Use split and merge to build the binaries with

goreleaser-cross container and finish the release outside of it with normal goreleaser-pro.
smallstep · Dec 18, 2024 · 86e873a · 86e873a
1 parent fedb109
commit 86e873a
Show file tree

Hide file tree

Showing 2 changed files with 62 additions and 2 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -36,6 +36,8 @@ jobs:
           OUT=$?
           if [ $OUT -eq 0 ]; then IS_PRERELEASE=true; else IS_PRERELEASE=false; fi
           echo "IS_PRERELEASE=${IS_PRERELEASE}" >> "${GITHUB_OUTPUT}"
+          echo "IS_PRERELEASE=${IS_PRERELEASE}" >> "${GITHUB_ENV}"
+
       - name: Extract Tag Names
         id: extract-tag
         run: |
@@ -46,6 +48,7 @@ jobs:
           echo "DOCKER_TAGS_CLOUD=${{ env.DOCKER_IMAGE }}:${VERSION}-${CLOUD_TAG}" >> "${GITHUB_ENV}"
           echo "DOCKER_TAGS_DEBIAN=${{ env.DOCKER_IMAGE }}:${VERSION}-${DEBIAN_TAG}" >> "${GITHUB_ENV}"
           echo "DOCKER_TAGS_WOLFI=${{ env.DOCKER_IMAGE }}:${VERSION}-${WOLFI_TAG}" >> "${GITHUB_ENV}"
+
       - name: Add Latest Tag
         if: steps.is_prerelease.outputs.IS_PRERELEASE == 'false'
         run: |
@@ -54,6 +57,7 @@ jobs:
           echo "DOCKER_TAGS_CLOUD=${{ env.DOCKER_IMAGE }}:${CLOUD_TAG}" >> "${GITHUB_ENV}"
           echo "DOCKER_TAGS_DEBIAN=${{ env.DOCKER_IMAGE }}:${DEBIAN_TAG}" >> "${GITHUB_ENV}"
           echo "DOCKER_TAGS_WOLFI=${{ env.DOCKER_IMAGE }}:${WOLFI_TAG}" >> "${GITHUB_ENV}"
+
       - name: Create Release
         id: create_release
         uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974 # v2.1.0
@@ -69,17 +73,71 @@ jobs:
     name: Upload Assets to Github w/ goreleaser
     runs-on: ubuntu-latest
     needs: create_release
+    permissions:
+      id-token: write
+      contents: write
+      packages: write
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
+
       - name: setup release environment
         run: |-
+          # shellcheck disable=SC2129
           echo 'GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}' > .release-env
-      - name: release publish
+          echo 'GORELEASER_KEY=${{ secrets.GORELEASER_KEY }}' >>  .release-env
+
+      - name: Build binaries
         run: make release
 
+      - name: Authenticate to Google Cloud
+        if: ${{ needs.create_release.outputs.is_prerelease == 'false' }}
+        id: gcloud-auth
+        uses: google-github-actions/auth@v2
+        with:
+          token_format: access_token
+          workload_identity_provider: ${{ secrets.GOOGLE_CLOUD_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ secrets.GOOGLE_CLOUD_GITHUB_SERVICE_ACCOUNT }}
+
+      - name: Set up Google Cloud SDK
+        if: ${{ needs.create_release.outputs.is_prerelease == 'false' }}
+        uses: google-github-actions/setup-gcloud@v2
+        with:
+          project_id: ${{ secrets.GOOGLE_CLOUD_PACKAGES_PROJECT_ID }}
+
+      - name: Write GPG private key to file
+        if: ${{ needs.create_release.outputs.is_prerelease == 'false' }}
+        run: |
+          echo "${GPG_PRIVATE_KEY}" > "${GPG_PRIVATE_KEY_FILE}"
+        shell: bash
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+
+      - name: Get Release Date
+        id: release_date
+        run: |
+          RELEASE_DATE=$(date -u +"%y-%m-%d")
+          echo "RELEASE_DATE=${RELEASE_DATE}" >> "${GITHUB_ENV}"
+
+      - name: Run GoReleaser Pro
+        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
+        with:
+          distribution: goreleaser-pro
+          version: latest
+          args: continue --merge
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
+          AWS_S3_REGION: ${{ secrets.AWS_S3_REGION }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GORELEASER_PAT }}
+          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+          NFPM_PASSPHRASE: ${{ secrets.GPG_PRIVATE_KEY_PASSWORD }}
+          RELEASE_DATE: ${{ env.RELEASE_DATE }}
+          IS_PRERELEASE: ${{ needs.create_release.outputs.is_prerelease }}
+
   build_upload_docker:
     name: Build & Upload Docker Image
     needs: create_release

diff --git a/Makefile b/Makefile
@@ -116,6 +116,7 @@ govulncheck:
 release-dev:
 	$Q @docker run -it --rm --privileged -e CGO_ENABLED=1 \
 		-e GORELEASER_KEY=${GORELEASER_KEY} \
+		-e IS_PRERELEASE=true \
 		--entrypoint /bin/bash \
 		-v /var/run/docker.sock:/var/run/docker.sock \
 		-v `pwd`:/go/src/$(PKG) \
@@ -125,6 +126,7 @@ release-dev:
 release-dry-run:
 	$Q @docker run --rm --privileged -e CGO_ENABLED=1 \
 		-e GORELEASER_KEY=${GORELEASER_KEY} \
+		-e IS_PRERELEASE=true \
 		--entrypoint /go/src/$(PKG)/docker/build/entrypoint.sh \
 		-v /var/run/docker.sock:/var/run/docker.sock \
 		-v `pwd`:/go/src/$(PKG) \
@@ -144,7 +146,7 @@ release:
 		-v `pwd`:/go/src/$(PKG) \
 		-w /go/src/$(PKG) \
 		ghcr.io/goreleaser/goreleaser-cross-pro:${GOLANG_CROSS_VERSION} \
-		release --clean
+		release --clean --split
 
 .PHONY: release-dev release-dry-run release