v0.32.2 #54
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| permissions: | |
| contents: write # in order to upload release assets | |
| on: | |
| release: | |
| types: | |
| - published | |
| jobs: | |
| metadata: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| versionFlags: ${{ steps.flags.outputs.versionFlags }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 | |
| - name: Set build version metadata flags | |
| id: flags | |
| run: | | |
| ldflags=( | |
| "-X github.com/pomerium/cli/version.Version=${{ github.event.release.tag_name }}" | |
| "-X github.com/pomerium/cli/version.GitCommit=$(git rev-parse --short HEAD)" | |
| "-X github.com/pomerium/cli/version.BuildMeta=$(date +%s)" | |
| "-X github.com/pomerium/cli/version.ProjectName=pomerium-cli" | |
| "-X github.com/pomerium/cli/version.ProjectURL=https://www.pomerium.com" | |
| ) | |
| echo "versionFlags=${ldflags[*]}" >> $GITHUB_OUTPUT | |
| build-windows: | |
| runs-on: windows-latest | |
| needs: metadata | |
| outputs: | |
| checksums: ${{ steps.build.outputs.checksums }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 | |
| - name: Set up Go | |
| uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c | |
| with: | |
| go-version-file: .tool-versions | |
| - name: Build and archive | |
| id: build | |
| shell: bash | |
| run: | | |
| echo 'checksums<<EOF' >> $GITHUB_OUTPUT | |
| for arch in amd64 arm64; do | |
| mkdir -p bin/$arch | |
| GOARCH=$arch CGO_ENABLED=1 go build -o bin/$arch \ | |
| -ldflags="-s -w ${{ needs.metadata.outputs.versionFlags }}" \ | |
| ./cmd/pomerium-cli | |
| zipfile="pomerium-cli-windows-$arch.zip" | |
| powershell "Compress-Archive -Path bin\\$arch\\\* -DestinationPath $zipfile" | |
| hash=$(powershell "(Get-FileHash $zipfile -Algorithm SHA256).Hash.ToLower()") | |
| echo "$hash $zipfile" >> $GITHUB_OUTPUT | |
| done | |
| echo EOF >> $GITHUB_OUTPUT | |
| - name: Upload to release | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: gh release upload "${{ github.event.release.tag_name }}" pomerium-cli-windows-*.zip | |
| goreleaser: | |
| permissions: | |
| contents: write | |
| issues: read | |
| pull-requests: read | |
| runs-on: ubuntu-latest | |
| needs: metadata | |
| env: | |
| DOCKER_CLI_EXPERIMENTAL: "enabled" | |
| outputs: | |
| tag: ${{ steps.tagName.outputs.tag }} | |
| checksums: ${{ steps.checksums.outputs.checksums }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 | |
| with: | |
| fetch-depth: 0 # GoReleaser needs commit history for changelog | |
| - name: Set up Go | |
| uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c | |
| with: | |
| go-version-file: .tool-versions | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f | |
| - uses: azure/docker-login@15c4aadf093404726ab2ff205b2cdd33fa6d054c | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USER }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Run GoReleaser | |
| uses: goreleaser/goreleaser-action@v6.4.0 | |
| with: | |
| version: v2.8.2 | |
| args: release | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| VERSION_FLAGS: ${{ needs.metadata.outputs.versionFlags }} | |
| - name: Compute checksums | |
| id: checksums | |
| working-directory: ./dist | |
| run: | | |
| echo 'checksums<<EOF' >> $GITHUB_OUTPUT | |
| shasum -a 256 *.{tar.gz,deb,rpm} >> $GITHUB_OUTPUT | |
| echo EOF >> $GITHUB_OUTPUT | |
| - name: Get tag name | |
| id: tagName | |
| run: | | |
| TAG=$(git describe --tags --exact-match) | |
| echo "tag=${TAG}" >> $GITHUB_OUTPUT | |
| echo "version=${TAG#v}" >> $GITHUB_OUTPUT | |
| echo "pkgversion=$(echo ${TAG#v} | tr '-' '~')" >> $GITHUB_OUTPUT | |
| - name: Install Cloudsmith CLI | |
| run: | | |
| pip3 install cloudsmith-cli | |
| - name: Publish to Cloudsmith | |
| env: | |
| CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }} | |
| working-directory: dist/ | |
| run: | | |
| VERSION=${{ steps.tagName.outputs.pkgversion }} | |
| RPMS="pomerium-cli-${VERSION}-1.aarch64.rpm pomerium-cli-${VERSION}-1.x86_64.rpm pomerium-cli-${VERSION}-1.armv6hl.rpm pomerium-cli-${VERSION}-1.armv7hl.rpm" | |
| for pkg in $(echo $RPMS); do | |
| cloudsmith push rpm pomerium/pomerium/el/any-version $pkg | |
| done | |
| DEBS="pomerium-cli_${VERSION}-1_amd64.deb pomerium-cli_${VERSION}-1_arm64.deb pomerium-cli_${VERSION}-1_armhf.deb" | |
| for pkg in $(echo $DEBS); do | |
| cloudsmith push deb pomerium/pomerium/debian/any-version $pkg | |
| done | |
| - name: Find latest tag | |
| id: latestTag | |
| run: | | |
| LATEST_TAG=$(git tag | grep -vi 'rc' | sort --version-sort | tail -1) | |
| echo "tag=${LATEST_TAG}" >> $GITHUB_OUTPUT | |
| - name: Publish latest tag | |
| if: "steps.latestTag.outputs.tag == steps.tagName.outputs.tag" | |
| run: | | |
| docker manifest create -a pomerium/cli:latest pomerium/cli:amd64-${{ steps.tagName.outputs.tag }} pomerium/cli:arm64v8-${{ steps.tagName.outputs.tag }} | |
| docker manifest push pomerium/cli:latest | |
| finish: | |
| runs-on: ubuntu-latest | |
| needs: [build-windows, goreleaser, metadata] | |
| steps: | |
| - name: Upload checksums | |
| env: | |
| GH_REPO: ${{ github.repository }} | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| echo "${{ needs.build-windows.outputs.checksums }}" >> pomerium-cli_checksums.txt | |
| echo "${{ needs.goreleaser.outputs.checksums }}" >> pomerium-cli_checksums.txt | |
| gh release upload "${{ github.event.release.tag_name }}" pomerium-cli_checksums.txt | |
| - id: clean_version | |
| run: | | |
| echo "release=${VERSION#v}" >> $GITHUB_OUTPUT | |
| env: | |
| VERSION: "${{ github.event.release.tag_name }}" | |
| - name: trigger mac signed and notarized builds | |
| uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 | |
| with: | |
| repository: pomerium/mac-builds | |
| token: ${{ secrets.APPARITOR_GITHUB_TOKEN }} | |
| event-type: pomerium-cli-release | |
| client-payload: '{ "release": "${{ github.event.release.tag_name }}", "version_flags": "${{ needs.metadata.outputs.versionFlags }}", "push": "true" }' |