Merge pull request #4634 from hashicorp/backport/convert-hashicorp-wa…

…ypoint-to-actions-20230412-195606/strongly-true-gibbon Backport of Convert hashicorp/waypoint to GitHub Actions into release/0.11.x
hashicorp · Apr 26, 2023 · da85c64 · da85c64
2 parents 9cad7f1 + f6c4bda
commit da85c64
Show file tree

Hide file tree

Showing 24 changed files with 760 additions and 104 deletions.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -1,7 +1,16 @@
 version: 2
+
 updates:
   - package-ecosystem: npm
     directory: /ui
     schedule:
       interval: weekly
     open-pull-requests-limit: 1
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
diff --git a/.github/scripts/split-tests.sh b/.github/scripts/split-tests.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+runner_count="${runner_count:-4}"
+
+all_packages=$(go list -json="ImportPath" ./...)
+
+filtered_packages=$(jq --compact-output \
+                       --slurp \
+                       'map(
+                         .ImportPath | 
+                         select(
+                           (contains("test-e2e") | not)
+                         )
+                       )'\
+                       <<< "${all_packages}")
+
+# _nwise is an undocumented jq function that splits an array
+# into arrays of size N where N is the input. We calculate N based
+# off of the number of packages divided by the number of GHA runners
+# we wish to use. We also track the array index to pass into the matrix
+# so that we can uniquely identify the test results.
+matrix=$(jq --argjson count $runner_count \
+            --compact-output \
+            -r \
+            '[_nwise(length / $count | ceil)] | to_entries | map({id: .key, packages: .value})' \
+            <<< "${filtered_packages}"
+)
+
+#             [keys as $k | {group: $k, packages: .[$k]}]' \
+echo "matrix=${matrix}" | tee -a $GITHUB_OUTPUT
diff --git a/.github/services/go-tests/docker-compose.yml b/.github/services/go-tests/docker-compose.yml
@@ -0,0 +1,26 @@
+version: "3.9"
+services:
+  localstack:
+    image: docker.mirror.hashicorp.services/localstack/localstack:1.3
+    ports:
+      - 4510-4559:4510-4559
+      - 4566:4566
+      - 5678:5678
+  pebble:
+    image: docker.mirror.hashicorp.services/letsencrypt/pebble
+    command: pebble
+    environment:
+      PEBBLE_VA_NOSLEEP: 1
+      PEBBLE_VA_ALWAYS_VALID: 1
+  postgres:
+    image: docker.mirror.hashicorp.services/circleci/postgres:11-alpine
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_DB: waypoint_test
+    ports:
+      - "5432:5432"
+  vault:
+    image: docker.mirror.hashicorp.services/vault
+    command: server -dev -dev-root-token-id=hznroot
+    ports:
+      - "8200:8200"
diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
@@ -0,0 +1,16 @@
+# If the repository is public, be sure to change to GitHub hosted runners
+name: Lint GitHub Actions Workflows
+on:
+  pull_request:
+    paths:
+      - .github/workflows/*
+
+permissions:
+  contents: read
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+      - name: "Check workflow files"
+        uses: docker://docker.mirror.hashicorp.services/rhysd/actionlint:latest
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
@@ -1,12 +1,10 @@
 ---
 name: Backport Assistant Runner
-
 on:
   pull_request_target:
     types:
       - closed
       - labeled
-
 jobs:
   backport:
     if: github.event.pull_request.merged
@@ -47,3 +45,5 @@ jobs:
           BACKPORT_LABEL_REGEXP: "backport/(?P<target>\\d+\\.\\d+\\.\\w+)"
           BACKPORT_TARGET_TEMPLATE: "release/{{.target}}"
           GITHUB_TOKEN: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+permissions:
+  contents: read
diff --git a/.github/workflows/build-waypoint-oss.yml b/.github/workflows/build-waypoint-oss.yml
@@ -35,9 +35,6 @@ on:
       waypoint-prerelease:
         type: string
         required: true
-      waypoint-metadata:
-        type: string
-        required: true
 
 jobs:
   build:
@@ -46,16 +43,16 @@ jobs:
       bin-name: ${{ steps.get-bin-name.outputs.bin-name }}
     name: Build ${{ inputs.package-name }} ${{ inputs.goos }} ${{ inputs.goarch }} v${{ inputs.waypoint-version }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
       - name: Restore ui assets
-        uses: actions/cache/restore@v3
+        uses: actions/cache/restore@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
         with:
           path: ui/dist/assets
           key: ui_assets_${{ github.sha }}
           fail-on-cache-miss: true
           enableCrossOsArchive: true
       - name: Restore build assets
-        uses: actions/cache/restore@v3
+        uses: actions/cache/restore@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
         with:
           path: internal/assets
           key: build_assets_${{ github.sha }}
@@ -77,7 +74,6 @@ jobs:
           WAYPOINT_GOARCH: ${{ inputs.goarch }}
           BASE_VERSION: ${{ inputs.waypoint-base-version }}
           PRERELEASE: ${{ inputs.waypoint-prerelease }}
-          ACTIONSOS: ${{ inputs.runson }}
           CGO_ENABLED: ${{ inputs.cgo-enabled }}
           CRT_BIN_NAME: ${{ steps.get-bin-name.outputs.bin-name }}
         uses: hashicorp/actions-go-build@v0.1.7
@@ -90,34 +86,36 @@ jobs:
           reproducible: nope
           instructions: |
             make bin/crt-${{ inputs.package-name }}
+
       - name: Linux packaging
+        id: packaging
         if: ${{ (inputs.goos == 'linux') && (inputs.package-name == 'waypoint') && (inputs.goarch != '386') }}
         uses: hashicorp/actions-packaging-linux@v1
         with:
           name: ${{ inputs.package-name }}
           description: ${{ inputs.package-name }}
           arch: ${{ inputs.goarch }}
-          version: ${{ inputs.waypoint-version }}+${{ inputs.waypoint-metadata }}
+          version: ${{ inputs.waypoint-version }}
           maintainer: "HashiCorp"
           homepage: "https://github.com/hashicorp/waypoint"
           license: "MPL-2.0"
           binary: "dist/${{ inputs.package-name }}"
           deb_depends: "git"
           rpm_depends: "git"
       - name: Set Package Names
-        if: ${{ inputs.goos == 'linux' }}
+        if: steps.packaging.conclusion == 'success'
         run: |
-          echo "RPM_PACKAGE=$(basename out/*.rpm)" >> $GITHUB_ENV
-          echo "DEB_PACKAGE=$(basename out/*.deb)" >> $GITHUB_ENV
-
-      - uses: actions/upload-artifact@v2
-        if: ${{ inputs.goos == 'linux' }}
+          echo "RPM_PACKAGE=$(basename out/*.rpm)" >> "$GITHUB_ENV"
+          echo "DEB_PACKAGE=$(basename out/*.deb)" >> "$GITHUB_ENV"
+      - name: Upload rpm package
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        if: steps.packaging.conclusion == 'success'
         with:
           name: ${{ env.RPM_PACKAGE }}
           path: out/${{ env.RPM_PACKAGE }}
-
-      - uses: actions/upload-artifact@v2
-        if: ${{ inputs.goos == 'linux' }}
+      - name: Upload deb package
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        if: steps.packaging.conclusion == 'success'
         with:
           name: ${{ env.DEB_PACKAGE }}
-          path: out/${{ env.DEB_PACKAGE }}
+          path: out/${{ env.DEB_PACKAGE }}
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -14,6 +14,7 @@ env:
 permissions:
   contents: read
   statuses: write
+  packages: write
 
 jobs:
   get-product-version:
@@ -26,7 +27,7 @@ jobs:
       pkg-name: ${{ steps.get-pkg-env-vars.outputs.pkg-name }}
       pkg-metadata: ${{ steps.get-pkg-env-vars.outputs.pkg-metadata }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
       - name: Get package environment variables
         id: get-pkg-env-vars
         run: |
@@ -48,12 +49,12 @@ jobs:
     outputs:
       go-version: ${{ steps.get-go-version.outputs.go-version }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
       - name: Determine Go version
         id: get-go-version
         run: |
           echo "Building with Go $(cat .go-version)"
-          echo "go-version=$(cat .go-version)" >> $GITHUB_OUTPUT
+          echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
 
   generate-metadata-file:
     name: "Generate release metadata"
@@ -62,14 +63,14 @@ jobs:
     outputs:
       filepath: ${{ steps.generate-metadata-file.outputs.filepath }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
       - name: Generate package metadata
         id: generate-metadata-file
         uses: hashicorp/actions-generate-metadata@v1
         with:
           version: ${{ needs.get-product-version.outputs.product-version }}
           product: ${{ env.PKG_NAME }}
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
         with:
           name: metadata.json
           path: ${{ steps.generate-metadata-file.outputs.filepath }}
@@ -79,9 +80,9 @@ jobs:
     name: Build UI
     needs: get-product-version
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
       - name: Set up node and yarn
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
         with:
           node-version: 14
           cache: yarn
@@ -90,14 +91,14 @@ jobs:
         run: |
           export PKG_VERSION=${{ needs.get-product-version.outputs.product-version }}
           export PKG_BINARY_TYPE=${{ needs.get-product-version.outputs.pkg-metadata }}
-          export PKG_COPYRIGHT_YEAR=$(git show -s --format=%cd --date=format:%Y HEAD)
+          PKG_COPYRIGHT_YEAR="$(git show -s --format=%cd --date=format:%Y HEAD)" ; export PKG_COPYRIGHT_YEAR
           export PKG_NAME=${{ needs.get-product-version.outputs.pkg-name }}
           echo "${PKG_NAME} version is ${PKG_VERSION}"
           echo "${PKG_NAME} binary type is ${PKG_BINARY_TYPE}"
           echo "${PKG_NAME} copyright year is ${PKG_COPYRIGHT_YEAR}"
           cd ui && make && cd ..
       - name: Save assets to cache
-        uses: actions/cache/save@v3
+        uses: actions/cache/save@v3 # TSCCR: no version of actions/cache trusts nested action "save"
         with:
           path: ui/dist/assets
           key: ui_assets_${{ github.sha }}
@@ -110,12 +111,12 @@ jobs:
       - get-product-version
       - build-ui
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v3
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+      - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
         with:
           go-version: ${{ needs.get-go-version.outputs.go-version }}
       - name: Restore ui assets
-        uses: actions/cache/restore@v3
+        uses: actions/cache/restore@v3 # TSCCR: no version of actions/cache trusts nested action "restore"
         with:
           path: ui/dist/assets
           key: ui_assets_${{ github.sha }}
@@ -130,7 +131,7 @@ jobs:
           go install github.com/kevinburke/go-bindata/go-bindata@v3.24.0+incompatible
           make bin/crt-assets
       - name: Save assets to cache
-        uses: actions/cache/save@v3
+        uses: actions/cache/save@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
         with:
           path: internal/assets
           key: build_assets_${{ github.sha }}
@@ -153,7 +154,7 @@ jobs:
           - {goos: "darwin", goarch: "amd64", pkg-name: "waypoint"}
           - { goos: "darwin", goarch: "arm64", pkg-name: "waypoint-entrypoint" }
           - { goos: "darwin", goarch: "amd64", pkg-name: "waypoint-entrypoint" }
-    name: Go ${{ matrix.go }} ${{ matrix.goos }} ${{ matrix.goarch }} build
+    name: Go ${{ matrix.goos }} ${{ matrix.goarch }} build
     uses: ./.github/workflows/build-waypoint-oss.yml
     with:
       create-packages: false
@@ -165,7 +166,6 @@ jobs:
       waypoint-version: ${{ needs.get-product-version.outputs.product-version }}
       waypoint-base-version: ${{ needs.get-product-version.outputs.base-product-version }}
       waypoint-prerelease: ${{ needs.get-product-version.outputs.prerelease-product-version }}
-      waypoint-metadata: ${{ needs.get-product-version.outputs.pkg-metadata }}
     secrets: inherit
 
   package-docker-waypoint-server:
@@ -182,25 +182,25 @@ jobs:
       repo: "waypoint"
       version: ${{ needs.get-product-version.outputs.product-version }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
       - name: Download Waypoint
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           path: archive
           name: waypoint_${{env.version}}_linux_${{ matrix.arch }}.zip
       - name: Download Entrypoint
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           path: archive
           name: waypoint-entrypoint_${{ env.version }}_linux_${{ matrix.arch }}.zip
       - name: Prepare zipped binaries to build Docker image
         id: prepare-zips
         run: |
-          DIR=$(mktemp -d)
-          echo "working-dir=$DIR" >> $GITHUB_OUTPUT
-          cp -v Dockerfile $DIR/Dockerfile
-          unzip -j archive/waypoint_${{env.version}}_linux_${{ matrix.arch }}.zip -d $DIR
-          unzip -j archive/waypoint-entrypoint_${{env.version}}_linux_${{ matrix.arch }}.zip -d $DIR
+          DIR="$(mktemp -d)"
+          echo "working-dir=$DIR" >> "$GITHUB_OUTPUT"
+          cp -v Dockerfile "$DIR/Dockerfile"
+          unzip -j "archive/waypoint_${{env.version}}_linux_${{ matrix.arch }}.zip" -d "$DIR"
+          unzip -j "archive/waypoint-entrypoint_${{env.version}}_linux_${{ matrix.arch }}.zip" -d "$DIR"
       - name: Build Docker image
         uses: hashicorp/actions-docker-build@v1
         with:
@@ -220,8 +220,6 @@ jobs:
   package-docker-waypoint-odr:
     name: Build Docker ODR image for linux_${{ matrix.arch }}
     runs-on: ubuntu-latest
-    outputs:
-      product-version: ${{ steps.prepare-zips.outputs.working-dir }}
     needs:
       - get-product-version
       - build-waypoint
@@ -233,7 +231,7 @@ jobs:
       repo: "waypoint"
       version: ${{ needs.get-product-version.outputs.product-version }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
       - name: Build Docker image
         uses: hashicorp/actions-docker-build@v1
         with:
@@ -247,3 +245,17 @@ jobs:
             docker.io/hashicorp/${{env.repo}}-odr:${{env.version}}
             public.ecr.aws/hashicorp/${{env.repo}}-odr:${{env.version}}
 
+  end-to-end-tests:
+    needs:
+      - get-product-version
+      - package-docker-waypoint-server
+      - package-docker-waypoint-odr
+    uses: ./.github/workflows/end-to-end.yml
+    with:
+      waypoint-binary: waypoint_${{needs.get-product-version.outputs.product-version}}_linux_amd64.zip
+      waypoint-tar: waypoint_crt_linux_amd64_0.12.0_${{github.sha}}.docker.tar
+      waypoint-image: hashicorp/waypoint:${{ needs.get-product-version.outputs.product-version }}
+      waypoint-odr-tar: waypoint_odr-crt_linux_amd64_0.12.0_${{github.sha}}.docker.tar
+      waypoint-odr-image: hashicorp/waypoint-odr:${{ needs.get-product-version.outputs.product-version }}
+    secrets: inherit
+