updated GitHub action workflows according to feedback

bitwarden · Feb 2, 2025 · 1cffc90 · 1cffc90
1 parent e8c6f23
commit 1cffc90
Show file tree

Hide file tree

Showing 8 changed files with 106 additions and 48 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -1,12 +1,13 @@
 name: Build
 
 on:
-  workflow_dispatch:
   push:
     branches:
       - "main"
-  pull_request_target:
-    types: [opened, synchronize]
+  pull_request:
+    branches:
+      - "main"
+    types: [ opened, synchronize ]
 
 jobs:
 

diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -1,12 +1,10 @@
 name: Scan
 
 on:
-  workflow_dispatch:
-  push:
+  pull_request:
     branches:
       - "main"
-  pull_request_target:
-    types: [opened, synchronize]
+    types: [ opened, synchronize ]
 
 jobs:
   docs:

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -1,12 +1,10 @@
 name: golangci-lint
 
 on:
-  workflow_dispatch:
-  push:
+  pull_request:
     branches:
       - "main"
-  pull_request_target:
-    types: [opened, synchronize]
+    types: [ opened, synchronize ]
 
 jobs:
   lint:

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -10,11 +10,53 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
 
+      - name: Check out repo
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+      - name: Get current version
+        id: current-version
+        run: |
+          CURRENT_VERSION=$(grep 'ProviderVersion string =' version/version.go | sed -E 's/.*"([0-9]+\.[0-9]+\.[0-9]+(-pre)?)".*/\1/')
+          echo "version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
+
+      - name: Download Artifacts
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          path: "/artifacts"
+          pattern: "*_${{ steps.current-version.outputs.version }}_*.zip"
+          merge-multiple: true
+
+      - name: Generate Checksum File
+        id: checksum
+        run: |
+          MODULE_NAME=$(grep "^module" go.mod | awk -F'/' '{print $NF}')
+          CHECKSUM_FILE="${MODULE_NAME}_${{ steps.current-version.outputs.version }}_SHA256SUMS"
+          shasum -a 256 /artifacts/*.zip > $CHECKSUM_FILE
+          echo "module_name=$MODULE_NAME" >> $GITHUB_OUTPUT
+          echo "checksum_file=$CHECKSUM_FILE" >> $GITHUB_OUTPUT
+
+      - name: Import GPG Key
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+        run: |
+          echo "$GPG_PRIVATE_KEY" | base64 --decode | gpg --import
+
+      - name: Sign Checksum File
+        run: |
+          gpg --detach-sign --local-user ${{ secrets.GPG_KEY_ID }} --output ${{ steps.checksum.outputs.checksum_file }}.sig ${{ steps.checksum.outputs.checksum_file }}
+
+      - name: Prepare Manifest File
+        id: manifest
+        run: |
+          MANIFEST_FILE="${{ steps.checksum.outputs.module_name}}_${{ steps.current-version.outputs.version }}_manifest.json"
+          cp terraform-registry-manifest.json $MANIFEST_FILE
+          echo "manifest_file=$MANIFEST_FILE" >> $GITHUB_OUTPUT
+
       - name: Release
-        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
+        uses: ncipollo/release-action@cdcc88a9acf3ca41c16c37bb7d21b9ad48560d87 # v1.15.0
         with:
-          files: |
-            release/*.zip
-            terraform-registry-manifest.json
-            release/${{ needs.build-artifact.outputs.module_name }}_${{ needs.build-artifact.outputs.version }}_SHA256SUMS
-#            release/${{ needs.build-artifact.outputs.module_name }}_${{ needs.build-artifact.outputs.version }}_SHA256SUMS.sig
+          name: "${{ steps.current-version.outputs.version }}"
+          artifacts: "artifacts/*.zip,
+              ${{ steps.manifest.outputs.manifest_file }},
+              ${{ steps.checksum.outputs.checksum_file }},
+              ${{ steps.checksum.outputs.checksum_file }}.sig"
diff --git a/.github/workflows/repository-management.yml b/.github/workflows/repository-management.yml
@@ -66,10 +66,10 @@ jobs:
       - name: Get current version
         id: current-version
         run: |
-          CURRENT_VERSION=$(grep 'ProviderVersion string =' version/version.go | sed -E "s/.*\"([^\"]+)\".*/\\1/")
+          CURRENT_VERSION=$(grep 'ProviderVersion string =' version/version.go | sed -E 's/.*"([0-9]+\.[0-9]+\.[0-9]+(-pre)?)".*/\1/')
           echo "version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
 
-      - name: Verify input version
+      - name: Verify and set input version
         if: ${{ inputs.version_number_override != '' }}
         env:
           CURRENT_VERSION: ${{ steps.current-version.outputs.version }}
@@ -90,30 +90,53 @@ jobs:
             exit 1
           fi
 
+          if [[ "$RELEASE_TYPE" == "pre-release" ]]; then
+            NEW_VERSION="$NEW_VERSION-pre"
+          fi
+
+          echo "New version is $NEW_VERSION"
+          echo "new_version=$NEW_VERSION" >> "$GITHUB_OUTPUT"
+
       - name: Calculate next release version
         if: ${{ inputs.version_number_override == '' }}
         id: calculate-next-version
         env:
           CURRENT_VERSION: ${{ steps.current-version.outputs.version }}
+          RELEASE_TYPE: ${{ inputs.release_type }}
+          VERSION_BUMP: ${{ inputs.version_bump }}
         run: |
-          CURRENT_VERSION="${{ steps.query-version.outputs.current_version }}"
-          IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT_VERSION"
-
-          case "${{ github.event.inputs.version_bump }}" in
-            major)
-              MAJOR=$((MAJOR + 1))
-              MINOR=0
-              PATCH=0
-              ;;
-            minor)
-              MINOR=$((MINOR + 1))
-              PATCH=0
-              ;;
-            patch)
-              PATCH=$((PATCH + 1))
-              ;;
-          esac
-
-          NEW_VERSION="$MAJOR.$MINOR.$PATCH"
+          CURRENT_VERSION="${{ steps.current-version.outputs.version }}"
+          IFS='.' read -r MAJOR MINOR PATCH <<< "$(echo "$CURRENT_VERSION" | sed 's/-pre//')"
+
+          if [[ "$RELEASE_TYPE" == "release" && "$CURRENT_VERSION" =~ -pre$ ]]; then
+            NEW_VERSION="$MAJOR.$MINOR.$PATCH"
+          else
+            case "$VERSION_BUMP" in
+              major)
+                MAJOR=$((MAJOR + 1))
+                MINOR=0
+                PATCH=0
+                ;;
+              minor)
+                MINOR=$((MINOR + 1))
+                PATCH=0
+                ;;
+              patch)
+                PATCH=$((PATCH + 1))
+                ;;
+            esac
+            NEW_VERSION="$MAJOR.$MINOR.$PATCH"
+          fi
+
           echo "New version is $NEW_VERSION"
-          echo "::set-output name=new_version::$NEW_VERSION"
+          echo "new_version=$NEW_VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Update provider version in version.go
+        run: |
+          sed -i "s/ProviderVersion = \".*\"/ProviderVersion = \"$NEW_VERSION\"/" version/version.go
+
+      - name: Commit and push version update
+        run: |
+          git add version/version.go
+          git commit -m "Update provider version to $NEW_VERSION"
+          git push origin main
diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml
@@ -1,12 +1,10 @@
 name: Scan
 
 on:
-  workflow_dispatch:
-  push:
+  pull_request:
     branches:
       - "main"
-  pull_request_target:
-    types: [opened, synchronize]
+    types: [ opened, synchronize ]
 
 # TODO: see https://bitwarden.atlassian.net/l/cp/SLtTZJ90 for configuration tips
 jobs:

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -1,12 +1,10 @@
 name: Tests
 
 on:
-  workflow_dispatch:
-  push:
+  pull_request:
     branches:
       - "main"
-  pull_request_target:
-    types: [opened, synchronize]
+    types: [ opened, synchronize ]
 
 permissions:
   contents: read

diff --git a/version/version.go b/version/version.go
@@ -2,5 +2,5 @@ package version
 
 var (
 	// ProviderVersion is set during release.
-	ProviderVersion string = "1.2.8-pre"
+	ProviderVersion = "1.2.8-pre"
 )