boundary/.github/workflows/build.yml

name: build

on:
  - workflow_dispatch
  - push
  - workflow_call

env:
  PKG_NAME: "boundary"

jobs:
  set-product-version:
    runs-on: ubuntu-latest
    outputs:
      product-version: ${{ steps.set-product-version.outputs.product-version }}
      base-product-version: $${{ steps.set-product-version.outputs.base-product-version }}
      prerelease-product-version: ${{ steps.set-product-version.outputs.prerelease-product-version }}
    steps:
      - uses: actions/checkout@v3
      - name: Set Product version
        id: set-product-version
        uses: hashicorp/actions-set-product-version@v1

  product-metadata:
    needs: set-product-version
    runs-on: ubuntu-latest
    outputs:
      product-minor-version: ${{ steps.get-product-minor-version.outputs.product-minor-version }}
      product-edition: ${{ steps.get-product-edition.outputs.product-edition }}
      go-version: ${{ steps.get-go-version.outputs.go-version }}
    steps:
      - uses: actions/checkout@v3
      - name: Determine Go version
        id: get-go-version
        # We use .go-version as our source of truth for current Go
        # version, because "goenv" can react to it automatically.
        run: |
          echo "Building with Go $(cat .go-version)"
          echo "go-version=$(cat .go-version)" >> $GITHUB_OUTPUT          
      - name: Set up Go
        uses: actions/setup-go@v3
        with:
          go-version: "${{ steps.get-go-version.outputs.go-version }}"
      - name: Determine Go cache paths
        id: go-cache-paths
        run: |
          echo "go-build=$(go env GOCACHE)" >> $GITHUB_OUTPUT
          echo "go-mod=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT          
      - name: Set up Go modules cache
        uses: actions/cache@v3
        with:
          path: |
            ${{ steps.go-cache-paths.outputs.go-build }}
            ${{ steps.go-cache-paths.outputs.go-mod }}            
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
                        ${{ runner.os }}-go-
      - name: Determine product edition
        id: get-product-edition
        # Run make edition twice to ensure that extra go output isn't included
        run: |
          make edition
          echo "product-edition=$(make edition)" >> $GITHUB_OUTPUT          
      - name: Determine minor product version
        id: get-product-minor-version
        run: |
          VERSION=${{ needs.set-product-version.outputs.product-version }}
          MINOR_VERSION=$(echo $VERSION | cut -d. -f-2)
          echo "product-minor-version=$MINOR_VERSION" >> $GITHUB_OUTPUT          

  verify-product-metadata:
    needs:
    - set-product-version
    - product-metadata
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout directory'
        uses: actions/checkout@v3
      - run: |
          echo "Product Version - ${{ needs.set-product-version.outputs.product-version }}"
          echo "Product Prerelease - ${{ needs.set-product-version.outputs.prerelease-product-version }}"
          echo "Product Metadata - ${{ needs.product-metadata.outputs.product-edition }}"
          echo "Product Minor Version - ${{ needs.product-metadata.outputs.product-minor-version }}"          

  generate-metadata-file:
    needs: set-product-version
    runs-on: ubuntu-latest
    outputs:
      filepath: ${{ steps.generate-metadata-file.outputs.filepath }}
    steps:
      - name: 'Checkout directory'
        uses: actions/checkout@v3
      - name: Generate metadata file
        id: generate-metadata-file
        uses: hashicorp/actions-generate-metadata@v1
        with:
          version: ${{ needs.set-product-version.outputs.product-version }}
          product: ${{ env.PKG_NAME }}

      - uses: actions/upload-artifact@v3
        with:
          name: metadata.json
          path: ${{ steps.generate-metadata-file.outputs.filepath }}

  build-other:
    needs:
      - product-metadata
      - set-product-version
    runs-on: ubuntu-latest
    strategy:
      matrix:
        goos: [ freebsd, windows, netbsd, openbsd, solaris ]
        goarch: [ "386", "amd64", "arm" ]
        go: [ "${{ needs.product-metadata.outputs.go-version }}" ]
        exclude:
          - goos: solaris
            goarch: 386
          - goos: solaris
            goarch: arm
          - goos: windows
            goarch: arm
      fail-fast: true

    name: Go ${{ matrix.go }} ${{ matrix.goos }} ${{ matrix.goarch }} build
    env:
      GOPRIVATE: "github.com/hashicorp"
      GO111MODULE: on
    steps:
      - uses: actions/checkout@v3
      - name: Set up go
        uses: actions/setup-go@v3
        with:
          go-version: ${{ matrix.go }}
      - name: Determine Go cache paths
        id: go-cache-paths
        run: |
          echo "go-build=$(go env GOCACHE)" >> $GITHUB_OUTPUT
          echo "go-mod=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT          
      - name: Set up Go modules cache
        uses: actions/cache@v3
        with:
          path: |
            ${{ steps.go-cache-paths.outputs.go-build }}
            ${{ steps.go-cache-paths.outputs.go-mod }}            
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}-${{ matrix.goarch }}
          restore-keys: |
                        ${{ runner.os }}-go-
      - name: Set up Git
        run: git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN }}:@github.com".insteadOf "https://github.com"
      - name: Determine SHA
        id: set-sha
        run: echo "sha=$(head -n1 internal/ui/VERSION | cut -d ' ' -f1)" >> $GITHUB_OUTPUT
      - name: Download UI artifact
        uses: dawidd6/action-download-artifact@v2
        with:
          workflow: build-admin-ui.yaml
          commit: ${{ steps.set-sha.outputs.sha }}
          repo: "hashicorp/boundary-ui"
          name: admin-ui-${{ needs.product-metadata.outputs.product-edition }}
          path: internal/ui/.tmp/boundary-ui/ui/admin/dist
      - name: Go Build
        env:
          CGO_ENABLED: "0"
          PRERELEASE_PRODUCT_VERSION: ${{ needs.set-product-version.outputs.prerelease-product-version }}
          METADATA_PRODUCT_VERSION: ${{ needs.product-metadata.outputs.product-edition }}
        uses: hashicorp/actions-go-build@v0.1.9
        with:
          product_name: ${{ env.PKG_NAME }}
          product_version: ${{ needs.set-product-version. outputs.product-version }}
          go_version: ${{ matrix.go }}
          os: ${{ matrix.goos }}
          arch: ${{ matrix.goarch }}
          reproducible: report
          instructions: |-
                        make build
      - uses: actions/upload-artifact@v3
        with:
          name: ${{ env.PKG_NAME }}_${{ needs.set-product-version.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip
          path: out/${{ env.PKG_NAME }}_${{ needs.set-product-version.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip

  build-linux:
    needs:
      - product-metadata
      - set-product-version
    runs-on: ubuntu-latest
    strategy:
      matrix:
        goos: [linux]
        goarch: ["arm", "arm64", "386", "amd64"]
        go: [ "${{ needs.product-metadata.outputs.go-version }}" ]
      fail-fast: true

    name: Go ${{ matrix.go }} ${{ matrix.goos }} ${{ matrix.goarch }} build

    env:
      GOPRIVATE: "github.com/hashicorp"
      GO111MODULE: on

    steps:
      - uses: actions/checkout@v3
      - name: Set up Git
        run: git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN }}:@github.com".insteadOf "https://github.com"
      - name: Set up Go
        uses: actions/setup-go@v3
        with:
          go-version: ${{ matrix.go }}
      - name: Determine Go cache paths
        id: go-cache-paths
        run: |
          echo "go-build=$(go env GOCACHE)" >> $GITHUB_OUTPUT
          echo "go-mod=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT          
      - name: Set up Go modules cache
        uses: actions/cache@v3
        with:
          path: |
            ${{ steps.go-cache-paths.outputs.go-build }}
            ${{ steps.go-cache-paths.outputs.go-mod }}            
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}-${{ matrix.goarch }}
          restore-keys: |
                        ${{ runner.os }}-go-
      - name: Determine SHA
        id: set-sha
        run: echo "sha=$(head -n1 internal/ui/VERSION | cut -d ' ' -f1)" >> $GITHUB_OUTPUT
      - name: Download UI artifact
        uses: dawidd6/action-download-artifact@v2
        with:
          workflow: build-admin-ui.yaml
          commit: ${{ steps.set-sha.outputs.sha }}
          repo: "hashicorp/boundary-ui"
          name: admin-ui-${{ needs.product-metadata.outputs.product-edition }}
          path: internal/ui/.tmp/boundary-ui/ui/admin/dist
      - name: Go Build
        env:
          CGO_ENABLED: "0"
          PRERELEASE_PRODUCT_VERSION: ${{ needs.set-product-version.outputs.prerelease-product-version }}
          METADATA_PRODUCT_VERSION: ${{ needs.product-metadata.outputs.product-edition }}
        uses: hashicorp/actions-go-build@v0.1.9
        with:
          product_name: ${{ env.PKG_NAME }}
          product_version: ${{ needs.set-product-version. outputs.product-version }}
          go_version: ${{ matrix.go }}
          os: ${{ matrix.goos }}
          arch: ${{ matrix.goarch }}
          reproducible: report
          instructions: |-
                        make build
      - uses: actions/upload-artifact@v3
        with:
          name: ${{ env.PKG_NAME }}_${{ needs.set-product-version.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip
          path: out/${{ env.PKG_NAME }}_${{ needs.set-product-version.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip
      - name: Package
        uses: hashicorp/actions-packaging-linux@v1
        with:
          name: ${{ github.event.repository.name }}
          description: "HashiCorp Boundary - Identity-based access management for dynamic infrastructure"
          arch: ${{ matrix.goarch }}
          version: ${{ needs.set-product-version.outputs.product-version }}
          maintainer: "HashiCorp"
          homepage: "https://github.com/hashicorp/boundary"
          license: "MPL-2.0"
          binary: "dist/${{ env.PKG_NAME }}"
          deb_depends: "openssl"
          rpm_depends: "openssl"
          config_dir: ".release/linux/package/"
          preinstall: ".release/linux/preinst"
          postremove: ".release/linux/postrm"
      - name: Add Linux Package names to env
        run: |
          echo "RPM_PACKAGE=$(basename out/*.rpm)" >> $GITHUB_ENV
          echo "DEB_PACKAGE=$(basename out/*.deb)" >> $GITHUB_ENV          
      - name: Upload RPM package
        uses: actions/upload-artifact@v3
        with:
          name: ${{ env.RPM_PACKAGE }}
          path: out/${{ env.RPM_PACKAGE }}
      - name: Upload DEB package
        uses: actions/upload-artifact@v3
        with:
          name: ${{ env.DEB_PACKAGE }}
          path: out/${{ env.DEB_PACKAGE }}

  build-darwin:
    needs:
      - product-metadata
      - set-product-version
    runs-on: macos-latest
    strategy:
      matrix:
        goos: [ darwin ]
        goarch: [ "amd64", "arm64" ]
        go: [ "${{ needs.product-metadata.outputs.go-version }}" ]
      fail-fast: true
    name: Go ${{ matrix.go }} ${{ matrix.goos }} ${{ matrix.goarch }} build

    env:
      GOPRIVATE: "github.com/hashicorp"
      GO111MODULE: on

    steps:
      - uses: actions/checkout@v3
      - name: Set up go
        uses: actions/setup-go@v3
        with:
          go-version: ${{ matrix.go }}
      - name: Determine Go cache paths
        id: go-cache-paths
        run: |
          echo "go-build=$(go env GOCACHE)" >> $GITHUB_OUTPUT
          echo "go-mod=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT          
      - name: Set up Go modules cache
        uses: actions/cache@v3
        with:
          path: |
            ${{ steps.go-cache-paths.outputs.go-build }}
            ${{ steps.go-cache-paths.outputs.go-mod }}            
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
                        ${{ runner.os }}-go-
      - name: Determine SHA
        id: set-sha
        run: echo "sha=$(head -n1 internal/ui/VERSION | cut -d ' ' -f1)" >> $GITHUB_OUTPUT
      - name: Download UI artifact
        uses: dawidd6/action-download-artifact@v2
        with:
          workflow: build-admin-ui.yaml
          commit: ${{ steps.set-sha.outputs.sha }}
          repo: "hashicorp/boundary-ui"
          name: admin-ui-${{ needs.product-metadata.outputs.product-edition }}
          path: internal/ui/.tmp/boundary-ui/ui/admin/dist
      - name: Go Build
        env:
          CGO_ENABLED: "0"
          PRERELEASE_PRODUCT_VERSION: ${{ needs.set-product-version.outputs.prerelease-product-version }}
          METADATA_PRODUCT_VERSION: ${{ needs.product-metadata.outputs.product-edition }}
        uses: hashicorp/actions-go-build@v0.1.9
        with:
          product_name: ${{ env.PKG_NAME }}
          product_version: ${{ needs.set-product-version. outputs.product-version }}
          go_version: ${{ matrix.go }}
          os: ${{ matrix.goos }}
          arch: ${{ matrix.goarch }}
          reproducible: report
          instructions: |-
                        make build
      - uses: actions/upload-artifact@v3
        with:
          name: ${{ env.PKG_NAME }}_${{ needs.set-product-version.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip
          path: out/${{ env.PKG_NAME }}_${{ needs.set-product-version.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip

  build-docker:
    name: Docker ${{ matrix.arch }} build
    needs:
      - product-metadata
      - set-product-version
      - build-linux
    runs-on: ubuntu-latest
    strategy:
      matrix:
        arch: ["arm", "arm64", "386", "amd64"]
    env:
      repo: ${{ github.event.repository.name }}
      version: ${{ needs.set-product-version.outputs.product-version }}
      minor-version: ${{ needs.product-metadata.outputs.product-minor-version }}
    steps:
      - uses: actions/checkout@v3
      - name: Docker Build (Action)
        uses: hashicorp/actions-docker-build@v1
        with:
          version: ${{ env.version }}
          target: default
          arch: ${{ matrix.arch }}
          tags: |
            docker.io/hashicorp/${{ env.repo }}:${{ env.version }}
            public.ecr.aws/hashicorp/${{ env.repo }}:${{ env.version }}            
          # Per-commit dev images follow the naming convention MAJOR.MINOR-dev
          # And MAJOR.MINOR-dev-$COMMITSHA
          dev_tags: |
            docker.io/hashicorppreview/${{ env.repo }}:${{ env.minor-version }}-dev
            docker.io/hashicorppreview/${{ env.repo }}:${{ env.minor-version }}-dev-${{ github.sha }}            

  enos:
    name: Enos
    # Only run the Enos workflow on pull requests that have been originated from
    # the hashicorp/boundary repository. As Enos scenarios require access to
    # Github Actions secrets, it only makes sense to run this workflow when those
    # secrets are available. Any pull requests from forks will not trigger the
    # workflow.
    if: "! github.event.pull_request.head.repo.fork"
    needs:
      - set-product-version
      - product-metadata
      - build-linux
    uses: ./.github/workflows/enos-run.yml
    with:
      artifact-name: "boundary_${{ needs.set-product-version.outputs.product-version }}_linux_amd64.zip"
      go-version: ${{ needs.product-metadata.outputs.go-version }}
    secrets: inherit

  bats:
    runs-on: ubuntu-latest
    name: CLI tests
    if: "! github.event.pull_request.head.repo.fork"
    needs:
      - set-product-version
      - build-linux
    steps:
      - uses: actions/checkout@v3
      - name: Import GPG key for Boundary pass keystore
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@v5
        with:
          gpg_private_key: ${{ secrets.ENOS_GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.ENOS_GPG_PASSPHRASE }}
      - name: Trust the pass keystore GPG key
        id: trust_gpg
        run: |
          gpg -a --encrypt -r ${{ secrets.ENOS_GPG_UID }} --trust-model always
          echo "trusted-key ${{ secrets.ENOS_GPG_UID }}" >> ~/.gnupg/gpg.conf
          cat ~/.gnupg/gpg.conf          
      - name: Set up Bats CLI UI tests dependency cache
        id: dep-cache
        uses: actions/cache@v3
        with:
          path: /tmp/bats-cli-ui-deps
          key: enos-bats-cli-ui-deps-jq-1.6-password-store-1.7.4-vault-1.12.2
      - name: Set up Node for Bats install
        uses: actions/setup-node@v3
        with:
          node-version: 16
      - name: Install Bats via NPM
        # Use npm so this workflow is portable on multiple runner distros
        run: npm install --location=global bats
      - name: Download jq for Bats CLI UI tests
        if: steps.dep-cache.outputs.cache-hit != 'true'
        # NOTE: if you update the jq version make sure to update the dep cache key
        run: |
          mkdir -p /tmp/bats-cli-ui-deps
          wget https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64 -O /tmp/bats-cli-ui-deps/jq-bin          
      - name: Install jq for Bats CLI UI tests
        run: |
          chmod +x /tmp/bats-cli-ui-deps/jq-bin
          sudo cp /tmp/bats-cli-ui-deps/jq-bin /usr/local/bin/jq          
      - name: Download and unzip pass for Boundary keyring
        if: steps.dep-cache.outputs.cache-hit != 'true'
        # NOTE: if you update the password store version make sure to update the dep cache key
        run: |
          mkdir -p /tmp/bats-cli-ui-deps/pass
          wget https://git.zx2c4.com/password-store/snapshot/password-store-1.7.4.tar.xz -O /tmp/bats-cli-ui-deps/pass/pass.tar.xz
          cd /tmp/bats-cli-ui-deps/pass
          tar -xvf pass.tar.xz          
      - name: Install pass for Boundary keyring
        run: |
          cd /tmp/bats-cli-ui-deps/pass/password-store-1.7.4
          sudo make install
          pass init ${{ secrets.ENOS_GPG_UID }}          
      - name: Download Vault AMD64 binary for integration testing
        if: steps.dep-cache.outputs.cache-hit != 'true'
        run: |
                    wget https://releases.hashicorp.com/vault/1.12.2/vault_1.12.2_linux_amd64.zip -O /tmp/bats-cli-ui-deps/vault.zip
      - name: Install Vault
        run: |
                    unzip /tmp/bats-cli-ui-deps/vault.zip -d /usr/local/bin
      - name: Download Linux AMD64 Boundary bundle
        id: download
        uses: actions/download-artifact@v3
        with:
          name: boundary_${{ needs.set-product-version.outputs.product-version }}_linux_amd64.zip
          path: /tmp
      - name: Unpack boundary bundle
        run: |
          unzip ${{steps.download.outputs.download-path}}/boundary_${{ needs.set-product-version.outputs.product-version }}_linux_amd64.zip -d /usr/local/bin
          rm ${{steps.download.outputs.download-path}}/boundary_${{ needs.set-product-version.outputs.product-version }}_linux_amd64.zip          
      - name: Versions
        run: |
          echo "go version:"
          go version
          echo "bats version:"
          bats --version
          echo "jq version:"
          jq --version
          echo "gpg version:"
          gpg --version
          echo "pass version:"
          pass --version
          echo "bash version:"
          bash --version
          echo "boundary version:"
          boundary version
          echo "vault version:"
          vault version          
      - name: Run cli bats tests
        run: |
          export VAULT_ADDR=http://127.0.0.1:8200
          export VAULT_TOKEN=boundarytok
          make -C internal/tests/cli test-vault-up
          until vault status; do docker container inspect boundary-cli-tests-vault &> /dev/null || exit -1; sleep 1; done
          make test-cli          
      - name: Cleanup
        if: success() || failure()
        run: |
                    make -C internal/tests/cli test-vault-down
      - name: Send Slack message
        if: ${{ failure() }}
        uses: slackapi/slack-github-action@007b2c3c751a190b6f0f040e47ed024deaa72844 # v1.23.0
        with:
          channel-id: ${{ secrets.SLACK_BOUNDARY_TEST_BOT_CHANNEL_ID }}
          payload: |
            {
              "text": ":x: bats tests failed: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n*Branch:* ${{ github.event.ref }}\n*SHA:* <${{ github.event.head_commit.url }}|${{ github.event.after }}>"
            }            
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOUNDARY_TEST_BOT_TOKEN }}