Skip to content

Commit 4479ac1

Browse files
shubham-stepsecurityshubham-stepsecurity
committed
feat(mdm): migrate script to go module
1 parent e9e5cee commit 4479ac1

47 files changed

Lines changed: 6235 additions & 102 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/go.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: Go
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
lint:
14+
name: Lint
15+
runs-on: macos-latest
16+
steps:
17+
- uses: actions/checkout@v4
18+
- uses: actions/setup-go@v5
19+
with:
20+
go-version-file: go.mod
21+
- uses: golangci/golangci-lint-action@v6
22+
with:
23+
version: latest
24+
25+
test:
26+
name: Test
27+
runs-on: macos-latest
28+
steps:
29+
- uses: actions/checkout@v4
30+
- uses: actions/setup-go@v5
31+
with:
32+
go-version-file: go.mod
33+
- run: make test
34+
35+
smoke:
36+
name: Smoke Tests
37+
runs-on: macos-latest
38+
needs: test
39+
steps:
40+
- uses: actions/checkout@v4
41+
- uses: actions/setup-go@v5
42+
with:
43+
go-version-file: go.mod
44+
- run: make smoke

‎.github/workflows/release.yml‎

Lines changed: 61 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,10 @@ jobs:
99
release:
1010
name: Build, Sign & Release
1111
runs-on: ubuntu-latest
12-
environment: release
1312
permissions:
14-
contents: write # create tag, release, and upload assets
15-
id-token: write # Sigstore OIDC keyless signing
16-
attestations: write # SLSA build provenance
13+
contents: write # create tag, release, and upload assets
14+
id-token: write # OIDC token for cosign keyless signing and build provenance
15+
attestations: write # SLSA build provenance
1716

1817
steps:
1918
- name: Harden the runner (Audit all outbound calls)
@@ -23,13 +22,15 @@ jobs:
2322

2423
- name: Checkout repository
2524
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
25+
with:
26+
fetch-depth: 0
2627

27-
- name: Extract version from script
28+
- name: Extract version from source
2829
id: version
2930
run: |
30-
version=$(grep -m1 '^AGENT_VERSION=' stepsecurity-dev-machine-guard.sh | sed 's/AGENT_VERSION="//;s/"//')
31+
version=$(grep -m1 'Version.*=' internal/buildinfo/version.go | sed 's/.*"\(.*\)".*/\1/')
3132
if [ -z "$version" ]; then
32-
echo "::error::Could not extract AGENT_VERSION from script"
33+
echo "::error::Could not extract Version from internal/buildinfo/version.go"
3334
exit 1
3435
fi
3536
tag="v${version}"
@@ -40,52 +41,74 @@ jobs:
4041
- name: Check tag does not already exist
4142
run: |
4243
if git rev-parse "refs/tags/${{ steps.version.outputs.tag }}" >/dev/null 2>&1; then
43-
echo "::error::Tag ${{ steps.version.outputs.tag }} already exists. Bump AGENT_VERSION in the script before releasing."
44+
echo "::error::Tag ${{ steps.version.outputs.tag }} already exists. Bump Version in internal/buildinfo/version.go before releasing."
4445
exit 1
4546
fi
4647
48+
- name: Create tag
49+
run: |
50+
git config user.name "github-actions[bot]"
51+
git config user.email "github-actions[bot]@users.noreply.github.com"
52+
git tag -a "${{ steps.version.outputs.tag }}" -m "Release ${{ steps.version.outputs.tag }}"
53+
git push origin "${{ steps.version.outputs.tag }}"
54+
55+
- name: Set up Go
56+
uses: actions/setup-go@v5
57+
with:
58+
go-version-file: go.mod
59+
60+
- name: Run GoReleaser
61+
uses: goreleaser/goreleaser-action@v6
62+
with:
63+
distribution: goreleaser
64+
version: latest
65+
args: release --clean
66+
env:
67+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
68+
4769
- name: Install cosign
4870
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
4971

50-
- name: Sign script with Sigstore (keyless)
72+
- name: Sign artifacts with Sigstore (keyless)
5173
run: |
74+
# Sign Go binaries
75+
for bin in dist/stepsecurity-dev-machine-guard_darwin_*/stepsecurity-dev-machine-guard; do
76+
cosign sign-blob "$bin" --bundle "${bin}.bundle" --yes
77+
done
78+
# Sign shell script
5279
cosign sign-blob stepsecurity-dev-machine-guard.sh \
53-
--bundle stepsecurity-dev-machine-guard.sh.bundle \
54-
--yes
55-
56-
- name: Verify signature
57-
run: |
58-
cosign verify-blob stepsecurity-dev-machine-guard.sh \
59-
--bundle stepsecurity-dev-machine-guard.sh.bundle \
60-
--certificate-identity-regexp "github.com/step-security/dev-machine-guard" \
61-
--certificate-oidc-issuer "https://token.actions.githubusercontent.com"
80+
--bundle stepsecurity-dev-machine-guard.sh.bundle --yes
6281
6382
- name: Generate checksums
6483
run: |
65-
sha256sum stepsecurity-dev-machine-guard.sh > checksums.txt
66-
sha256sum stepsecurity-dev-machine-guard.sh.bundle >> checksums.txt
67-
echo "Checksums:"
68-
cat checksums.txt
84+
cd dist
85+
sha256sum stepsecurity-dev-machine-guard_darwin_*/stepsecurity-dev-machine-guard >> stepsecurity-dev-machine-guard_${{ steps.version.outputs.version }}_SHA256SUMS
86+
cd ..
87+
sha256sum stepsecurity-dev-machine-guard.sh >> dist/stepsecurity-dev-machine-guard_${{ steps.version.outputs.version }}_SHA256SUMS
6988
70-
- name: Create tag
89+
- name: Upload signature bundles and checksums to release
90+
env:
91+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
7192
run: |
72-
git config user.name "github-actions[bot]"
73-
git config user.email "github-actions[bot]@users.noreply.github.com"
74-
git tag -a "${{ steps.version.outputs.tag }}" -m "Release ${{ steps.version.outputs.tag }}"
75-
git push origin "${{ steps.version.outputs.tag }}"
93+
gh release upload "${{ steps.version.outputs.tag }}" \
94+
dist/stepsecurity-dev-machine-guard_darwin_*/stepsecurity-dev-machine-guard.bundle \
95+
stepsecurity-dev-machine-guard.sh.bundle \
96+
dist/stepsecurity-dev-machine-guard_${{ steps.version.outputs.version }}_SHA256SUMS \
97+
--clobber
7698
77-
- name: Create GitHub Release
78-
uses: step-security/action-gh-release@d45511d7589f080cf54961ff056b9705a74fd160 # v2.5.0
79-
with:
80-
tag_name: ${{ steps.version.outputs.tag }}
81-
name: ${{ steps.version.outputs.tag }}
82-
generate_release_notes: true
83-
files: |
84-
stepsecurity-dev-machine-guard.sh
85-
stepsecurity-dev-machine-guard.sh.bundle
86-
checksums.txt
99+
- name: Mark release as immutable (not a draft, not a prerelease)
100+
env:
101+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
102+
run: |
103+
gh release edit "${{ steps.version.outputs.tag }}" \
104+
--draft=false \
105+
--prerelease=false \
106+
--latest
87107
88108
- name: Attest build provenance
89109
uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
90110
with:
91-
subject-path: stepsecurity-dev-machine-guard.sh
111+
subject-path: |
112+
dist/stepsecurity-dev-machine-guard_darwin_amd64_v1/stepsecurity-dev-machine-guard
113+
dist/stepsecurity-dev-machine-guard_darwin_arm64_v1/stepsecurity-dev-machine-guard
114+
stepsecurity-dev-machine-guard.sh

‎.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,9 @@
1717
!docs/**/*.html
1818
!images/**/*.html
1919

20+
# Go build artifacts
21+
/stepsecurity-dev-machine-guard
22+
dist/
23+
2024
# Temporary files
2125
todo-remove/

‎.goreleaser.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
version: 2
2+
project_name: stepsecurity-dev-machine-guard
3+
4+
builds:
5+
- id: stepsecurity-dev-machine-guard
6+
main: ./cmd/stepsecurity-dev-machine-guard
7+
binary: stepsecurity-dev-machine-guard
8+
goos:
9+
- darwin
10+
goarch:
11+
- amd64
12+
- arm64
13+
mod_timestamp: "{{ .CommitTimestamp }}"
14+
flags:
15+
- -trimpath
16+
ldflags:
17+
- -s -w
18+
- -X github.com/step-security/dev-machine-guard/internal/buildinfo.GitCommit={{.FullCommit}}
19+
- -X github.com/step-security/dev-machine-guard/internal/buildinfo.ReleaseTag={{.Tag}}
20+
- -X github.com/step-security/dev-machine-guard/internal/buildinfo.ReleaseBranch={{.Branch}}
21+
env:
22+
- CGO_ENABLED=0
23+
24+
archives:
25+
- format: binary
26+
name_template: "{{ .Binary }}_{{ .Os }}_{{ .Arch }}"
27+
28+
checksum:
29+
name_template: "{{ .ProjectName }}_{{ .Version }}_SHA256SUMS"
30+
algorithm: sha256
31+
32+
release:
33+
extra_files:
34+
- glob: stepsecurity-dev-machine-guard.sh

‎Makefile‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
BINARY := stepsecurity-dev-machine-guard
2+
MODULE := github.com/step-security/dev-machine-guard
3+
VERSION := $(shell grep -m1 'Version' internal/buildinfo/version.go | sed 's/.*"//;s/".*//')
4+
COMMIT := $(shell git rev-parse --short HEAD 2>/dev/null || echo "unknown")
5+
BRANCH := $(shell git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "unknown")
6+
TAG := $(shell git describe --tags --exact-match 2>/dev/null || echo "dev")
7+
LDFLAGS := -s -w \
8+
-X $(MODULE)/internal/buildinfo.GitCommit=$(COMMIT) \
9+
-X $(MODULE)/internal/buildinfo.ReleaseTag=$(TAG) \
10+
-X $(MODULE)/internal/buildinfo.ReleaseBranch=$(BRANCH)
11+
12+
.PHONY: build test lint clean smoke
13+
14+
build:
15+
go build -trimpath -ldflags "$(LDFLAGS)" -o $(BINARY) ./cmd/stepsecurity-dev-machine-guard
16+
17+
test:
18+
go test ./... -v -race -count=1
19+
20+
lint:
21+
golangci-lint run ./...
22+
23+
clean:
24+
rm -f $(BINARY)
25+
26+
smoke: build
27+
bash tests/test_smoke_go.sh

0 commit comments

Comments
 (0)