diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml index c097596..4298747 100644 --- a/.github/workflows/prerelease.yml +++ b/.github/workflows/prerelease.yml @@ -6,6 +6,13 @@ on: tags: - v*.*.*-** env: + AZURE_SIGNING_CLIENT_ID: ${{ secrets.AZURE_SIGNING_CLIENT_ID }} + AZURE_SIGNING_CLIENT_SECRET: ${{ secrets.AZURE_SIGNING_CLIENT_SECRET }} + AZURE_SIGNING_TENANT_ID: ${{ secrets.AZURE_SIGNING_TENANT_ID }} + AZURE_SIGNING_KEY_VAULT_URI: ${{ secrets.AZURE_SIGNING_KEY_VAULT_URI }} + SKIP_SIGNING: ${{ secrets.AZURE_SIGNING_CLIENT_ID == '' && + secrets.AZURE_SIGNING_CLIENT_SECRET == '' && secrets.AZURE_SIGNING_TENANT_ID + == '' && secrets.AZURE_SIGNING_KEY_VAULT_URI == '' }} GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }} PROVIDER: docker-build PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }} @@ -58,7 +65,7 @@ jobs: lfs: true - id: version name: Set Provider Version - uses: pulumi/provider-version-action@0391d47b9b0d865d33dd0a295b1fcf9f7021dd4c # v1.5.3 + uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0 with: set-env: PROVIDER_VERSION - name: Install Go @@ -71,7 +78,7 @@ jobs: with: repo: pulumi/pulumictl - name: Install Pulumi CLI - uses: pulumi/actions@c7fad9e2f0b79653172b36538b8b34b3c0291952 # v6.0.0 + uses: pulumi/actions@13b8b7177d6fb736766875dac9b78aab07bd785f # v6.0.1 - if: github.event_name == 'pull_request' name: Install Schema Tools uses: jaxxstorm/action-install-gh-release@cd6b2b78ad38bdd294341cda064ec0692b06215b # v1.14.0 @@ -166,7 +173,7 @@ jobs: github.workspace}}/bin/ pulumi-resource-${{ env.PROVIDER }} pulumi-gen-${{ env.PROVIDER}} - name: Upload artifacts - uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0 + uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 with: name: pulumi-${{ env.PROVIDER }}-provider.tar.gz path: ${{ github.workspace }}/bin/provider.tar.gz @@ -203,7 +210,7 @@ jobs: lfs: true - id: version name: Set Provider Version - uses: pulumi/provider-version-action@0391d47b9b0d865d33dd0a295b1fcf9f7021dd4c # v1.5.3 + uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0 with: set-env: PROVIDER_VERSION - name: Install Go @@ -216,7 +223,7 @@ jobs: with: repo: pulumi/pulumictl - name: Install Pulumi CLI - uses: pulumi/actions@c7fad9e2f0b79653172b36538b8b34b3c0291952 # v6.0.0 + uses: pulumi/actions@13b8b7177d6fb736766875dac9b78aab07bd785f # v6.0.1 - name: Setup Node uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0 with: @@ -310,7 +317,7 @@ jobs: - name: Tar SDK folder run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} . - name: Upload artifacts - uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0 + uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 with: name: ${{ matrix.language }}-sdk.tar.gz path: ${{ github.workspace}}/sdk/${{ matrix.language }}.tar.gz @@ -345,7 +352,7 @@ jobs: lfs: true - id: version name: Set Provider Version - uses: pulumi/provider-version-action@0391d47b9b0d865d33dd0a295b1fcf9f7021dd4c # v1.5.3 + uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0 with: set-env: PROVIDER_VERSION - name: Install Go @@ -358,7 +365,7 @@ jobs: with: repo: pulumi/pulumictl - name: Install Pulumi CLI - uses: pulumi/actions@c7fad9e2f0b79653172b36538b8b34b3c0291952 # v6.0.0 + uses: pulumi/actions@13b8b7177d6fb736766875dac9b78aab07bd785f # v6.0.1 - name: Setup Node uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0 with: @@ -461,7 +468,7 @@ jobs: lfs: true - id: version name: Set Provider Version - uses: pulumi/provider-version-action@0391d47b9b0d865d33dd0a295b1fcf9f7021dd4c # v1.5.3 + uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0 with: set-env: PROVIDER_VERSION - name: Install Go @@ -483,7 +490,7 @@ jobs: with: repo: pulumi/pulumictl - name: Install Pulumi CLI - uses: pulumi/actions@c7fad9e2f0b79653172b36538b8b34b3c0291952 # v6.0.0 + uses: pulumi/actions@13b8b7177d6fb736766875dac9b78aab07bd785f # v6.0.1 - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2 with: @@ -519,7 +526,7 @@ jobs: lfs: true - id: version name: Set Provider Version - uses: pulumi/provider-version-action@0391d47b9b0d865d33dd0a295b1fcf9f7021dd4c # v1.5.3 + uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0 with: set-env: PROVIDER_VERSION - name: Checkout Scripts Repo @@ -538,7 +545,7 @@ jobs: with: repo: pulumi/pulumictl - name: Install Pulumi CLI - uses: pulumi/actions@c7fad9e2f0b79653172b36538b8b34b3c0291952 # v6.0.0 + uses: pulumi/actions@13b8b7177d6fb736766875dac9b78aab07bd785f # v6.0.1 - name: Setup Node uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0 with: @@ -602,7 +609,7 @@ jobs: lfs: true - id: version name: Set Provider Version - uses: pulumi/provider-version-action@0391d47b9b0d865d33dd0a295b1fcf9f7021dd4c # v1.5.3 + uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0 with: set-env: PROVIDER_VERSION - name: Install Go @@ -615,7 +622,7 @@ jobs: with: repo: pulumi/pulumictl - name: Install Pulumi CLI - uses: pulumi/actions@c7fad9e2f0b79653172b36538b8b34b3c0291952 # v6.0.0 + uses: pulumi/actions@13b8b7177d6fb736766875dac9b78aab07bd785f # v6.0.1 - name: Setup Java uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0 with: @@ -653,7 +660,7 @@ jobs: lfs: true - id: version name: Set Provider Version - uses: pulumi/provider-version-action@0391d47b9b0d865d33dd0a295b1fcf9f7021dd4c # v1.5.3 + uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0 with: set-env: PROVIDER_VERSION - name: Download go SDK diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b65b2f4..79f1887 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,6 +7,13 @@ on: - v*.*.* - "!v*.*.*-**" env: + AZURE_SIGNING_CLIENT_ID: ${{ secrets.AZURE_SIGNING_CLIENT_ID }} + AZURE_SIGNING_CLIENT_SECRET: ${{ secrets.AZURE_SIGNING_CLIENT_SECRET }} + AZURE_SIGNING_TENANT_ID: ${{ secrets.AZURE_SIGNING_TENANT_ID }} + AZURE_SIGNING_KEY_VAULT_URI: ${{ secrets.AZURE_SIGNING_KEY_VAULT_URI }} + SKIP_SIGNING: ${{ secrets.AZURE_SIGNING_CLIENT_ID == '' && + secrets.AZURE_SIGNING_CLIENT_SECRET == '' && secrets.AZURE_SIGNING_TENANT_ID + == '' && secrets.AZURE_SIGNING_KEY_VAULT_URI == '' }} GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }} PROVIDER: docker-build PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }} @@ -58,7 +65,7 @@ jobs: lfs: true - id: version name: Set Provider Version - uses: pulumi/provider-version-action@0391d47b9b0d865d33dd0a295b1fcf9f7021dd4c # v1.5.3 + uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0 with: set-env: PROVIDER_VERSION - name: Install Go @@ -71,7 +78,7 @@ jobs: with: repo: pulumi/pulumictl - name: Install Pulumi CLI - uses: pulumi/actions@c7fad9e2f0b79653172b36538b8b34b3c0291952 # v6.0.0 + uses: pulumi/actions@13b8b7177d6fb736766875dac9b78aab07bd785f # v6.0.1 - if: github.event_name == 'pull_request' name: Install Schema Tools uses: jaxxstorm/action-install-gh-release@cd6b2b78ad38bdd294341cda064ec0692b06215b # v1.14.0 @@ -166,7 +173,7 @@ jobs: github.workspace}}/bin/ pulumi-resource-${{ env.PROVIDER }} pulumi-gen-${{ env.PROVIDER}} - name: Upload artifacts - uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0 + uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 with: name: pulumi-${{ env.PROVIDER }}-provider.tar.gz path: ${{ github.workspace }}/bin/provider.tar.gz @@ -203,7 +210,7 @@ jobs: lfs: true - id: version name: Set Provider Version - uses: pulumi/provider-version-action@0391d47b9b0d865d33dd0a295b1fcf9f7021dd4c # v1.5.3 + uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0 with: set-env: PROVIDER_VERSION - name: Install Go @@ -216,7 +223,7 @@ jobs: with: repo: pulumi/pulumictl - name: Install Pulumi CLI - uses: pulumi/actions@c7fad9e2f0b79653172b36538b8b34b3c0291952 # v6.0.0 + uses: pulumi/actions@13b8b7177d6fb736766875dac9b78aab07bd785f # v6.0.1 - name: Setup Node uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0 with: @@ -310,7 +317,7 @@ jobs: - name: Tar SDK folder run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} . - name: Upload artifacts - uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0 + uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0 with: name: ${{ matrix.language }}-sdk.tar.gz path: ${{ github.workspace}}/sdk/${{ matrix.language }}.tar.gz @@ -345,7 +352,7 @@ jobs: lfs: true - id: version name: Set Provider Version - uses: pulumi/provider-version-action@0391d47b9b0d865d33dd0a295b1fcf9f7021dd4c # v1.5.3 + uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0 with: set-env: PROVIDER_VERSION - name: Install Go @@ -358,7 +365,7 @@ jobs: with: repo: pulumi/pulumictl - name: Install Pulumi CLI - uses: pulumi/actions@c7fad9e2f0b79653172b36538b8b34b3c0291952 # v6.0.0 + uses: pulumi/actions@13b8b7177d6fb736766875dac9b78aab07bd785f # v6.0.1 - name: Setup Node uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0 with: @@ -461,7 +468,7 @@ jobs: lfs: true - id: version name: Set Provider Version - uses: pulumi/provider-version-action@0391d47b9b0d865d33dd0a295b1fcf9f7021dd4c # v1.5.3 + uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0 with: set-env: PROVIDER_VERSION - name: Install Go @@ -483,7 +490,7 @@ jobs: with: repo: pulumi/pulumictl - name: Install Pulumi CLI - uses: pulumi/actions@c7fad9e2f0b79653172b36538b8b34b3c0291952 # v6.0.0 + uses: pulumi/actions@13b8b7177d6fb736766875dac9b78aab07bd785f # v6.0.1 - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2 with: @@ -519,7 +526,7 @@ jobs: lfs: true - id: version name: Set Provider Version - uses: pulumi/provider-version-action@0391d47b9b0d865d33dd0a295b1fcf9f7021dd4c # v1.5.3 + uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0 with: set-env: PROVIDER_VERSION - name: Checkout Scripts Repo @@ -538,7 +545,7 @@ jobs: with: repo: pulumi/pulumictl - name: Install Pulumi CLI - uses: pulumi/actions@c7fad9e2f0b79653172b36538b8b34b3c0291952 # v6.0.0 + uses: pulumi/actions@13b8b7177d6fb736766875dac9b78aab07bd785f # v6.0.1 - name: Setup Node uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0 with: @@ -602,7 +609,7 @@ jobs: lfs: true - id: version name: Set Provider Version - uses: pulumi/provider-version-action@0391d47b9b0d865d33dd0a295b1fcf9f7021dd4c # v1.5.3 + uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0 with: set-env: PROVIDER_VERSION - name: Install Go @@ -615,7 +622,7 @@ jobs: with: repo: pulumi/pulumictl - name: Install Pulumi CLI - uses: pulumi/actions@c7fad9e2f0b79653172b36538b8b34b3c0291952 # v6.0.0 + uses: pulumi/actions@13b8b7177d6fb736766875dac9b78aab07bd785f # v6.0.1 - name: Setup Java uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0 with: @@ -653,7 +660,7 @@ jobs: lfs: true - id: version name: Set Provider Version - uses: pulumi/provider-version-action@0391d47b9b0d865d33dd0a295b1fcf9f7021dd4c # v1.5.3 + uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0 with: set-env: PROVIDER_VERSION - name: Download go SDK diff --git a/.goreleaser.prerelease.yml b/.goreleaser.prerelease.yml index 4f379aa..6b465a7 100644 --- a/.goreleaser.prerelease.yml +++ b/.goreleaser.prerelease.yml @@ -2,26 +2,43 @@ project_name: pulumi-docker-build builds: -- dir: provider +- id: build-provider + dir: provider env: - CGO_ENABLED=0 - GO111MODULE=on goos: - darwin - - windows - linux goarch: - amd64 - arm64 - ignore: [] + ignore: &a1 [] + main: ./cmd/pulumi-resource-docker-build/ + ldflags: &a2 + - -s + - -w + - -X + github.com/pulumi/pulumi-docker-build/provider/pkg/version.Version={{.Tag}} + - -X github.com/pulumi/pulumi-docker-build/provider.Version={{.Tag}} + binary: pulumi-resource-docker-build +- id: build-provider-sign-windows + dir: provider + env: + - CGO_ENABLED=0 + - GO111MODULE=on + goos: + - windows + goarch: + - amd64 + - arm64 + ignore: *a1 main: ./cmd/pulumi-resource-docker-build/ - ldflags: - - -s - - -w - - -X - github.com/pulumi/pulumi-docker-build/provider/pkg/version.Version={{.Tag}} - - -X github.com/pulumi/pulumi-docker-build/provider.Version={{.Tag}} + ldflags: *a2 binary: pulumi-resource-docker-build + hooks: + post: + - make sign-goreleaser-exe-{{ .Arch }} archives: - name_template: "{{ .Binary }}-{{ .Tag }}-{{ .Os }}-{{ .Arch }}" id: archive diff --git a/.goreleaser.yml b/.goreleaser.yml index 3a17383..2ae51d6 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -2,26 +2,43 @@ project_name: pulumi-docker-build builds: -- dir: provider +- id: build-provider + dir: provider env: - CGO_ENABLED=0 - GO111MODULE=on goos: - darwin - - windows - linux goarch: - amd64 - arm64 - ignore: [] + ignore: &a1 [] + main: ./cmd/pulumi-resource-docker-build/ + ldflags: &a2 + - -s + - -w + - -X + github.com/pulumi/pulumi-docker-build/provider/pkg/version.Version={{.Tag}} + - -X github.com/pulumi/pulumi-docker-build/provider.Version={{.Tag}} + binary: pulumi-resource-docker-build +- id: build-provider-sign-windows + dir: provider + env: + - CGO_ENABLED=0 + - GO111MODULE=on + goos: + - windows + goarch: + - amd64 + - arm64 + ignore: *a1 main: ./cmd/pulumi-resource-docker-build/ - ldflags: - - -s - - -w - - -X - github.com/pulumi/pulumi-docker-build/provider/pkg/version.Version={{.Tag}} - - -X github.com/pulumi/pulumi-docker-build/provider.Version={{.Tag}} + ldflags: *a2 binary: pulumi-resource-docker-build + hooks: + post: + - make sign-goreleaser-exe-{{ .Arch }} archives: - name_template: "{{ .Binary }}-{{ .Tag }}-{{ .Os }}-{{ .Arch }}" id: archive diff --git a/Makefile b/Makefile index e771cf2..37a91cb 100644 --- a/Makefile +++ b/Makefile @@ -259,3 +259,48 @@ sdk/java: $(PULUMI) bin/${PROVIDER} docs: $(shell find docs/yaml -type f) $(shell find ./provider/internal/embed -name '*.md') ${SCHEMA_PATH} go generate docs/generate.go @touch docs + +# Set these variables to enable signing of the windows binary +AZURE_SIGNING_CLIENT_ID ?= +AZURE_SIGNING_CLIENT_SECRET ?= +AZURE_SIGNING_TENANT_ID ?= +AZURE_SIGNING_KEY_VAULT_URI ?= +SKIP_SIGNING ?= + +bin/jsign-6.0.jar: + wget https://github.com/ebourg/jsign/releases/download/6.0/jsign-6.0.jar --output-document=bin/jsign-6.0.jar + +sign-goreleaser-exe-amd64: GORELEASER_ARCH := amd64_v1 +sign-goreleaser-exe-arm64: GORELEASER_ARCH := arm64 + +# Set the shell to bash to allow for the use of bash syntax. +sign-goreleaser-exe-%: SHELL:=/bin/bash +sign-goreleaser-exe-%: bin/jsign-6.0.jar + @# Only sign windows binary if fully configured. + @# Test variables set by joining with | between and looking for || showing at least one variable is empty. + @# Move the binary to a temporary location and sign it there to avoid the target being up-to-date if signing fails. + @set -e; \ + if [[ "${SKIP_SIGNING}" != "true" ]]; then \ + if [[ "|${AZURE_SIGNING_CLIENT_ID}|${AZURE_SIGNING_CLIENT_SECRET}|${AZURE_SIGNING_TENANT_ID}|${AZURE_SIGNING_KEY_VAULT_URI}|" == *"||"* ]]; then \ + echo "Can't sign windows binaries as required configuration not set: AZURE_SIGNING_CLIENT_ID, AZURE_SIGNING_CLIENT_SECRET, AZURE_SIGNING_TENANT_ID, AZURE_SIGNING_KEY_VAULT_URI"; \ + echo "To rebuild with signing delete the unsigned windows exe file and rebuild with the fixed configuration"; \ + if [[ "${CI}" == "true" ]]; then exit 1; fi; \ + else \ + file=dist/build-provider-sign-windows_windows_${GORELEASER_ARCH}/pulumi-resource-docker-build.exe; \ + mv $${file} $${file}.unsigned; \ + az login --service-principal \ + --username "${AZURE_SIGNING_CLIENT_ID}" \ + --password "${AZURE_SIGNING_CLIENT_SECRET}" \ + --tenant "${AZURE_SIGNING_TENANT_ID}" \ + --output none; \ + ACCESS_TOKEN=$$(az account get-access-token --resource "https://vault.azure.net" | jq -r .accessToken); \ + java -jar bin/jsign-6.0.jar \ + --storetype AZUREKEYVAULT \ + --keystore "PulumiCodeSigning" \ + --url "${AZURE_SIGNING_KEY_VAULT_URI}" \ + --storepass "$${ACCESS_TOKEN}" \ + $${file}.unsigned; \ + mv $${file}.unsigned $${file}; \ + az logout; \ + fi; \ + fi