release.yml

name: Release

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"

jobs:
  setup:
    env:
      BASE_PROJECT: armory-cli
      GRGIT_USER: GitHub
      GRGIT_PASS: ${{ secrets.GITHUB_TOKEN }}
    runs-on: ubuntu-latest
    outputs:
      version: ${{ github.ref_name }}
      changelog: ${{ steps.changelog.outputs.CHANGELOG }}
    steps:
      - name: Checkout Code
        uses: actions/checkout@v2
        with:
          token: ${{ secrets.ARMORY_PLATFORM_GITHUB_PAT_TOKEN }}
          submodules: recursive

      - name: Fetch full history
        run: git fetch --prune --tags --unshallow

      - name: Generate Changelog
        id: changelog
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          export NEW_TAG="${{ github.ref_name }}"
          echo "NEW_TAG=$NEW_TAG"

          export PREVIOUS_TAG=$(git describe --abbrev=0 --tags "${NEW_TAG}"^ --match 'v[0-9]*')
          echo "PREVIOUS_TAG=$PREVIOUS_TAG"

          export CHANGELOG=`git log $NEW_TAG...$PREVIOUS_TAG --oneline`
          echo "CHANGELOG=$CHANGELOG"

          #Format the changelog so it's markdown compatible
          CHANGELOG="${CHANGELOG//$'%'/%25}"
          CHANGELOG="${CHANGELOG//$'\n'/%0A}"
          CHANGELOG="${CHANGELOG//$'\r'/%0D}"
          echo ::set-output name=CHANGELOG::$(echo -e "${CHANGELOG}")

  run-quality-suite:
    name: Run Quality Suite
    needs:
      - setup
    runs-on: ubuntu-latest
    steps:
      - name: Get GitHub App Installation Token for Private Go Repos
        id: get_token
        uses: machine-learning-apps/actions-app-token@0.21
        with:
          APP_PEM: ${{ secrets.GO_PRIVATE_REPO_APP_KEY }}
          APP_ID: ${{ secrets.GO_PRIVATE_REPO_APP_ID }}

      - name: Checkout Code
        uses: actions/checkout@v2
        with:
          fetch-depth: 1
          token: ${{ secrets.ARMORY_PLATFORM_GITHUB_PAT_TOKEN }}
          submodules: recursive

      - name: Setup Go environment
        uses: actions/setup-go@v3.5.0
        with:
          go-version-file: 'go.mod'

      - name: Cache Dependencies
        uses: actions/cache@v2
        with:
          path: ~/go/pkg/mod
          key: go-${{ hashFiles('**/go.sum') }}
          restore-keys: go-

      - name: Configure git for private modules
        env:
          TOKEN: ${{ steps.get_token.outputs.app_token }}
        run: git config --global url."https://x-access-token:${TOKEN}@github.com".insteadOf "https://github.com"

      - name: Run build
        run: |
          make all

      - name: SonarQube Analysis
        uses: sonarsource/sonarqube-scan-action@master
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}

  create-release:
    name: Create Release
    needs:
      - setup
      - run-quality-suite
    runs-on: ubuntu-latest
    outputs:
      release-url: ${{ steps.create-release.outputs.upload_url }}
    steps:
      - name: Create Release
        id: create-release
        uses: actions/create-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: "${{ needs.setup.outputs.version }}"
          release_name: ${{ github.event.repository.name }} ${{ needs.setup.outputs.version }}
          body: |
            ${{ needs.setup.outputs.changelog }}
          draft: false
          prerelease: false

  compile:
    name: Compile Binaries and Upload to Release
    needs:
      - setup
      - create-release
    runs-on: ubuntu-latest
    strategy:
      matrix:
        os: [ darwin, windows, linux ]
        arch: [ amd64, arm64 ]
        include:
          - os: windows
            arch: amd64
            ext: .exe
        exclude:
          - os: windows
            arch: arm64
    env:
      ASSET_NAME: armory-${{ matrix.os }}-${{ matrix.arch }}${{ matrix.ext }}
    steps:
      - name: Get GitHub App Installation Token for Private Go Repos
        id: get_token
        uses: machine-learning-apps/actions-app-token@0.21
        with:
          APP_PEM: ${{ secrets.GO_PRIVATE_REPO_APP_KEY }}
          APP_ID: ${{ secrets.GO_PRIVATE_REPO_APP_ID }}

      - name: Checkout Code
        uses: actions/checkout@v2
        with:
          token: ${{ secrets.ARMORY_PLATFORM_GITHUB_PAT_TOKEN }}
          submodules: recursive

      - name: Setup Go environment
        uses: actions/setup-go@v3.5.0
        with:
          go-version-file: 'go.mod'

      - name: Cache Dependencies
        uses: actions/cache@v2
        with:
          path: ~/go/pkg/mod
          key: go-${{ hashFiles('**/go.sum') }}
          restore-keys: go-

      - name: Configure git for private modules
        env:
          TOKEN: ${{ steps.get_token.outputs.app_token }}
        run: git config --global url."https://x-access-token:${TOKEN}@github.com".insteadOf "https://github.com"

      - name: Build CLI
        env:
          VERSION: ${{ needs.setup.outputs.version }}
          GOOS: ${{ matrix.os }}
          GOARCH: ${{ matrix.arch }}
          CLI_EXT: ${{ matrix.ext }}
        run: make build

      - name: Upload Release Asset
        id: upload-release-asset
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ needs.create-release.outputs.release-url }} # This pulls from the CREATE RELEASE step above, referencing its ID to get its outputs object, which include a `upload_url`. See this blog post for more info: https://jasonet.co/posts/new-features-of-github-actions/#passing-data-to-future-steps
          asset_path: ./build/dist/${{ matrix.os }}_${{ matrix.arch }}/armory${{ matrix.ext }}
          asset_name: ${{ env.ASSET_NAME }}
          asset_content_type: binary/octet-stream

  build-push:
    name: Build and Push Docker Image
    needs:
      - setup
      - create-release
      - compile
    runs-on: ubuntu-latest
    outputs:
      docker-version: ${{ steps.vars.outputs.version }}
    steps:
      - name: Get GitHub App Installation Token for Private Go Repos
        id: get_token
        uses: machine-learning-apps/actions-app-token@0.21
        with:
          APP_PEM: ${{ secrets.GO_PRIVATE_REPO_APP_KEY }}
          APP_ID: ${{ secrets.GO_PRIVATE_REPO_APP_ID }}

      - name: Checkout Code
        uses: actions/checkout@v2
        with:
          token: ${{ secrets.ARMORY_PLATFORM_GITHUB_PAT_TOKEN }}
          submodules: recursive

      - name: Setup Go environment
        uses: actions/setup-go@v3.5.0
        with:
          go-version-file: 'go.mod'

      - name: Cache Dependencies
        uses: actions/cache@v2
        with:
          path: ~/go/pkg/mod
          key: go-${{ hashFiles('**/go.sum') }}
          restore-keys: go-

      - name: Configure git for private modules
        env:
          TOKEN: ${{ steps.get_token.outputs.app_token }}
        run: git config --global url."https://x-access-token:${TOKEN}@github.com".insteadOf "https://github.com"

      - name: Login to Artifactory
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.ARTIFACTORY_USER }}
          password: ${{ secrets.ARTIFACTORY_TOKEN }}
          registry: armory-docker-local.jfrog.io


      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASS }}

      - name: Set variables
        id: vars
        run: |
          # Trim 'v' prefix from version
          echo "version=$(cut -c2- <<< ${{ needs.setup.outputs.version }})" >> $GITHUB_OUTPUT

      - name: Build and push Docker image
        env:
          REGISTRY: docker.io
          VERSION: ${{ needs.setup.outputs.version }}
          IMAGE_TAG_VERSION: ${{ steps.vars.outputs.version }}
          IMAGE_TAG: latest
          PUSH: true
        run: make release

  scan-image:
    name: CVE Image Scan
    needs:
      - build-push
      - setup
    runs-on: ubuntu-latest
    steps:
      - name: Run Security Scan
        uses: armory-io/aquasec-scan-action@v0.0.8
        with:
          url: https://aquasec.armory.io
          registry: Docker Hub
          username: ${{ secrets.AQUA_USER }}
          password: ${{ secrets.AQUA_PASSWORD }}
          image: armory/armory-cli:${{needs.build-push.outputs.docker-version}}

  run-s3-releaser:
    name: Update Releaser Repository
    needs:
      - setup
      - create-release
      - compile
    runs-on: ubuntu-latest
    steps:
      - name: Dispatch update event to releaser repository
        run: |
          curl -X POST -H "Authorization: token ${{ secrets.ARMORY_PLATFORM_GITHUB_PAT_TOKEN }}" -H "Accept: application/vnd.github.everest-preview+json" -H "Content-Type: application/json" https://api.github.com/repos/armory-io/armory-cli-releaser/dispatches --data "{\"event_type\": \"ReleaseCli\", \"client_payload\": {\"release_tag\": \"${{ github.ref_name }}\"}}"