Skip to content

Commit 8277034

Browse files
james-nesbittgithub-advanced-security[bot]
james-nesbitt
and
github-advanced-security[bot]
authored
Migrate to gha only (#615)
- refactor CI/CD to GHA only - drop goreleaser and stick to native go builds/tests - address some linting and security issues (vendor updates/govulncheck/GHA secret safety) --------- Signed-off-by: James Nesbitt <jnesbitt@mirantis.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
1 parent c0a9f54 commit 8277034

File tree

7 files changed

+244
-95
lines changed

7 files changed

+244
-95
lines changed

‎.github/workflows/build.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# Build and test workflow for Launchpad
2+
# Triggered on PRs and pushes to main.
3+
4+
name: Build and Test
5+
permissions:
6+
contents: read
7+
packages: write # Required for uploading artifacts
8+
9+
on:
10+
push:
11+
branches: [ main ]
12+
13+
jobs:
14+
build:
15+
name: Build Binaries
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout code
19+
uses: actions/checkout@v4
20+
21+
- name: Set up Go
22+
uses: actions/setup-go@v5
23+
with:
24+
go-version: "1.25"
25+
26+
- name: Build binaries
27+
run: |
28+
mkdir -p dist
29+
platforms=("linux/amd64" "linux/arm64" "windows/amd64" "windows/arm64" "darwin/amd64" "darwin/arm64")
30+
for platform in "${platforms[@]}"; do
31+
GOOS=${platform%/*}
32+
GOARCH=${platform#*/}
33+
output_name="dist/launchpad_${GOOS}_${GOARCH}"
34+
if [ "$GOOS" = "windows" ]; then
35+
output_name+=".exe"
36+
fi
37+
echo "Building $output_name"
38+
GOOS=$GOOS GOARCH=$GOARCH go build -o "$output_name" ./main.go
39+
done
40+
41+
- name: Upload artifacts
42+
uses: actions/upload-artifact@v4
43+
with:
44+
name: launchpad-binaries
45+
path: dist/
46+
47+
test:
48+
name: Run Tests
49+
runs-on: ubuntu-latest
50+
needs: build
51+
steps:
52+
- name: Checkout code
53+
uses: actions/checkout@v4
54+
55+
- name: Set up Go
56+
uses: actions/setup-go@v5
57+
with:
58+
go-version: "1.22"
59+
60+
- name: Run unit tests
61+
run: go test -v ./...
62+
63+
- name: Run integration tests
64+
run: go test -v -tags=integration ./test/integration

‎.github/workflows/golangci-lint.yaml‎

Lines changed: 0 additions & 33 deletions
This file was deleted.

‎.github/workflows/pr.yml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# PR validation workflow for Launchpad
2+
# Triggered on PRs to main branch.
3+
4+
name: PR Validation
5+
6+
permissions:
7+
contents: read
8+
pull-requests: write # Required for PR comments or labels
9+
10+
on:
11+
pull_request:
12+
branches: [ main ]
13+
paths:
14+
- "**.go"
15+
- "go.mod"
16+
- "go.sum"
17+
- "test/**"
18+
- "examples/**"
19+
- ".github/workflows/**"
20+
paths-ignore:
21+
- "**.md"
22+
- "docs/**"
23+
24+
jobs:
25+
lint:
26+
name: Lint Code
27+
runs-on: ubuntu-latest
28+
steps:
29+
- name: Checkout code
30+
uses: actions/checkout@v4
31+
32+
- name: Set up Go
33+
uses: actions/setup-go@v5
34+
with:
35+
go-version: "1.25"
36+
37+
- name: Run golangci-lint
38+
run: make lint
39+
40+
unit-test:
41+
name: Unit Tests
42+
runs-on: ubuntu-latest
43+
steps:
44+
- name: Checkout code
45+
uses: actions/checkout@v4
46+
47+
- name: Set up Go
48+
uses: actions/setup-go@v5
49+
with:
50+
go-version: "1.25"
51+
52+
- name: Run unit tests
53+
run: make unit-test
54+
55+
integration-test:
56+
name: Integration Tests
57+
runs-on: ubuntu-latest
58+
steps:
59+
- name: Checkout code
60+
uses: actions/checkout@v4
61+
62+
- name: Set up Go
63+
uses: actions/setup-go@v5
64+
with:
65+
go-version: "1.25"
66+
67+
- name: Run integration tests
68+
run: make integration-test
69+
70+
71+
72+
security-scan:
73+
name: Security Scan
74+
runs-on: ubuntu-latest
75+
steps:
76+
- name: Checkout code
77+
uses: actions/checkout@v4
78+
79+
- name: Set up Go
80+
uses: actions/setup-go@v5
81+
with:
82+
go-version: "1.25"
83+
84+
- name: Install govulncheck
85+
run: go install golang.org/x/vuln/cmd/govulncheck@latest
86+
87+
- name: Run security scan
88+
run: govulncheck ./...

‎.github/workflows/release.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
# Release workflow for Launchpad
2+
# Triggered on tags (e.g., v1.5.16).
3+
4+
name: Release
5+
permissions:
6+
contents: read # Top-level: Restricts all jobs by default
7+
packages: write # Required for uploading artifacts
8+
9+
on:
10+
push:
11+
tags:
12+
- "v*"
13+
14+
jobs:
15+
build:
16+
name: Build Release Binaries
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: Checkout code
20+
uses: actions/checkout@v4
21+
22+
- name: Set up Go
23+
uses: actions/setup-go@v5
24+
with:
25+
go-version: "1.25"
26+
27+
- name: Build binaries
28+
run: |
29+
mkdir -p dist
30+
platforms=("linux/amd64" "linux/arm64" "windows/amd64" "windows/arm64" "darwin/amd64" "darwin/arm64")
31+
for platform in "${platforms[@]}"; do
32+
GOOS=${platform%/*}
33+
GOARCH=${platform#*/}
34+
output_name="dist/launchpad_${GOOS}_${GOARCH}"
35+
if [ "$GOOS" = "windows" ]; then
36+
output_name+=".exe"
37+
fi
38+
echo "Building $output_name"
39+
GOOS=$GOOS GOARCH=$GOARCH go build -o "$output_name" ./main.go
40+
done
41+
42+
- name: Upload artifacts
43+
uses: actions/upload-artifact@v4
44+
with:
45+
name: launchpad-release-binaries
46+
path: dist/
47+
48+
release:
49+
name: Create GitHub Release
50+
runs-on: ubuntu-latest
51+
needs: build
52+
permissions:
53+
contents: write
54+
steps:
55+
- name: Download binaries
56+
uses: actions/download-artifact@v4
57+
with:
58+
name: launchpad-release-binaries
59+
path: dist/
60+
61+
- name: Create GitHub Release
62+
uses: softprops/action-gh-release@v1
63+
with:
64+
files: dist/*
65+
generate_release_notes: true
66+
draft: true
67+
env:
68+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
69+
70+
# TODO: Add Digicert signing here.
71+
# TODO: Push signed artifacts to S3 here.

‎Makefile‎

Lines changed: 18 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -1,81 +1,40 @@
11

2-
GO=$(shell which go)
3-
4-
RELEASE_FOLDER=dist/release
5-
6-
CHECKSUM=$(shell which sha256sum)
7-
8-
VOLUME_MOUNTS=-v "$(CURDIR):/v"
9-
SIGN?=docker run --rm -i $(VOLUME_MOUNTS) -e SM_API_KEY -e SM_CLIENT_CERT_PASSWORD -e SM_CLIENT_CERT_FILE -v "$(SM_CLIENT_CERT_FILE):$(SM_CLIENT_CERT_FILE)" -w "/v" registry.mirantis.com/prodeng/digicert-keytools-jsign:latest sign
10-
11-
GOLANGCI_LINT?=docker run -t --rm -v "$(CURDIR):/data" -w "/data" golangci/golangci-lint:latest golangci-lint
12-
13-
SEGMENT_TOKEN?=""
14-
152
.PHONY: clean
163
clean:
174
rm -fr dist
185

19-
# Sign release binaries (Windows)
20-
# (build may need to be run in a separate make run)
21-
.PHONY: sign-release
22-
sign-release: $(RELEASE_FOLDER)
23-
for f in `find $(RELEASE_FOLDER)/*.exe`; do echo $(SIGN) "$$f"; done
6+
# TODO: Digicert signing will be reimplemented in GitHub Actions.
247

25-
# Force a clean build of the artifacts by first cleaning
26-
# and then building
27-
.PHONY: build-release
28-
build-release: clean $(RELEASE_FOLDER)
29-
# build all the binaries for release, using goreleaser, but
30-
# don't use any of the other features of goreleaser - because
31-
# we need to use digicert to sign the binaries first, and
32-
# goreleaser doesn't allow for that (some pro features may
33-
# allow it in a round about way.)
34-
#
35-
# If you are using more than one tag for a commit, then use
36-
# the GORELEASER_CURRENT_TAG env var to clarify the version to
37-
# avoid having the wrong tag version applied
38-
$(RELEASE_FOLDER):
39-
SEGMENT_TOKEN=${SEGMENT_TOKEN} goreleaser build --clean --config=.goreleaser.release.yml
40-
41-
.PHONY: create-checksum
42-
create-checksum:
43-
cd $(RELEASE_FOLDER) && \
44-
for f in *; do \
45-
$(CHECKSUM) $$f > $$f.sha256; \
46-
done
47-
48-
.PHONY: verify-checksum
49-
verify-checksum:
50-
for f in $(RELEASE_FOLDER)/*.sha256; do \
51-
$(CHECKSUM) -c $$f; \
52-
echo "Verified checksum for $$f"; \
53-
done
54-
55-
# clean out any existing release build
56-
.PHONY: clean-release
57-
clean-release:
58-
rm -fr $(RELEASE_FOLDER)
59-
60-
# Local build of the plugin. This saves time building platforms that you
61-
# won't test locally. To use it, find the path to your build binary path
62-
# and alias it.
8+
# Local build of the plugin. This saves time building only the host platform.
9+
# Uses native Go commands to avoid Goreleaser dependency.
6310
.PHONY: local
6411
local:
65-
SEGMENT_TOKEN=${SEGMENT_TOKEN} goreleaser build --clean --single-target --skip=validate --snapshot --config .goreleaser.local.yml
12+
mkdir -p dist
13+
GOOS=$(shell go env GOOS) GOARCH=$(shell go env GOARCH) \
14+
output_name="dist/launchpad_$${GOOS}_$${GOARCH}"; \
15+
if [ "$${GOOS}" = "windows" ]; then \
16+
output_name="$${output_name}.exe"; \
17+
fi; \
18+
go build -o "$${output_name}" ./main.go && \
19+
./$${output_name} --help
6620

6721
# run linting
6822
.PHONY: lint
6923
lint:
70-
$(GOLANGCI_LINT) run
24+
golangci-lint run
25+
26+
# security scanning
27+
.PHONY: security-scan
28+
security-scan:
29+
govulncheck ./...
7130

7231
# Testing related targets
7332

7433
# TEST_FLAGS can be set in CI to e.g. -short to skip tests that need network/OCI
7534
TEST_FLAGS?=
7635
.PHONY: unit-test
7736
unit-test:
78-
$(GO) test -v --tags 'testing' $(TEST_FLAGS) ./pkg/...
37+
go test -v --tags 'testing' $(TEST_FLAGS) ./pkg/...
7938

8039
.PHONY: functional-test
8140
functional-test:

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,7 @@ require (
157157
github.com/spf13/pflag v1.0.10 // indirect
158158
github.com/tidwall/transform v0.0.0-20201103190739-32f242e2dbde // indirect
159159
github.com/tmccombs/hcl2json v0.6.4 // indirect
160-
github.com/ulikunitz/xz v0.5.14 // indirect
160+
github.com/ulikunitz/xz v0.5.15 // indirect
161161
github.com/x448/float16 v0.8.4 // indirect
162162
github.com/xlab/treeprint v1.2.0 // indirect
163163
github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 // indirect

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -425,8 +425,8 @@ github.com/tidwall/transform v0.0.0-20201103190739-32f242e2dbde h1:AMNpJRc7P+GTw
425425
github.com/tidwall/transform v0.0.0-20201103190739-32f242e2dbde/go.mod h1:MvrEmduDUz4ST5pGZ7CABCnOU5f3ZiOAZzT6b1A6nX8=
426426
github.com/tmccombs/hcl2json v0.6.4 h1:/FWnzS9JCuyZ4MNwrG4vMrFrzRgsWEOVi+1AyYUVLGw=
427427
github.com/tmccombs/hcl2json v0.6.4/go.mod h1:+ppKlIW3H5nsAsZddXPy2iMyvld3SHxyjswOZhavRDk=
428-
github.com/ulikunitz/xz v0.5.14 h1:uv/0Bq533iFdnMHZdRBTOlaNMdb1+ZxXIlHDZHIHcvg=
429-
github.com/ulikunitz/xz v0.5.14/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
428+
github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
429+
github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
430430
github.com/urfave/cli/v2 v2.27.7 h1:bH59vdhbjLv3LAvIu6gd0usJHgoTTPhCFib8qqOwXYU=
431431
github.com/urfave/cli/v2 v2.27.7/go.mod h1:CyNAG/xg+iAOg0N4MPGZqVmv2rCoP267496AOXUZjA4=
432432
github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=

0 commit comments

Comments
 (0)