release-harp-terraformer.yml

name: Release (Harp Terraformer)

on:
  workflow_dispatch:
    inputs:
      release:
        description: 'Release version'
        required: true

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      packages: write
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          # normal
          - golang-image: "golang"
            golang-version: "1.17"
            tools-image: ghcr.io/elastic/harp/harp-tools:latest
            harp-image: harp-terraformer
          # fips
          - golang-image: "goboring/golang"
            golang-version: "1.16.7b7"
            tools-image: ghcr.io/elastic/harp/harp-tools-fips:latest
            harp-image: harp-terraformer-fips
    steps:
      -
        name: Check out the repo
        uses: actions/checkout@v2
        with:
          fetch-depth: 0
      -
        name: Set up Go
        uses: actions/setup-go@v2
        with:
          go-version: 1.17
      -
        name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v1
        with:
          install: true
      - name: Cache Docker layers
        uses: actions/cache@v2
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}-multi-buildx-terraformer-${{ matrix.golang-version }}-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-multi-buildx-terraformer-${{ matrix.golang-version }}-${{ github.sha }}
            ${{ runner.os }}-multi-buildx-terraformer-${{ matrix.golang-version }}
            ${{ runner.os }}-multi-buildx-terraformer
      -
        name: Set Dockerfile settings
        run: |
          echo Building $DOCKER_IMAGE_NAME with $GOLANG_IMAGE:$GOLANG_VERSION
          echo "DOCKERFILE_ONLY=1" >> $GITHUB_ENV
          echo "GOLANG_IMAGE=$GOLANG_IMAGE" >> $GITHUB_ENV
          echo "GOLANG_VERSION=$GOLANG_VERSION" >> $GITHUB_ENV
          echo "TOOL_IMAGE_NAME=$TOOL_IMAGE_NAME" >> $GITHUB_ENV
          echo "RELEASE=$RELEASE" >> $GITHUB_ENV
        env:
          DOCKERFILE_ONLY: 1
          GOLANG_IMAGE: ${{ matrix.golang-image }}
          GOLANG_VERSION: ${{ matrix.golang-version }}
          TOOL_IMAGE_NAME: ${{ matrix.tools-image }}
          RELEASE: ${{ github.event.inputs.release }}
      -
        name: Generate Dockerfile
        uses: magefile/mage-action@v1
        with:
          version: latest
          args: releaser:terraformer
      -
        name: Log in to the Container registry
        uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      -
        name: Build Docker image
        id: docker_build
        uses: docker/build-push-action@v2
        with:
          context: .
          file: Dockerfile.release
          pull: false
          push: true
          tags: |
            ghcr.io/elastic/harp-plugins/${{ matrix.harp-image }}:v${{ github.event.inputs.release }}
            ghcr.io/elastic/harp-plugins/${{ matrix.harp-image }}:latest
          cache-from: type=local,src=/tmp/.buildx-cache
          cache-to: type=local,mode=max,dest=/tmp/.buildx-cache-new
          build-args: |
            GOLANG_IMAGE=${{ matrix.golang-image }}
            GOLANG_VERSION=${{ matrix.golang-version }}
            RELEASE=${{ github.event.inputs.release }}
      -
        name: Create SBOM
        uses: anchore/sbom-action@v0
        with:
          image: ghcr.io/elastic/harp-plugins/${{ matrix.harp-image }}:v${{ github.event.inputs.release }}
          registry-username: ${{ github.actor }}
          registry-password: ${{ github.token }}
          artifact-name: sbom.spdx
          format: spdx
      -
        uses: sigstore/cosign-installer@main
      -
        name: Sign image and add attestations
        run: |
          echo -n "${COSIGN_PASSWORD}" | \
          cosign sign --key <(echo -n "${COSIGN_KEY}") \
            -a "repo=${{ github.repository }}" \
            -a "workflow=${{ github.workflow }}" \
            -a "ref=${{ github.sha }}" \
            ghcr.io/elastic/harp-plugins/${{ matrix.harp-image }}:v${{ github.event.inputs.release }}
          cosign attach sbom --sbom sbom.spdx ghcr.io/elastic/harp-plugins/${{ matrix.harp-image }}:v${{ github.event.inputs.release }}
        env:
          COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
      -
        name: Move cache
        run: |
          rm -rf /tmp/.buildx-cache
          mv /tmp/.buildx-cache-new /tmp/.buildx-cache

  release:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      packages: read
      contents: write
    steps:
      -
        name: Log in to the Container registry
        uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      -
        name: Extract artifacts from the docker image
        id: extract-std
        uses: shrink/actions-docker-extract@v1
        with:
          image: ghcr.io/elastic/harp-plugins/harp-terraformer:v${{ github.event.inputs.release }}
          path: '/app/.'
      -
        name: Extract FIPS artifacts from the docker image
        id: extract-fips
        uses: shrink/actions-docker-extract@v1
        with:
          image: ghcr.io/elastic/harp-plugins/harp-terraformer-fips:v${{ github.event.inputs.release }}
          path: '/app/.'
      -
        name: Assemble a package
        run: |
          mkdir .dist
          cp ${{ steps.extract-std.outputs.destination }}/* .dist/
          cp ${{ steps.extract-fips.outputs.destination }}/* .dist/
          cd .dist
          find . -maxdepth 1 -mindepth 1 -type f -exec tar czvf {}.tar.gz {} --remove-files \;
      -
        name: Create checksum
        id: create-checksum
        run: |
          cd .dist
          sha512sum * > checksum.txt
      -
        uses: sigstore/cosign-installer@main
      -
        name: Sign the checksum
        run: |
          cd .dist
          echo -n "${COSIGN_PASSWORD}" | \
            cosign sign-blob --key <(echo -n "${COSIGN_KEY}") \
              --output-signature=checksum.txt.sig \
              checksum.txt
        env:
          COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
      -
        name: Upload to release
        uses: AButler/upload-release-assets@v2.0
        with:
          files: '.dist/*'
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          release-tag: cmd/harp-terraformer/v${{ github.event.inputs.release }}