diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml deleted file mode 100644 index b480117f..00000000 --- a/.github/workflows/release.yml +++ /dev/null @@ -1,64 +0,0 @@ -# This GitHub action can publish assets for release when a tag is created. -# Currently its setup to run on any tag that matches the pattern "v*" (ie. v0.1.0). -# -# This uses an action (paultyng/ghaction-import-gpg) that assumes you set your -# private key in the `GPG_PRIVATE_KEY` secret and passphrase in the `PASSPHRASE` -# secret. If you would rather own your own GPG handling, please fork this action -# or use an alternative one for key handling. -# -# You will need to pass the `--batch` flag to `gpg` in your signing step -# in `goreleaser` to indicate this is being used in a non-interactive mode. -# -name: release -on: - push: - tags: - - "v*" -jobs: - changelog-entry: - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v2 - - name: Get version from tag - id: tag_name - run: | - echo ::set-output name=current_version::${GITHUB_REF#refs/tags/v} - shell: bash - - name: Get Changelog Entry - id: changelog_reader - uses: mindsers/changelog-reader-action@v1 - with: - version: ${{ steps.tag_name.outputs.current_version }} - path: ./CHANGELOG.md - outputs: - entry: ${{ steps.changelog_reader.outputs.log_entry }} - - goreleaser: - runs-on: ubuntu-latest - needs: changelog-entry - steps: - - name: Checkout - uses: actions/checkout@v2 - - name: Unshallow - run: git fetch --prune --unshallow - - name: Set up Go - uses: actions/setup-go@v2 - with: - go-version: 1.18 - - name: Import GPG key - id: import_gpg - uses: paultyng/ghaction-import-gpg@v2.1.0 - env: - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - PASSPHRASE: ${{ secrets.PASSPHRASE }} - - name: Write entry to tmp file - run: echo "${{ needs.changelog-entry.outputs.entry }}" >> ../entry.tmp - - name: Run GoReleaser - uses: goreleaser/goreleaser-action@v2 - with: - version: latest - args: release --rm-dist --release-notes ../entry.tmp - env: - GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }} - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.goreleaser.yml b/.goreleaser.yml index c7439e2c..a141da2a 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -1,5 +1,10 @@ # Visit https://goreleaser.com for documentation on how to customize this # behavior. +# TODO: Figure out why this won't grab the correct dir off env +# dist: {{ .Env.LD_RELEASE_ARTIFACTS_DIR }} // fails with unmarshal errors: cannot unmarshal !!map into string +# dist: "{{ .Env.LD_RELEASE_ARTIFACTS_DIR }}" // Doesn't replace the variable with actual value +# Below is the default that project-releaser sets - we can probably leave this hardcoded for now as it won't change +dist: /tmp/project-releaser/artifacts before: hooks: # this is just an example and not a requirement for provider building/publishing @@ -48,7 +53,7 @@ signs: - "--detach-sign" - "${artifact}" release: - # Visit your project's GitHub Releases page to publish this release. - draft: true + # Actually creating the release is handled by project-releaser + disable: true changelog: skip: true diff --git a/.ldrelease/build.sh b/.ldrelease/build.sh new file mode 100755 index 00000000..ee9bf58e --- /dev/null +++ b/.ldrelease/build.sh @@ -0,0 +1,5 @@ +#!/bin/bash + +set -ue + +echo "Skipping build step as we want to build artifacts after tagging in the publish step" diff --git a/.ldrelease/config.yml b/.ldrelease/config.yml new file mode 100644 index 00000000..b4f2aeb5 --- /dev/null +++ b/.ldrelease/config.yml @@ -0,0 +1,18 @@ +version: 2 + +repo: + public: terraform-provider-launchdarkly + private: terraform-provider-launchdarkly-private + +jobs: + - docker: + image: golang:1.18-buster + copyGitHistory: true + template: + name: go + # We run the tests as part of every merge + skip: + - test + +branches: + - name: main diff --git a/.ldrelease/prepare.sh b/.ldrelease/prepare.sh new file mode 100755 index 00000000..a762356f --- /dev/null +++ b/.ldrelease/prepare.sh @@ -0,0 +1,19 @@ +#!/bin/bash + +set -ue +# Prep for getting goreleaser +echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | tee /etc/apt/sources.list.d/goreleaser.list +apt-get update +# Get goreleaser and gnupg +apt-get install -y --no-install-recommends \ + goreleaser \ + gnupg \ +; \ + +# Get GPG Key +echo -e "$(cat "${LD_RELEASE_SECRETS_DIR}/gpg_private_key")" | gpg --import --batch --no-tty +echo "hello world" > temp.txt +gpg --detach-sig --yes -v --output=/dev/null --pinentry-mode loopback --passphrase "$(cat "${LD_RELEASE_SECRETS_DIR}/gpg_passphrase")" temp.txt +rm temp.txt +# Set it to env +export GPG_FINGERPRINT=$(gpg --with-colons --list-keys | awk -F: '/^pub/ { print $5 }') diff --git a/.ldrelease/publish-dry-run.sh b/.ldrelease/publish-dry-run.sh new file mode 100755 index 00000000..4cdf9bc8 --- /dev/null +++ b/.ldrelease/publish-dry-run.sh @@ -0,0 +1,15 @@ +#!/bin/bash + +set -ue + +# Run goreleaser +# We can't run in the build step, as project-releaser only tags the commit after the build step finishes and goreleaser pulls the tag off the most recent commit +GPG_FINGERPRINT=$(gpg --with-colons --list-keys | awk -F: '/^pub/ { print $5 }') GITHUB_TOKEN="$(cat "${LD_RELEASE_SECRETS_DIR}/github_token")" LD_RELEASE_ARTIFACTS_DIR="${LD_RELEASE_ARTIFACTS_DIR}" goreleaser release --clean --snapshot + +# Remove extra files that we don't want in our release +rm /tmp/project-releaser/artifacts/artifacts.json +rm /tmp/project-releaser/artifacts/metadata.json +rm /tmp/project-releaser/artifacts/config.yaml +# Remove the binaries themselves as goreleaser puts them in subfolders +# We only want to keep the .zip files to release +rm -rf /tmp/project-releaser/artifacts/*/ diff --git a/.ldrelease/publish.sh b/.ldrelease/publish.sh new file mode 100755 index 00000000..96295e32 --- /dev/null +++ b/.ldrelease/publish.sh @@ -0,0 +1,15 @@ +#!/bin/bash + +set -ue + +# Run goreleaser +# We can't run in the build step, as project-releaser only tags the commit after the build step finishes and goreleaser pulls the tag off the most recent commit +GPG_FINGERPRINT=$(gpg --with-colons --list-keys | awk -F: '/^pub/ { print $5 }') GITHUB_TOKEN="$(cat "${LD_RELEASE_SECRETS_DIR}/github_token")" goreleaser release --clean --release-notes ../entry.tmp + +# Remove extra files that we don't want in our release +rm /tmp/project-releaser/artifacts/artifacts.json +rm /tmp/project-releaser/artifacts/metadata.json +rm /tmp/project-releaser/artifacts/config.yaml +# Remove the binaries themselves as goreleaser puts them in subfolders +# We only want to keep the .zip files to release +rm -rf /tmp/project-releaser/artifacts/*/ diff --git a/.ldrelease/secrets.properties b/.ldrelease/secrets.properties new file mode 100644 index 00000000..207ac346 --- /dev/null +++ b/.ldrelease/secrets.properties @@ -0,0 +1,4 @@ +gpg_private_key=blob:/terraform-provider/private.pgp +gpg_passphrase=param:/production/common/releasing/terraform-provider/gpg-passphrase +# This token is the default config token for the releaser, set in it's releaser.conf +github_token=param:/staging/common/services/github/releaser_access_token