Skip to content

Commit df3832a

Browse files
SBGoodsSBGoods
authored
Migrate to release process to CRT and Prepare for v2.3.5-alpha1 release (#412)
* Add `issues: write` permission to close associated GitHub milestone * Add CRT release configuration files * Update changelog for `2.3.5-alpha1` release * Rename artifacts file
1 parent 75e9ece commit df3832a

File tree

8 files changed

+319
-2
lines changed

8 files changed

+319
-2
lines changed

‎.changes/2.3.5-alpha1.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
## 2.3.5-alpha1 (April 28, 2025)
2+
3+
NOTES:
4+
5+
* all: This release is being used to test new build and release actions. ([#412](https://github.com/hashicorp/terraform-provider-external/issues/412))
6+

‎.github/workflows/build.yml

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
# This workflow builds the product for all supported platforms and uploads the resulting
2+
# binaries as Actions artifacts. The workflow also uploads a build metadata file
3+
# (metadata.json) -- and a Terraform Registry manifest file (terraform-registry-manifest.json).
4+
#
5+
# Reference: https://github.com/hashicorp/terraform-provider-crt-example/blob/main/.github/workflows/README.md
6+
7+
name: build
8+
9+
# We default to running this workflow on every push to every branch.
10+
# This provides fast feedback when build issues occur, so they can be
11+
# fixed prior to being merged to the main branch.
12+
#
13+
# If you want to opt out of this, and only run the build on certain branches
14+
# please refer to the documentation on branch filtering here:
15+
#
16+
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onpushbranchestagsbranches-ignoretags-ignore
17+
#
18+
on: [workflow_dispatch, push]
19+
20+
env:
21+
PKG_NAME: "terraform-provider-external"
22+
23+
jobs:
24+
# Detects the Go toolchain version to use for product builds.
25+
#
26+
# The implementation is inspired by envconsul -- https://go.hashi.co/get-go-version-example
27+
get-go-version:
28+
name: "Detect Go toolchain version"
29+
runs-on: ubuntu-latest
30+
outputs:
31+
go-version: ${{ steps.get-go-version.outputs.go-version }}
32+
steps:
33+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
34+
- uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
35+
with:
36+
go-version-file: 'go.mod'
37+
- name: Detect Go version
38+
id: get-go-version
39+
run: |
40+
version="$(go list -f {{.GoVersion}} -m)"
41+
echo "go-version=$version" >> "$GITHUB_OUTPUT"
42+
43+
# Parses the version/VERSION file. Reference: https://github.com/hashicorp/actions-set-product-version/blob/main/README.md
44+
#
45+
# > This action should be implemented in product repo `build.yml` files. The action is intended to grab the version
46+
# > from the version file at the beginning of the build, then passes those versions (along with metadata, where
47+
# > necessary) to any workflow jobs that need version information.
48+
set-product-version:
49+
name: "Parse version file"
50+
runs-on: ubuntu-latest
51+
outputs:
52+
product-version: ${{ steps.set-product-version.outputs.product-version }}
53+
product-base-version: ${{ steps.set-product-version.outputs.base-product-version }}
54+
product-prerelease-version: ${{ steps.set-product-version.outputs.prerelease-product-version }}
55+
product-minor-version: ${{ steps.set-product-version.outputs.minor-product-version }}
56+
steps:
57+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
58+
- name: Set variables
59+
id: set-product-version
60+
uses: hashicorp/actions-set-product-version@v2
61+
62+
# Creates metadata.json file containing build metadata for consumption by CRT workflows.
63+
#
64+
# Reference: https://github.com/hashicorp/actions-generate-metadata/blob/main/README.md
65+
generate-metadata-file:
66+
needs: set-product-version
67+
runs-on: ubuntu-latest
68+
outputs:
69+
filepath: ${{ steps.generate-metadata-file.outputs.filepath }}
70+
steps:
71+
- name: "Checkout directory"
72+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
73+
- name: Generate metadata file
74+
id: generate-metadata-file
75+
uses: hashicorp/actions-generate-metadata@v1
76+
with:
77+
version: ${{ needs.set-product-version.outputs.product-version }}
78+
product: ${{ env.PKG_NAME }}
79+
repositoryOwner: "hashicorp"
80+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
81+
with:
82+
name: metadata.json
83+
path: ${{ steps.generate-metadata-file.outputs.filepath }}
84+
85+
# Uploads an Actions artifact named terraform-registry-manifest.json.zip.
86+
#
87+
# The artifact contains a single file with a filename that Terraform Registry expects
88+
# (example: terraform-provider-crt-example_2.3.6-alpha1_manifest.json). The file contents
89+
# are identical to the terraform-registry-manifest.json file in the source repository.
90+
upload-terraform-registry-manifest-artifact:
91+
needs: set-product-version
92+
runs-on: ubuntu-latest
93+
steps:
94+
- name: "Checkout directory"
95+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
96+
with:
97+
path: ${{ env.PKG_NAME }}
98+
- name: "Copy manifest from checkout directory to a file with the desired name"
99+
id: terraform-registry-manifest
100+
run: |
101+
name="${{ env.PKG_NAME }}"
102+
version="${{ needs.set-product-version.outputs.product-version }}"
103+
104+
source="${name}/terraform-registry-manifest.json"
105+
destination="${name}_${version}_manifest.json"
106+
107+
cp "$source" "$destination"
108+
echo "filename=$destination" >> "$GITHUB_OUTPUT"
109+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
110+
with:
111+
name: terraform-registry-manifest.json
112+
path: ${{ steps.terraform-registry-manifest.outputs.filename }}
113+
if-no-files-found: error
114+
115+
# Builds the product for all platforms except macOS.
116+
#
117+
# With `reproducible: report`, this job also reports whether the build is reproducible,
118+
# but does not enforce it.
119+
#
120+
# Reference: https://github.com/hashicorp/actions-go-build/blob/main/README.md
121+
build:
122+
needs:
123+
- get-go-version
124+
- set-product-version
125+
runs-on: ubuntu-latest
126+
strategy:
127+
fail-fast: true
128+
# Verify expected Artifacts list for a workflow run.
129+
matrix:
130+
goos: [freebsd, windows, linux, darwin]
131+
goarch: ["386", "amd64", "arm", "arm64"]
132+
exclude:
133+
- goos: freebsd
134+
goarch: arm64
135+
- goos: windows
136+
goarch: arm64
137+
- goos: windows
138+
goarch: arm
139+
- goos: darwin
140+
goarch: 386
141+
- goos: darwin
142+
goarch: arm
143+
144+
name: Go ${{ needs.get-go-version.outputs.go-version }} ${{ matrix.goos }} ${{ matrix.goarch }} build
145+
steps:
146+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
147+
- uses: hashicorp/actions-go-build@v1
148+
env:
149+
CGO_ENABLED: 0
150+
BASE_VERSION: ${{ needs.set-product-version.outputs.product-base-version }}
151+
PRERELEASE_VERSION: ${{ needs.set-product-version.outputs.product-prerelease-version}}
152+
METADATA_VERSION: ${{ env.METADATA }}
153+
with:
154+
bin_name: "${{ env.PKG_NAME }}_v${{ needs.set-product-version.outputs.product-version }}_x5"
155+
product_name: ${{ env.PKG_NAME }}
156+
product_version: ${{ needs.set-product-version.outputs.product-version }}
157+
go_version: ${{ needs.get-go-version.outputs.go-version }}
158+
os: ${{ matrix.goos }}
159+
arch: ${{ matrix.goarch }}
160+
reproducible: report
161+
instructions: |
162+
go build \
163+
-o "$BIN_PATH" \
164+
-trimpath \
165+
-buildvcs=false \
166+
-ldflags "-s -w"
167+
cp LICENSE "$TARGET_DIR/LICENSE.txt"
168+
169+
whats-next:
170+
needs:
171+
- build
172+
- generate-metadata-file
173+
- upload-terraform-registry-manifest-artifact
174+
runs-on: ubuntu-latest
175+
name: "What's next?"
176+
steps:
177+
- name: "Write a helpful summary"
178+
run: |
179+
github_dot_com="${{ github.server_url }}"
180+
owner_with_name="${{ github.repository }}"
181+
ref="${{ github.ref }}"
182+
183+
echo "### What's next?" >> "$GITHUB_STEP_SUMMARY"
184+
echo "#### For a release branch (see \`.release/ci.hcl\`)" >> $GITHUB_STEP_SUMMARY
185+
echo "After this \`build\` workflow run completes succesfully, you can expect the CRT \`prepare\` workflow to begin momentarily." >> "$GITHUB_STEP_SUMMARY"
186+
echo "To find the \`prepare\` workflow run, [view the checks for this commit]($github_dot_com/$owner_with_name/commits/$ref)" >> "$GITHUB_STEP_SUMMARY"

‎.release/ci.hcl

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
# Reference: https://github.com/hashicorp/crt-core-helloworld/blob/main/.release/ci.hcl (private repository)
2+
3+
schema = "2"
4+
5+
project "terraform-provider-external" {
6+
// team is currently unused and has no meaning
7+
// but is required to be non-empty by CRT orchestator
8+
team = "_UNUSED_"
9+
10+
slack {
11+
notification_channel = "C02BASDVCDT" // #feed-terraform-sdk
12+
}
13+
14+
github {
15+
organization = "hashicorp"
16+
repository = "terraform-provider-external"
17+
release_branches = ["main", "release/**"]
18+
}
19+
}
20+
21+
event "merge" {
22+
}
23+
24+
event "build" {
25+
action "build" {
26+
depends = ["merge"]
27+
28+
organization = "hashicorp"
29+
repository = "terraform-provider-external"
30+
workflow = "build"
31+
}
32+
}
33+
34+
event "prepare" {
35+
# `prepare` is the Common Release Tooling (CRT) artifact processing workflow.
36+
# It prepares artifacts for potential promotion to staging and production.
37+
# For example, it scans and signs artifacts.
38+
39+
depends = ["build"]
40+
41+
action "prepare" {
42+
organization = "hashicorp"
43+
repository = "crt-workflows-common"
44+
workflow = "prepare"
45+
depends = ["build"]
46+
}
47+
48+
notification {
49+
on = "fail"
50+
}
51+
}
52+
53+
event "trigger-staging" {
54+
}
55+
56+
event "promote-staging" {
57+
action "promote-staging" {
58+
organization = "hashicorp"
59+
repository = "crt-workflows-common"
60+
workflow = "promote-staging"
61+
depends = null
62+
config = "release-metadata.hcl"
63+
}
64+
65+
depends = ["trigger-staging"]
66+
67+
notification {
68+
on = "always"
69+
}
70+
}
71+
72+
event "trigger-production" {
73+
}
74+
75+
event "promote-production" {
76+
action "promote-production" {
77+
organization = "hashicorp"
78+
repository = "crt-workflows-common"
79+
workflow = "promote-production"
80+
depends = null
81+
config = ""
82+
}
83+
84+
depends = ["trigger-production"]
85+
86+
notification {
87+
on = "always"
88+
}
89+
}

‎.release/release-metadata.hcl

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
1-
url_source_repository = "https://github.com/hashicorp/terraform-provider-external"
2-
url_license = "https://github.com/hashicorp/terraform-provider-external/blob/main/LICENSE"
1+
url_source_repository = "https://github.com/hashicorp/terraform-provider-external"
2+
url_project_website = "https://registry.terraform.io/providers/hashicorp/external"
3+
url_license = "https://github.com/hashicorp/terraform-provider-external/blob/main/LICENSE"
4+
url_release_notes = "https://github.com/hashicorp/terraform-provider-external/blob/main/CHANGELOG.md"

‎.release/security-scan.hcl

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Reference: https://github.com/hashicorp/security-scanner/blob/main/CONFIG.md#binary (private repository)
2+
3+
binary {
4+
secrets {
5+
all = true
6+
}
7+
go_modules = true
8+
osv = true
9+
oss_index = false
10+
nvd = false
11+
}

‎.release/terraform-provider-external-artifacts.hcl

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
schema = 1
2+
artifacts {
3+
zip = [
4+
"terraform-provider-external_${version}_darwin_amd64.zip",
5+
"terraform-provider-external_${version}_darwin_arm64.zip",
6+
"terraform-provider-external_${version}_freebsd_386.zip",
7+
"terraform-provider-external_${version}_freebsd_amd64.zip",
8+
"terraform-provider-external_${version}_freebsd_arm.zip",
9+
"terraform-provider-external_${version}_linux_386.zip",
10+
"terraform-provider-external_${version}_linux_amd64.zip",
11+
"terraform-provider-external_${version}_linux_arm.zip",
12+
"terraform-provider-external_${version}_linux_arm64.zip",
13+
"terraform-provider-external_${version}_windows_386.zip",
14+
"terraform-provider-external_${version}_windows_amd64.zip",
15+
]
16+
}

‎CHANGELOG.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
## 2.3.5-alpha1 (April 28, 2025)
2+
3+
NOTES:
4+
5+
* all: This release is being used to test new build and release actions. ([#412](https://github.com/hashicorp/terraform-provider-external/issues/412))
6+
17
## 2.3.4 (September 10, 2024)
28

39
NOTES:

‎version/VERSION

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2.3.5-alpha1

0 commit comments

Comments
 (0)