action.yml

# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: MPL-2.0

name: Go Build
author: Release Engineering <team-rel-eng@hashicorp.com>
description: Define a reproducible build. Currently only supports Go builds.

inputs:

  product_name:
    description: >
      Used to calculate default `bin_name` and `zip_name`.
      Defaults to repository name.
    required: false

  product_version:
    description: >
      Full version of the product being built (including metadata).
    required: false

  product_version_meta:
    description: >
      The metadata field of the version.
    required: false

  go_version:
    description: Version of Go to use for this build.
    required: true

  os:
    description: >
      Target product operating system.
    required: true

  arch:
    description: >
      Target product architecture.
    required: true

  reproducible:
    description: >
      Assert that this build is reproducible.
      Options are `assert` (the default), `report`, or `nope`.
    required: false
    default: assert

  bin_name:
    description: >
      Name of the product binary generated.
      Defaults to `product_name` minus any `-enterprise` suffix.
    required: false

  zip_name:
    description: >
      Name of the product zip file.
      Defaults to `<product_name>_<product_version>_<os>_<arch>.zip`.
    required: false

  work_dir:
    description: >
      The working directory, to run the instructions in.
      Defaults to the current directory.
    required: false
    default: .

  instructions:
    description: >
      Build instructions to generate the binary.
      See [Build Instructions](#build-instructions) for more info.
    required: true

  debug:
    description: >
      Enable debug-level logging.
    required: false
    default: 0

runs:
  using: composite
  steps:

    # Setup Go for CLI compilation.
    - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
      with:
        go-version: 1.18
        cache: false

    - name: Action Setup
      shell: bash
      working-directory: ${{ github.action_path }}
      run: ./action-setup

    # Setup Go
    - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
      with:
        go-version: ${{ inputs.go_version }}
        cache: false


    # Read config.
    - name: Read config from inputs; export to GITHUB_ENV
      shell: bash
      working-directory: ${{ inputs.work_dir }}
      run: $RUN_CLI config -github
      env:
        PRODUCT_NAME: ${{ inputs.product_name }}
        PRODUCT_VERSION: ${{ inputs.product_version }}
        PRODUCT_VERSION_META: ${{ inputs.product_version_meta }}
        OS: ${{ inputs.os }}
        ARCH: ${{ inputs.arch }}
        REPRODUCIBLE: ${{ inputs.reproducible }}
        BIN_NAME: ${{ inputs.bin_name }}
        ZIP_NAME: ${{ inputs.zip_name }}
        INSTRUCTIONS: ${{ inputs.instructions }}
        DEBUG: ${{ inputs.debug }}

    # Primary Build
    - name: Run Primary Build
      shell: bash
      working-directory: ${{ inputs.work_dir }}
      run: $RUN_CLI build -clean -json

    # Upload Primary Build
    - name: Upload Primary Zip
      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
      with:
        name: ${{ env.ZIP_NAME }}
        path: ${{ env.ZIP_PATH_PRIMARY }}
        if-no-files-found: error

    # Local Verification Build
    - name: Run Local Verification Build
      if: inputs.reproducible == 'assert' || inputs.reproducible == 'report'
      shell: bash
      working-directory: ${{ inputs.work_dir }}
      run: $RUN_CLI build -clean -json -verification

    # Upload Local Verification Build
    - name: Upload Local Verification Zip
      if: inputs.reproducible == 'assert' || inputs.reproducible == 'report'
      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
      with:
        name: ${{ env.ZIP_NAME }}.local-verification-build.zip
        path: ${{ env.ZIP_PATH_VERIFICATION }}
        if-no-files-found: error

    # Assert Reproducibility
    - name: Assert Build Outputs Identical
      if: inputs.reproducible == 'assert'
      shell: bash
      working-directory: ${{ inputs.work_dir }}
      run: |
        # Verify
        mkdir -p "$(dirname "$VERIFICATION_RESULT")"
        $RUN_CLI verify \
          -verification-build-result "$VERIFICATION_BUILD_RESULT" \
          -json | tee > "$VERIFICATION_RESULT"

    # Report Reproducibility
    - name: Report Reproducibility Results
      if: inputs.reproducible == 'report'
      shell: bash
      working-directory: ${{ inputs.work_dir }}
      run: |
        # Verify
        mkdir -p "$(dirname "$VERIFICATION_RESULT")"
        $RUN_CLI verify \
          -verification-build-result "$VERIFICATION_BUILD_RESULT" \
          -json | tee > "$VERIFICATION_RESULT" || true

    # Upload Verification Result
    - name: Upload Verification Result
      if: inputs.reproducible == 'assert' || inputs.reproducible == 'report'
      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
      with:
        name: ${{ env.ZIP_NAME }}.verificationresult.json
        path: ${{ env.VERIFICATION_RESULT }}
        if-no-files-found: error