Skip to content

Commit 07e6010

Browse files
james-nesbittjames-nesbitt
committed
chore: move signing to a reusable workflow and call it from PR
Signed-off-by: James Nesbitt <jnesbitt@mirantis.com>
1 parent 2d1a59b commit 07e6010

7 files changed

Lines changed: 193 additions & 185 deletions

File tree

‎.github/workflows/build-and-sign.yml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
# Cross-compile selected platforms, then DigiCert-sign artifacts. Add triggers under `on:` as needed.
2+
# Fork PRs are skipped (no secrets). Requires SM_* repository secrets and SM_* vars for DigiCert.
3+
4+
name: Build and sign (DigiCert)
5+
6+
permissions:
7+
contents: read
8+
actions: write
9+
10+
on:
11+
pull_request:
12+
branches: [main]
13+
14+
env:
15+
# Unique per run; safe for PR, manual runs, and future triggers.
16+
SIGNING_ARTIFACT_NAME: launchpad-signing-${{ github.run_id }}
17+
18+
jobs:
19+
build-for-signing:
20+
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
21+
name: Build binaries for signing
22+
runs-on: ubuntu-latest
23+
steps:
24+
- uses: actions/checkout@v6
25+
- uses: actions/setup-go@v6
26+
with:
27+
go-version-file: go.mod
28+
- name: Build binaries
29+
shell: bash
30+
run: |
31+
set -euo pipefail
32+
mkdir -p dist
33+
read -r -a platforms <<< "windows/amd64 darwin/amd64"
34+
for platform in "${platforms[@]}"; do
35+
GOOS=${platform%/*}
36+
GOARCH=${platform#*/}
37+
output_name="dist/launchpad_${GOOS}_${GOARCH}"
38+
if [ "$GOOS" = "windows" ]; then
39+
output_name+=".exe"
40+
fi
41+
echo "Building $output_name"
42+
GOOS=$GOOS GOARCH=$GOARCH go build -o "$output_name" ./main.go
43+
done
44+
- uses: actions/upload-artifact@v4
45+
with:
46+
name: ${{ env.SIGNING_ARTIFACT_NAME }}
47+
path: dist/
48+
49+
sign-binaries:
50+
needs: build-for-signing
51+
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
52+
name: Sign binaries
53+
runs-on: ubuntu-latest
54+
steps:
55+
- uses: actions/checkout@v6
56+
- uses: actions/download-artifact@v4
57+
with:
58+
name: ${{ env.SIGNING_ARTIFACT_NAME }}
59+
path: dist/
60+
61+
- name: Decode SM client certificate
62+
run: |
63+
SM_CLIENT_CERT_FILE="${{ runner.temp }}/sm_client_cert.p12"
64+
echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > "$SM_CLIENT_CERT_FILE"
65+
echo "SM_CLIENT_CERT_FILE=$SM_CLIENT_CERT_FILE" >> "$GITHUB_ENV"
66+
shell: bash
67+
68+
- name: DigiCert Software Trust Manager
69+
uses: digicert/code-signing-software-trust-action@v1
70+
with:
71+
simple-signing-mode: true
72+
keypair-alias: ${{ vars.SM_KEYPAIR_ALIAS }}
73+
input: dist/
74+
env:
75+
SM_HOST: ${{ vars.SM_HOST }}
76+
SM_API_KEY: ${{ secrets.SM_API_KEY }}
77+
SM_CLIENT_CERT_FILE: ${{ env.SM_CLIENT_CERT_FILE }}
78+
SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
79+
80+
- uses: actions/upload-artifact@v4
81+
with:
82+
name: launchpad-binaries-signed
83+
path: dist/

‎.github/workflows/build.yml‎

Lines changed: 22 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,30 @@
1-
# Build and test workflow for Launchpad
2-
# Triggered on PRs and pushes to main.
1+
# Build and test on push to main (unsigned); DigiCert build+sign is in build-and-sign.yml.
32

43
name: Build and Test
4+
55
permissions:
66
contents: read
7-
packages: write # Required for uploading artifacts
7+
actions: write # upload-artifact
88

99
on:
1010
push:
11-
branches: [ main ]
11+
branches: [main]
1212

1313
jobs:
1414
build:
15-
name: Build Binaries
15+
name: Build binaries
1616
runs-on: ubuntu-latest
1717
steps:
18-
- name: Checkout code
19-
uses: actions/checkout@v4
20-
21-
- name: Set up Go
22-
uses: actions/setup-go@v5
18+
- uses: actions/checkout@v6
19+
- uses: actions/setup-go@v6
2320
with:
24-
go-version: "1.25"
25-
21+
go-version-file: go.mod
2622
- name: Build binaries
23+
shell: bash
2724
run: |
25+
set -euo pipefail
2826
mkdir -p dist
29-
platforms=("linux/amd64" "linux/arm64" "windows/amd64" "windows/arm64" "darwin/amd64" "darwin/arm64")
27+
platforms=(linux/amd64 linux/arm64 windows/amd64 windows/arm64 darwin/amd64 darwin/arm64)
3028
for platform in "${platforms[@]}"; do
3129
GOOS=${platform%/*}
3230
GOARCH=${platform#*/}
@@ -37,28 +35,23 @@ jobs:
3735
echo "Building $output_name"
3836
GOOS=$GOOS GOARCH=$GOARCH go build -o "$output_name" ./main.go
3937
done
40-
41-
- name: Upload artifacts
42-
uses: actions/upload-artifact@v4
38+
- uses: actions/upload-artifact@v4
4339
with:
4440
name: launchpad-binaries
4541
path: dist/
4642

4743
test:
48-
name: Run Tests
44+
name: Tests
4945
runs-on: ubuntu-latest
5046
needs: build
5147
steps:
52-
- name: Checkout code
53-
uses: actions/checkout@v4
54-
55-
- name: Set up Go
56-
uses: actions/setup-go@v5
48+
- uses: actions/checkout@v6
49+
- uses: actions/setup-go@v6
5750
with:
58-
go-version: "1.22"
59-
60-
- name: Run unit tests
61-
run: go test -v ./...
62-
63-
- name: Run integration tests
64-
run: go test -v -tags=integration ./test/integration
51+
go-version-file: go.mod
52+
- name: Unit tests
53+
run: make unit-test
54+
env:
55+
TEST_FLAGS: -short
56+
- name: Integration tests
57+
run: make integration-test

‎.github/workflows/go.yml‎

Lines changed: 0 additions & 29 deletions
This file was deleted.

‎.github/workflows/pr.yml‎

Lines changed: 44 additions & 102 deletions
Original file line numberDiff line numberDiff line change
@@ -1,129 +1,71 @@
1-
# PR validation workflow for Launchpad
2-
# Triggered on PRs to main branch.
1+
# PR validation for Launchpad (lint, tests, security). Build+sign is in build-and-sign.yml.
32

43
name: PR Validation
54

65
permissions:
76
contents: read
8-
pull-requests: write # Required for PR comments or labels
97

108
on:
119
pull_request:
12-
branches: [ main ]
10+
branches: [main]
1311

1412
jobs:
15-
# lint:
16-
# name: Lint Code
17-
# runs-on: ubuntu-latest
18-
# steps:
19-
# - name: Checkout code
20-
# uses: actions/checkout@v4
21-
#
22-
# - name: Set up Go
23-
# uses: actions/setup-go@v5
24-
# with:
25-
# go-version: "1.25"
26-
#
27-
# - name: golangci-lint
28-
# uses: golangci/golangci-lint-action@v6
29-
# with:
30-
# version: latest
31-
# install-mode: goinstall
32-
# args: --timeout=5m
33-
34-
unit-test:
35-
name: Unit Tests
13+
lint:
14+
name: Lint
3615
runs-on: ubuntu-latest
3716
steps:
38-
- name: Checkout code
39-
uses: actions/checkout@v4
40-
41-
- name: Set up Go
42-
uses: actions/setup-go@v5
17+
- uses: actions/checkout@v6
18+
- uses: actions/setup-go@v6
4319
with:
44-
go-version: "1.25"
45-
46-
- name: Run unit tests
47-
run: make unit-test
20+
go-version-file: go.mod
21+
- name: go mod tidy check
22+
run: go mod tidy -v && git diff --exit-code
23+
- name: golangci-lint
24+
uses: golangci/golangci-lint-action@v9.2.0
25+
with:
26+
version: latest
27+
skip-cache: true
28+
only-new-issues: false
29+
args: --verbose
4830

49-
integration-test:
50-
name: Integration Tests
51-
runs-on: ubuntu-latest
31+
unit-test:
32+
name: Unit Tests (${{ matrix.os }})
33+
strategy:
34+
fail-fast: false
35+
matrix:
36+
os: [ubuntu-latest, macos-latest, windows-latest]
37+
runs-on: ${{ matrix.os }}
5238
steps:
53-
- name: Checkout code
54-
uses: actions/checkout@v4
55-
56-
- name: Set up Go
57-
uses: actions/setup-go@v5
39+
- uses: actions/checkout@v6
40+
- uses: actions/setup-go@v6
5841
with:
59-
go-version: "1.25"
60-
61-
- name: Run integration tests
62-
run: make integration-test
63-
64-
42+
go-version-file: go.mod
43+
- name: Unit tests
44+
run: make unit-test
45+
env:
46+
TEST_FLAGS: -short
6547

6648
security-scan:
67-
name: Security Scan
49+
name: Security scan
6850
runs-on: ubuntu-latest
6951
steps:
70-
- name: Checkout code
71-
uses: actions/checkout@v4
72-
73-
- name: Set up Go
74-
uses: actions/setup-go@v5
52+
- uses: actions/checkout@v6
53+
- uses: actions/setup-go@v6
7554
with:
76-
go-version: "1.25"
77-
78-
- name: Install govulncheck
55+
go-version-file: go.mod
56+
- name: govulncheck
7957
run: go install golang.org/x/vuln/cmd/govulncheck@latest
80-
8158
- name: Run security scan
82-
run: govulncheck ./...
59+
run: make security-scan
8360

84-
# TODO: REMOVE THIS JOB BEFORE MERGING - IT IS FOR TESTING SIGNING ONLY
85-
test-signing:
86-
name: Test DigiCert Signing
61+
integration-test:
62+
name: Integration Tests
63+
needs: security-scan
8764
runs-on: ubuntu-latest
8865
steps:
89-
- name: Checkout code
90-
uses: actions/checkout@v4
91-
92-
- name: Set up Go
93-
uses: actions/setup-go@v5
66+
- uses: actions/checkout@v6
67+
- uses: actions/setup-go@v6
9468
with:
95-
go-version: "1.25"
96-
97-
- name: Build binaries for signing test
98-
run: |
99-
mkdir -p dist
100-
platforms=("windows/amd64" "darwin/amd64")
101-
for platform in "${platforms[@]}"; do
102-
GOOS=${platform%/*}
103-
GOARCH=${platform#*/}
104-
output_name="dist/launchpad_${GOOS}_${GOARCH}"
105-
if [ "$GOOS" = "windows" ]; then
106-
output_name+=".exe"
107-
fi
108-
echo "Building $output_name"
109-
GOOS=$GOOS GOARCH=$GOARCH go build -o "$output_name" ./main.go
110-
done
111-
112-
- name: Setup SM_CLIENT_CERT_FILE from base64 secret data
113-
run: |
114-
SM_CLIENT_CERT_FILE="${{ runner.temp }}/sm_client_cert.p12"
115-
echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > "$SM_CLIENT_CERT_FILE"
116-
echo "SM_CLIENT_CERT_FILE=$SM_CLIENT_CERT_FILE" >> $GITHUB_ENV
117-
shell: bash
118-
119-
- name: Setup Software Trust Manager and Sign Binaries
120-
uses: digicert/code-signing-software-trust-action@v1
121-
with:
122-
simple-signing-mode: true
123-
keypair-alias: ${{ vars.SM_KEYPAIR_ALIAS }}
124-
input: dist/
125-
env:
126-
SM_HOST: ${{ vars.SM_HOST }}
127-
SM_API_KEY: ${{ secrets.SM_API_KEY }}
128-
SM_CLIENT_CERT_FILE: ${{ env.SM_CLIENT_CERT_FILE }}
129-
SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
69+
go-version-file: go.mod
70+
- name: Integration tests
71+
run: make integration-test

0 commit comments

Comments
 (0)