Terramaid/.github/workflows/build.yaml at d6d8432ab307b561c0bf5525e5cceceee890b581 · RoseSecurity/Terramaid · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
name: "Build CLI and Attach to GitHub Release"

on:
  release:
    types: [published]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

permissions:
  contents: write

jobs:
  build:
    name: "Build CLI and Attach to GitHub Release"
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      # Setup Go
      - name: "Setup Go"
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: "go.mod"

      # Print Go version
      - run: go version

      # Build and release
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
        with:
          version: latest
          args: release --parallelism 2 --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}

      - name: Get Debian Package Names
        id: deb_package
        run: |
          echo "ARM_PACKAGE=$(find dist/ -name '*arm64.deb' | head -n 1)" >> $GITHUB_ENV
          echo "AMD_PACKAGE=$(find dist/ -name '*amd64.deb' | head -n 1)" >> $GITHUB_ENV

      # Push the Debian package to Cloudsmith
      - name: Push Debian ARM package to Cloudsmith
        id: push_arm
        uses: cloudsmith-io/action@7af394e0f8add4867bce109385962dafecad1b8d # v0.6.14
        with:
          api-key: ${{ secrets.CLOUDSMITH_API_KEY }}
          command: "push"
          format: "deb"
          owner: "rosesecurity"
          repo: "terramaid"
          distro: "any-distro"
          release: "any-version"
          file: ${{ env.ARM_PACKAGE }}

      - name: Push Debian AMD package to Cloudsmith
        id: push_amd
        uses: cloudsmith-io/action@7af394e0f8add4867bce109385962dafecad1b8d # v0.6.14
        with:
          api-key: ${{ secrets.CLOUDSMITH_API_KEY }}
          command: "push"
          format: "deb"
          owner: "rosesecurity"
          repo: "terramaid"
          distro: "any-distro"
          release: "any-version"
          file: ${{ env.AMD_PACKAGE }}

  docker:
    name: "Build and Push Docker Image"
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Get version number
        id: version
        run: |
          version=$(echo "${{ github.ref }}" | awk -F"/" '{print $NF}' )
          echo "version=$version" >> $GITHUB_OUTPUT

      - name: Set up QEMU
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Login to Docker Hub
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          platforms: linux/amd64,linux/arm64
          push: true
          tags: rosesecurity/terramaid:${{ steps.version.outputs.version }}

  homebrew:
    name: "Bump Homebrew Formula"
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - uses: mislav/bump-homebrew-formula-action@ccf2332299a883f6af50a1d2d41e5df7904dd769 # v4.1
        with:
          # A PR will be sent to github.com/Homebrew/homebrew-core to update this formula:
          formula-name: terramaid
          formula-path: Formula/t/terramaid.rb
        env:
          COMMITTER_TOKEN: ${{ secrets.COMMITTER_TOKEN }}