ci-build-binaries.yml

name: Build Binaries

permissions:
  contents: read

on:
  workflow_call:
    inputs:
      ref:
        required: true
        description: "GitHub ref to use"
        type: string
      os:
        required: true
        description: "Target OS (i.e.: GOOS)"
        type: string
      arch:
        required: true
        description: "Target Architecture (i.e.: GOARCH)"
        type: string
      build-platform:
        required: false
        default: ubuntu-latest
        description: 'Build platform (i.e.: runs-on) for job'
        type: string
      version:
        required: true
        description: "Version to produce"
        type: string
      version-set:
        required: false
        description: "Set of language versions to use for builds, lints, releases, etc."
        type: string

defaults:
  run:
    shell: bash

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  PULUMI_VERSION: ${{ inputs.version }}

jobs:
  build:
    name: ${{ inputs.os }}-${{ inputs.arch }}
    runs-on: ${{ inputs.build-platform }}

    env:
      PULUMI_VERSION: ${{ inputs.version }}

    permissions:
      id-token: write

    steps:
      - name: "Windows cache workaround"
        # https://github.com/actions/cache/issues/752#issuecomment-1222415717
        # but only modify the path by adding tar.exe
        if: ${{ runner.os == 'Windows' }}
        env:
          TOOL_BIN: ${{ runner.temp }}/tar-bin
        run: |
          set -x
          mkdir -p "${TOOL_BIN}"
          cp "C:/Program Files/Git/usr/bin/tar.exe" "${TOOL_BIN}"
          PATH="${TOOL_BIN}:${PATH}"
          echo "$TOOL_BIN" | tee -a "$GITHUB_PATH"
          command -v tar
          tar --version
      - uses: actions/checkout@v3
        with:
          ref: ${{ inputs.ref }}
      - name: Configure Go Cache Key
        env:
          CACHE_KEY: "${{ fromJson(inputs.version-set).go }}-${{ runner.os }}-${{ runner.arch }}-${{ inputs.os }}-${{ inputs.arch }}"
        run: echo "$CACHE_KEY" > .gocache.tmp
      - uses: actions/setup-go@v3
        with:
          go-version: ${{ fromJson(inputs.version-set).go }}
          cache: true
          cache-dependency-path: |
            pkg/go.sum
            .gocache.tmp
      - name: Setup versioning env vars
        run: |
          ./scripts/versions.sh | tee -a "${GITHUB_ENV}"
      - uses: sigstore/cosign-installer@9becc617647dfa20ae7b1151972e9b3a2c338a2b # v2.8.1
      - name: Install GoReleaser
        uses: goreleaser/goreleaser-action@v3
        with:
          install-only: true
          distribution: goreleaser-pro
      - name: Set up bin dir
        env:
          GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
          GOOS: ${{ inputs.os }}
          GOARCH: ${{ inputs.arch }}
        run: ./scripts/prep-for-goreleaser.sh local
      - name: Show files and permissions
        if: ${{ runner.os != 'macOS'}}
        run: find bin -type f -printf "%M    %p/"\\n
      - name: Show files and permissions
        if: ${{ runner.os == 'macOS'}}
        run: |
          brew install findutils
          gfind bin -type f -printf "%M    %p/"\\n
      - name: Package
        shell: bash
        env:
          GORELEASER_CURRENT_TAG: v${{ inputs.version }}
        run: |
          set -euxo pipefail
          # Spurious, this command requires piping via stdin
          # shellcheck disable=SC2002
          cat .goreleaser.yml \
            | go run github.com/t0yv0/goreleaser-filter@v0.3.0 -goos ${{ inputs.os }} -goarch ${{ inputs.arch }} \
            | goreleaser release -f - -p 5 --skip-validate --rm-dist --snapshot
      - uses: actions/upload-artifact@v2
        with:
          name: artifacts-cli-${{ inputs.os }}-${{ inputs.arch }}
          retention-days: 1
          path: |
            goreleaser/*.tar.gz
            goreleaser/*.sig
            goreleaser/*.zip