Skip to content

Commit 5d0a9c3

Browse files
rdimitrovshibumitrishankatdatadog
authored
Add automatic releases using goreleaser (#234)
* chore: add goreleaser + cosign releases * feat: keyless realeases with goreleaser and cosign This commit enables keyless signatures via the Github Actions workload identity. The pipeline will run on a new tag and will generate a compiled cli and server version of TUF and a signed source tarball. The keys are ephemeral and valid for 30min and strictly coupled to the workload identity of the Github Actions workflow. Transparency logs will be automatically uploaded to the public rekor instance * chore: try a basic config of gorelease * chore: split test and release phases into reusable workflows Adds also github style changelog in which it tags people who contributed to the last release. It also groups breaking commits into a separate group that is on top of the changelog for better visibility. Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> * chore: bump goreleaser to v1.6.3 Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> * chore: use golangci-lint instead of go fmt, staticcheck, etc. Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> * chore: use github-action for goveralls instead of the legacy GOPATH way Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> * chore: add golangci.yml config enabling several other linters Fix also some of the linter errors so it doesn't fail. Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> * chore: use the flags property of goreleaser instead of env vars while building Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> * chore: set goreleaser to automatically mark releases with a suffix as prereleases Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> * chore: partially revert "Add golangci.yml config enabling several other linters" This reverts commit a72cf40 which also included fixes for some of the issues raised by golangci-lint. They will be addressed in a separate PR. Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> * chore: add commitsar action to enforce the use of conventional commits For reference - https://www.conventionalcommits.org Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> * fix: use keyword specificed in the conventional commit spec for breaking changes Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> * chore: configure dependabot to monitor github-actions too Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> * chore: pin github-actions dependencies by digest Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> * chore: pin and configure dependabot to monitor Python test dependencies Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> * chore: bump goreleaser version to v1.7.0 Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> * chore: run tests using Go version 1.18.x Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> * chore: checkout code first in order to fix CI failure Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> * chore: run CI against all Go versions newer than the minimal one set in go.mod Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> * chore: download python dependencies from requirements-test.txt Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> * chore: use the minimal Go version set in go.mod for releases Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> * chore: pin the go-version-action using a digest Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> * chore: configure dependabot to use chore commit prefix for gomod updates Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> * chore: revert the use of dedicated requirements.txt file path for github actions Signed-off-by: Radoslav Dimitrov <dimitrovr@vmware.com> Co-authored-by: Christian Rebischke <chris@shibumi.dev> Co-authored-by: Trishank Karthik Kuppusamy <trishank.kuppusamy@datadoghq.com>
1 parent 2b4cbfe commit 5d0a9c3

File tree

9 files changed

+260
-46
lines changed

9 files changed

+260
-46
lines changed

‎.github/dependabot.yml‎

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,32 @@
11
version: 2
22
updates:
3-
- package-ecosystem: "gomod"
4-
directory: "/"
5-
schedule:
6-
interval: "daily"
7-
open-pull-requests-limit: 10
3+
# Monitor Go dependencies
4+
- package-ecosystem: "gomod"
5+
directory: "/"
6+
schedule:
7+
interval: "daily"
8+
time: "10:00"
9+
commit-message:
10+
prefix: "chore"
11+
include: "scope"
12+
open-pull-requests-limit: 10
13+
# Monitor Github Actions
14+
- package-ecosystem: "github-actions"
15+
directory: "/"
16+
schedule:
17+
interval: "daily"
18+
time: "10:00"
19+
commit-message:
20+
prefix: "chore"
21+
include: "scope"
22+
open-pull-requests-limit: 10
23+
# Monitor Python test dependencies
24+
- package-ecosystem: "pip"
25+
directory: "/"
26+
schedule:
27+
interval: "daily"
28+
time: "10:00"
29+
commit-message:
30+
prefix: "chore"
31+
include: "scope"
32+
open-pull-requests-limit: 10

‎.github/workflows/build.yml‎

Lines changed: 0 additions & 41 deletions
This file was deleted.

‎.github/workflows/ci.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
on:
2+
pull_request:
3+
push:
4+
branches:
5+
- "master"
6+
tags:
7+
- "v*"
8+
name: CI
9+
jobs:
10+
tests:
11+
uses: ./.github/workflows/tests.yml
12+
tuf:
13+
needs: tests
14+
if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
15+
uses: ./.github/workflows/release.yml
16+
with:
17+
cli-name: tuf
18+
tuf-client:
19+
needs: tests
20+
if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
21+
uses: ./.github/workflows/release.yml
22+
with:
23+
cli-name: tuf-client

‎.github/workflows/release.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
on:
2+
workflow_call:
3+
inputs:
4+
cli-name:
5+
required: true
6+
type: string
7+
name: Release
8+
jobs:
9+
release:
10+
permissions:
11+
id-token: write
12+
contents: write
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout
16+
uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
17+
with:
18+
fetch-depth: 0
19+
- name: Get Go version
20+
uses: arnested/go-version-action@d44f8fbecf1ac5ea61d81603e99dfec9833f592f
21+
id: go-version
22+
env:
23+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
24+
- name: Set up Go
25+
uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492
26+
with:
27+
go-version: ${{ steps.go-version.outputs.minimal }}
28+
- name: Run GoReleaser
29+
uses: goreleaser/goreleaser-action@b953231f81b8dfd023c58e0854a721e35037f28b
30+
with:
31+
distribution: goreleaser
32+
version: "v1.7.0"
33+
args: release --config ./.goreleaser/${{ inputs.cli-name }}.yml --rm-dist
34+
env:
35+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/tests.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
on:
2+
workflow_call:
3+
name: Tests
4+
jobs:
5+
get-go-versions:
6+
name: Collect available Go versions
7+
runs-on: ubuntu-latest
8+
outputs:
9+
matrix: ${{ steps.versions.outputs.matrix }}
10+
steps:
11+
- uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
12+
- uses: arnested/go-version-action@d44f8fbecf1ac5ea61d81603e99dfec9833f592f
13+
id: versions
14+
env:
15+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
16+
17+
run:
18+
strategy:
19+
matrix:
20+
os: [ubuntu-latest, macos-latest]
21+
go-version: ${{ fromJSON(needs.get-go-versions.outputs.matrix) }}
22+
runs-on: ${{ matrix.os }}
23+
needs: get-go-versions
24+
steps:
25+
- name: Checkout code
26+
uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
27+
28+
- name: Setup - Go ${{ matrix.go-version }}
29+
uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492
30+
with:
31+
go-version: ${{ matrix.go-version }}
32+
33+
- name: Setup - Python
34+
uses: actions/setup-python@7f80679172b057fc5e90d70d197929d454754a5a
35+
with:
36+
python-version: 3.6
37+
cache: "pip"
38+
cache-dependency-path: "requirements-test.txt"
39+
40+
- name: Install Python dependencies
41+
run: |
42+
python3 -m pip install --upgrade pip
43+
python3 -m pip install --upgrade -r requirements-test.txt
44+
45+
- name: Run tests
46+
run: go test -race -covermode atomic -coverprofile='profile.cov' ./...
47+
48+
- name: Send coverage
49+
uses: shogo82148/actions-goveralls@31ee804b8576ae49f6dc3caa22591bc5080e7920
50+
with:
51+
path-to-profile: profile.cov
52+
flag-name: Go-${{ matrix.go-version }}
53+
parallel: true
54+
55+
golangci:
56+
strategy:
57+
matrix:
58+
go-version: ${{ fromJSON(needs.get-go-versions.outputs.matrix) }}
59+
os: [ubuntu-latest, macos-latest]
60+
runs-on: ${{ matrix.os }}
61+
needs: get-go-versions
62+
steps:
63+
- uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492
64+
- uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
65+
- name: golangci-lint
66+
uses: golangci/golangci-lint-action@5c56cd6c9dc07901af25baab6f2b0d9f3b7c3018
67+
with:
68+
version: v1.44
69+
70+
conventional-commits-lint-check:
71+
runs-on: "ubuntu-latest"
72+
steps:
73+
- name: Checkout code
74+
uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
75+
with:
76+
fetch-depth: 0
77+
- name: Commitsar Action
78+
uses: aevea/commitsar@159cec82966ca402a09ae3c185524a5256affa22

‎.golangci.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
linters:
2+
disable-all: true
3+
enable:
4+
- staticcheck
5+
- gofmt
6+
- govet
7+
- gosimple
8+
- structcheck
9+
- varcheck
10+
- unused
11+
- typecheck

‎.goreleaser/tuf-client.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
project_name: tuf-client
2+
builds:
3+
- ldflags:
4+
- "-s -w"
5+
- "-extldflags=-zrelro"
6+
- "-extldflags=-znow"
7+
env:
8+
- "CGO_ENABLED=0"
9+
- "GO111MODULE=on"
10+
flags:
11+
- -mod=readonly
12+
- -trimpath
13+
goos:
14+
- linux
15+
- darwin
16+
- windows
17+
goarch:
18+
- amd64
19+
main: ./cmd/tuf-client/
20+
source:
21+
enabled: true
22+
changelog:
23+
use: github
24+
groups:
25+
- title: "Breaking changes"
26+
regexp: "^.*BREAKING CHANGE[(\\w)]*:+.*$"
27+
order: 0
28+
- title: Features
29+
regexp: "^.*feat[(\\w)]*:+.*$"
30+
order: 1
31+
- title: "Bug fixes"
32+
regexp: "^.*fix[(\\w)]*:+.*$"
33+
order: 2
34+
- title: Others
35+
order: 999
36+
release:
37+
# If set to auto, will mark the release as not ready for production
38+
# in case there is an indicator for this in the tag e.g. v1.0.0-rc1
39+
prerelease: auto

‎.goreleaser/tuf.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
project_name: tuf
2+
builds:
3+
- ldflags:
4+
- "-s -w"
5+
- "-extldflags=-zrelro"
6+
- "-extldflags=-znow"
7+
env:
8+
- "CGO_ENABLED=0"
9+
- "GO111MODULE=on"
10+
flags:
11+
- -mod=readonly
12+
- -trimpath
13+
goos:
14+
- linux
15+
- darwin
16+
- windows
17+
goarch:
18+
- amd64
19+
main: ./cmd/tuf/
20+
source:
21+
enabled: true
22+
changelog:
23+
use: github
24+
groups:
25+
- title: "Breaking changes"
26+
regexp: "^.*BREAKING CHANGE[(\\w)]*:+.*$"
27+
order: 0
28+
- title: Features
29+
regexp: "^.*feat[(\\w)]*:+.*$"
30+
order: 1
31+
- title: "Bug fixes"
32+
regexp: "^.*fix[(\\w)]*:+.*$"
33+
order: 2
34+
- title: Others
35+
order: 999
36+
release:
37+
# If set to auto, will mark the release as not ready for production
38+
# in case there is an indicator for this in the tag e.g. v1.0.0-rc1
39+
prerelease: auto

‎requirements-test.txt‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
iso8601==1.0.2
2+
requests==2.27.1
3+
securesystemslib==0.21.0
4+
six==1.16.0
5+
tuf==0.20.0

0 commit comments

Comments
 (0)