build-docker-redhat is an example of how to build a Red Hat Certified Container (RHCC) Image. | |
| # This means it uses the 'redhat_tag' input, instead of 'tags' and 'dev_tags'. | |
| # | |
| # It's important to note that there are other important differences with RHCC images, compared | |
| # with calls using the 'tags' and optionally 'dev_tags' inputs: | |
| # | |
| # - They can only be built for a single architecture, | |
| # so the 'arch' input is hard-coded to 'amd64' in this case. | |
| # - Therefore, we don't use a matrix to expand over architectures, | |
| # when using the 'redhat_tag' input. | |
| # - We can only specify a single 'redhat_tag' not multiple tags, | |
| # as with the 'tags' and 'dev_tags' inputs. | |
| build-docker-redhat: | |
| name: Docker UBI Image Build (for Red Hat Certified Container Registry) | |
| needs: | |
| - set-product-version | |
| - build-linux | |
| runs-on: ubuntu-latest | |
| env: | |
| repo: ${{github.event.repository.name}} | |
| version: ${{needs.set-product-version.outputs.product-version}} | |
| steps: | |
| - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 | |
| - uses: hashicorp/actions-docker-build@v2 | |
| with: | |
| version: ${{env.version}} | |
| target: release-ubi | |
| arch: amd64 | |
| redhat_tag: quay.io/redhat-isv-containers/62211e0d8bf2cabc69a39c7d:${{env.version}}-ubi |