action.yml

# Copyright (c) 2021 SpyderMix Ltd.

name: 'Wireleap component test/build/staging/release action'
description: 'Run unit tests, build binaries, upload to staging location and perform tagged release'
author: 'Anton Pyrogovskyi <anton@wireleap.com>'
inputs:
  token:
    description: 'Token to access private repos and dispatch gh-test workflow'
    required: true
  ssh_key:
    description: 'SSH private key for artifact upload to staging location'
    required: true
  upload_target:
    description: 'Where to upload artifacts to (ssh/scp-style path: user@host:dir/)'
    required: true
  gpg_key:
    description: 'GPG key for signing release binaries'
    required: false
    default: 'none'
runs:
  using: 'composite'
  steps:
    - name: Fix https://github.com/actions/checkout/issues/290
      run: "cd ${{ github.workspace }} && git fetch --tags --force"
      shell: sh
    - name: Set up private repo access
      env:
        GITHUB_TOKEN: ${{ inputs.token }}
      run: "cat ${{ github.action_path }}/gitconfig-template | envsubst > ${{ github.action_path }}/gitconfig"
      shell: sh
    - name: Output version
      run: "${{ github.workspace }}/contrib/gitversion.sh"
      shell: sh
    - name: Get dependencies, build and run unit tests
      env:
        DOCKER_OPTS: "-v ${{ github.action_path }}/gitconfig:/root/.gitconfig"
      run: "${{ github.workspace }}/contrib/docker/run-tests.sh"
      shell: sh
    - name: Build binaries
      env:
        DOCKER_OPTS: "-v ${{ github.action_path }}/gitconfig:/root/.gitconfig"
      run: "${{ github.workspace }}/contrib/docker/build-bin.sh build"
      shell: sh
    - name: Import GPG key
      run: |
          if [ "${{ inputs.gpg_key }}" = 'none' ]; then
              echo '### No GPG key defined to sign release, aborting.'
              exit 1
          fi
          echo "${{ inputs.gpg_key }}" | gpg --batch --import -
      shell: sh
    - name: Sign binaries
      run: |
          for i in build/*; do
              "${{ github.action_path }}/helpers/gen-signature.sh" "$i"
          done
      shell: sh
    - name: Set up SSH
      run: |
          mkdir -p "$HOME/.ssh"
          echo "${{ inputs.ssh_key }}" > "$HOME/.ssh/id_rsa"
          chmod go-rwx "$HOME/.ssh/id_rsa"
          cp ${{ github.action_path }}/known_hosts "$HOME/.ssh/known_hosts"
      shell: sh
    - name: Deploy to staging location
      run: "rsync -e 'ssh -o RequestTTY=no' -WavK build/ ${{ inputs.upload_target }}"
      shell: sh
    - name: Trigger gh-test workflow and wait for it to succeed
      run: |
          echo '### Triggering gh-test workflow ...'
          curl -sS \
              -H 'Accept: application/vnd.github.v3+json' \
              -H "Authorization: token ${{ inputs.token }}" \
              -X POST \
              -d '{"ref":"master"}' \
              'https://api.github.com/repos/wireleap/gh-test/actions/workflows/main.yml/dispatches'
          sleep 10 # wait for it to "appear"
          while ! curl -sS \
              -H 'Accept: application/vnd.github.v3+json' \
              -H "Authorization: token ${{ inputs.token }}" \
              'https://api.github.com/repos/wireleap/gh-test/actions/workflows/main.yml/runs?per_page=1&event=workflow_dispatch' \
              | jq --exit-status '.workflow_runs | .[0] | .status == "completed"' > /dev/null
          do
              echo '### Waiting for gh-test workflow to complete ...'
              sleep 10
          done
          if curl -sS \
              -H 'Accept: application/vnd.github.v3+json' \
              -H "Authorization: token ${{ inputs.token }}" \
              'https://api.github.com/repos/wireleap/gh-test/actions/workflows/main.yml/runs?per_page=1&event=workflow_dispatch' \
              | jq --exit-status '.workflow_runs | .[0] | .conclusion == "success"' > /dev/null
          then
              echo '### Integration tests succeeded!'
          else
              echo '### Integration tests failed!'
              exit 1
          fi
          # remove intermediate artifacts
          rm -rf build
      shell: sh
    - name: Build, sign & upload release binaries
      env:
        DOCKER_OPTS: "-v ${{ github.action_path }}/gitconfig:/root/.gitconfig"
      run: |
          case "${{ github.event_name }}+${{ github.ref }}" in
              'push+refs/tags/v'*) true ;;
              *) echo '### No release tag pushed -- not a release build.'; exit 0 ;;
          esac

          if [ "${{ github.repository }}" = 'wireleap/client' ]; then
              BUILD_USER="$(id -u)" \
              BUILD_GROUP="$(id -g)" \
              "${{ github.action_path }}/helpers/build-release-bin.sh" \
                  "${{ github.workspace }}" \
                  "${{ github.workspace }}/build" \
                  all
          else
              BUILD_USER="$(id -u)" \
              BUILD_GROUP="$(id -g)" \
              "${{ github.action_path }}/helpers/build-release-bin.sh" \
                  "${{ github.workspace }}" \
                  "${{ github.workspace }}/build" \
                  linux
              BUILD_USER="$(id -u)" \
              BUILD_GROUP="$(id -g)" \
              "${{ github.action_path }}/helpers/build-release-bin.sh" \
                  "${{ github.workspace }}" \
                  "${{ github.workspace }}/build" \
                  darwin
          fi
          rm -rf ~/.gnupg
          # create initial release
          tag=${GITHUB_REF#refs/*/}
          version=${tag#v}
          output="$(curl -sS \
              -H 'Accept: application/vnd.github.v3+json' \
              -H "Authorization: token ${{ github.token }}" \
              -X POST \
              -d "{
                  \"tag_name\":\"$tag\",
                  \"draft\":true,
                  \"name\":\"$($GITHUB_WORKSPACE/contrib/gitversion.sh)\",
                  \"body\":\"The changelog for this version is located [here](https://github.com/${{ github.repository }}/blob/master/changelogs/$version.md).\"
              }" \
              'https://api.github.com/repos/${{ github.repository }}/releases'
          )"
          url="$( echo "$output" | jq -r '.url' )"
          upload_url="$( echo "$output" | jq -r '.upload_url | split("{") | first' )"
          [ "$upload_url" != 'null' ] || { echo '### null upload_url, aborting. query output:'; echo "$output"; exit 1; }
          # upload release assets (binaries and .hash files)
          for f in "${{ github.workspace }}/build/"*; do
              name="$(basename "$f")"
              if [ "${f##*.}" = 'hash' ]; then
                  ct='text/plain'
              else
                  ct='application/octet-stream'
                  bname="$( echo "$name" | cut -d'_' -f1 )"
              fi
              curl -sS \
                  -H 'Accept: application/vnd.github.v3+json' \
                  -H "Authorization: token ${{ github.token }}" \
                  -H "Content-Type: $ct" \
                  -X POST \
                  --data-binary "@${f}" \
                  "$upload_url?name=$(basename "$f")&label=$(basename "$f")"
          done
          # undraft release
          curl -sS \
              -H 'Accept: application/vnd.github.v3+json' \
              -H "Authorization: token ${{ github.token }}" \
              -X PATCH \
              -d "{\"tag_name\":\"$tag\",\"draft\":false}" \
              "$url"
      shell: sh
    - name: Clean up private repo gitconfig
      run: "shred -u ${{ github.action_path }}/gitconfig"
      shell: sh