CI: update workflows to use Azure Trusted Signing #34
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| id-token: write | |
| contents: read | |
| env: | |
| GO_VERSION: '1.23' | |
| jobs: | |
| build: | |
| name: Build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Build | |
| run: | | |
| go install github.com/tc-hib/go-winres@latest | |
| GIT_COMMIT=`git describe --always --dirty` | |
| HAS_TAGS=$(git tag -l | head -1) | |
| if [ -z ${HAS_TAGS} ] | |
| then | |
| LATEST_TAG=v0.0.0 | |
| NUM_COMMITS_FROM_TAG=$(git rev-list --all | wc -l) | |
| else | |
| LATEST_TAG=$(git describe --tags $(git rev-list --tags --max-count=1)) | |
| NUM_COMMITS_FROM_TAG=$(git rev-list ${LATEST_TAG}.. --count) | |
| fi | |
| VERSION=$(echo "${LATEST_TAG}" | awk -F. -v OFS=. '{$NF++;print}')-dev.${NUM_COMMITS_FROM_TAG} | |
| FILE_VERSION=${LATEST_TAG:1}.${NUM_COMMITS_FROM_TAG} | |
| mkdir bin | |
| go-winres simply --arch amd64 --product-version $VERSION-$GIT_COMMIT --file-version $FILE_VERSION --file-description "SFTPGo plugin auth" --product-name "SFTPGo plugin auth" --copyright "AGPL-3.0" --original-filename sftpgo-plugin-auth-windows-x86_64.exe --icon res/icon.ico | |
| CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -trimpath -ldflags "-s -w -X github.com/sftpgo/sftpgo-plugin-auth/cmd.commitHash=`git describe --always --dirty` -X github.com/sftpgo/sftpgo-plugin-auth/cmd.buildDate=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-auth-windows-x86_64.exe | |
| go-winres simply --arch arm64 --product-version $VERSION-$GIT_COMMIT --file-version $FILE_VERSION --file-description "SFTPGo plugin auth" --product-name "SFTPGo plugin auth" --copyright "AGPL-3.0" --original-filename sftpgo-plugin-auth-windows-arm64.exe --icon res/icon.ico | |
| CGO_ENABLED=0 GOOS=windows GOARCH=arm64 go build -trimpath -ldflags "-s -w -X github.com/sftpgo/sftpgo-plugin-auth/cmd.commitHash=`git describe --always --dirty` -X github.com/sftpgo/sftpgo-plugin-auth/cmd.buildDate=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-auth-windows-arm64.exe | |
| go-winres simply --arch 386 --product-version $VERSION-$GIT_COMMIT --file-version $FILE_VERSION --file-description "SFTPGo plugin auth" --product-name "SFTPGo plugin auth" --copyright "AGPL-3.0" --original-filename sftpgo-plugin-auth-windows-x86.exe --icon res/icon.ico | |
| CGO_ENABLED=0 GOOS=windows GOARCH=386 go build -trimpath -ldflags "-s -w -X github.com/sftpgo/sftpgo-plugin-auth/cmd.commitHash=`git describe --always --dirty` -X github.com/sftpgo/sftpgo-plugin-auth/cmd.buildDate=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-auth-windows-x86.exe | |
| CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags "-s -w -X github.com/sftpgo/sftpgo-plugin-auth/cmd.commitHash=`git describe --always --dirty` -X github.com/sftpgo/sftpgo-plugin-auth/cmd.buildDate=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-auth-linux-amd64 | |
| CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -trimpath -ldflags "-s -w -X github.com/sftpgo/sftpgo-plugin-auth/cmd.commitHash=`git describe --always --dirty` -X github.com/sftpgo/sftpgo-plugin-auth/cmd.buildDate=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-auth-linux-arm64 | |
| CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=7 go build -trimpath -ldflags "-s -w -X github.com/sftpgo/sftpgo-plugin-auth/cmd.commitHash=`git describe --always --dirty` -X github.com/sftpgo/sftpgo-plugin-auth/cmd.buildDate=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-auth-linux-armv7 | |
| CGO_ENABLED=0 GOOS=linux GOARCH=ppc64le go build -trimpath -ldflags "-s -w -X github.com/sftpgo/sftpgo-plugin-auth/cmd.commitHash=`git describe --always --dirty` -X github.com/sftpgo/sftpgo-plugin-auth/cmd.buildDate=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-auth-linux-ppc64le | |
| CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -trimpath -ldflags "-s -w -X github.com/sftpgo/sftpgo-plugin-auth/cmd.commitHash=`git describe --always --dirty` -X github.com/sftpgo/sftpgo-plugin-auth/cmd.buildDate=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-auth-darwin-amd64 | |
| CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build -trimpath -ldflags "-s -w -X github.com/sftpgo/sftpgo-plugin-auth/cmd.commitHash=`git describe --always --dirty` -X github.com/sftpgo/sftpgo-plugin-auth/cmd.buildDate=`date -u +%FT%TZ`" -o bin/sftpgo-plugin-auth-darwin-arm64 | |
| shell: bash | |
| - name: Upload build artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: sftpgo-plugin-auth | |
| path: bin | |
| sign-windows-binaries: | |
| name: Sign Windows binaries | |
| if: ${{ github.event_name != 'pull_request' }} | |
| environment: signing | |
| needs: [build] | |
| runs-on: windows-latest | |
| steps: | |
| - name: Download artifact | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: sftpgo-plugin-auth | |
| path: ${{ github.workspace }}/bin | |
| - name: Azure login | |
| uses: azure/login@v2 | |
| with: | |
| client-id: ${{ secrets.AZURE_CLIENT_ID }} | |
| tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
| subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | |
| - name: Sign | |
| uses: azure/trusted-signing-action@v0.5.0 | |
| with: | |
| endpoint: https://eus.codesigning.azure.net/ | |
| trusted-signing-account-name: nicola | |
| certificate-profile-name: SFTPGo | |
| files: | | |
| ${{ github.workspace }}\bin\sftpgo-plugin-auth-windows-x86_64.exe | |
| ${{ github.workspace }}\bin\sftpgo-plugin-auth-windows-arm64.exe | |
| ${{ github.workspace }}\bin\sftpgo-plugin-auth-windows-x86.exe | |
| file-digest: SHA256 | |
| timestamp-rfc3161: http://timestamp.acs.microsoft.com | |
| timestamp-digest: SHA256 | |
| exclude-environment-credential: true | |
| exclude-workload-identity-credential: true | |
| exclude-managed-identity-credential: true | |
| exclude-shared-token-cache-credential: true | |
| exclude-visual-studio-credential: true | |
| exclude-visual-studio-code-credential: true | |
| exclude-azure-cli-credential: false | |
| exclude-azure-powershell-credential: true | |
| exclude-azure-developer-cli-credential: true | |
| exclude-interactive-browser-credential: true | |
| - name: Upload build artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: sftpgo-plugin-auth | |
| path: bin | |
| overwrite: true | |
| test: | |
| name: Run test cases | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.23' | |
| - name: Run tests | |
| run: | | |
| #curl -L https://github.com/glauth/glauth/releases/latest/download/glauth-linux-amd64 --output "test/glauth-linux-amd64" | |
| curl -L https://github.com/glauth/glauth/releases/download/v2.3.0/glauth-linux-amd64 --output "test/glauth-linux-amd64" | |
| cd test && chmod 755 glauth-linux-amd64 && ./glauth-linux-amd64 -c glauth.cfg & | |
| sleep 5 | |
| go test -v -p 1 -timeout 5m ./... -covermode=atomic | |
| killall -TERM glauth-linux-amd64 || true | |
| golangci-lint: | |
| name: golangci-lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.23' | |
| - uses: actions/checkout@v4 | |
| - name: Run golangci-lint | |
| uses: golangci/golangci-lint-action@v6 | |
| with: | |
| version: latest |