build.yml

name: build

# We now default to running this workflow on every push to every branch.
# This provides fast feedback when build issues occur, so they can be
# fixed prior to being merged to the main branch.
#
# If you want to opt out of this, and only run the build on certain branches
# please refer to the documentation on branch filtering here:
#
#   https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onpushbranchestagsbranches-ignoretags-ignore
#
on:
  workflow_dispatch:
  push:
    branches:
      - main
      - release/**

env:
  PKG_NAME: "tfctl"

jobs:
  get-go-version:
    name: "Determine Go toolchain version"
    runs-on: ubuntu-latest
    outputs:
      go-version: ${{ steps.get-go-version.outputs.go-version }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Determine Go version
        id: get-go-version
        # We use .go-version as our source of truth for current Go
        # version, because "goenv" can react to it automatically.
        # Specify the exact Go version (e.g., 1.22.4) in .go-version
        # if your build requires a specific patch version of Go.
        # Otherwise, specify the major and minor versions (e.g., 1.22),
        # with a caveat that it can lead to builds using different
        # patch versions of Go in a workflow run.
        run: |
          GO_VERSION=$(head -n 1 .go-version)
          echo "Building with Go ${GO_VERSION}"
          echo "go-version=${GO_VERSION}" >> $GITHUB_OUTPUT

  set-product-version:
    runs-on: ubuntu-latest
    outputs:
      product-version: ${{ steps.set-product-version.outputs.product-version }}
      product-base-version: ${{ steps.set-product-version.outputs.base-product-version }}
      product-prerelease-version: ${{ steps.set-product-version.outputs.prerelease-product-version }}
      product-minor-version: ${{ steps.set-product-version.outputs.minor-product-version }}
      product-date: ${{ steps.set-product-date.outputs.product-date }}
      shared-ldflags: ${{ steps.shared-ldflags.outputs.shared-ldflags }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Set Product version
        id: set-product-version
        uses: hashicorp/actions-set-product-version@v2
      - name: Set Product date
        id: set-product-date
        run: |
          echo "product-date=$(scripts/build-date.sh)" >> "$GITHUB_OUTPUT"
      - name: Set shared -ldflags
        id: shared-ldflags
        run: |
          T="github.com/hashicorp/tfctl-cli/version"
          echo "shared-ldflags=-X ${T}.commit=${GITHUB_SHA::8} \
          -X ${T}.committedTime=${{ steps.set-product-date.outputs.product-date }} \
          " >> "$GITHUB_OUTPUT"

  generate-metadata-file:
    needs: set-product-version
    runs-on: ubuntu-latest
    outputs:
      filepath: ${{ steps.generate-metadata-file.outputs.filepath }}
    steps:
      - name: "Checkout directory"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Generate metadata file
        id: generate-metadata-file
        uses: hashicorp/actions-generate-metadata@v1
        with:
          version: ${{ needs.set-product-version.outputs.product-version }}
          product: ${{ env.PKG_NAME }}
          repository: "tfctl-cli"
      - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: metadata.json
          path: ${{ steps.generate-metadata-file.outputs.filepath }}

  build-other:
    needs:
      - get-go-version
      - set-product-version
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false # recommended during development
      matrix:
        goos: [freebsd, windows, netbsd, openbsd]
        goarch: ["386", "amd64", "arm"]
        exclude:
          - goos: windows
            goarch: arm

    name: Go ${{ needs.get-go-version.outputs.go-version }} ${{ matrix.goos }} ${{ matrix.goarch }} build

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: hashicorp/actions-go-build@b9e2cfba3013adccdc112b01cba922d83c78fac5 # v1.1.1
        env:
          BASE_VERSION: ${{ needs.set-product-version.outputs.product-base-version }}
          PRERELEASE_VERSION: ${{ needs.set-product-version.outputs.product-prerelease-version}}
          METADATA_VERSION: ${{ env.METADATA }}
        with:
          product_name: ${{ env.PKG_NAME }}
          product_version: ${{ needs.set-product-version.outputs.product-version }}
          go_version: ${{ needs.get-go-version.outputs.go-version }}
          os: ${{ matrix.goos }}
          arch: ${{ matrix.goarch }}
          reproducible: report
          instructions: |
            make go/build

  build-linux:
    needs:
      - get-go-version
      - set-product-version
    runs-on: ubuntu-latest
    strategy:
      matrix:
        goos: [linux]
        goarch: ["arm", "arm64", "386", "amd64"]

      fail-fast: false # recommended during development

    name: Go ${{ needs.get-go-version.outputs.go-version }} ${{ matrix.goos }} ${{ matrix.goarch }} build

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: hashicorp/actions-go-build@b9e2cfba3013adccdc112b01cba922d83c78fac5 # v1.1.1
        env:
          BASE_VERSION: ${{ needs.set-product-version.outputs.product-base-version }}
          PRERELEASE_VERSION: ${{ needs.set-product-version.outputs.product-prerelease-version}}
          METADATA_VERSION: ${{ env.METADATA }}
        with:
          product_name: ${{ env.PKG_NAME }}
          product_version: ${{ needs.set-product-version.outputs.product-version }}
          go_version: ${{ needs.get-go-version.outputs.go-version }}
          os: ${{ matrix.goos }}
          arch: ${{ matrix.goarch }}
          reproducible: report
          instructions: |
            make go/build
      - name: Copy license file to config_dir
        if: ${{ matrix.goos == 'linux' }}
        env:
          LICENSE_DIR: ".release/linux/package/usr/share/doc/${{ env.PKG_NAME }}"
        run: |
          mkdir -p "$LICENSE_DIR" && cp LICENSE "$LICENSE_DIR/LICENSE.txt"
      - name: Package
        if: ${{ matrix.goos == 'linux' }}
        uses: hashicorp/actions-packaging-linux@v1
        with:
          name: ${{ github.event.repository.name }}
          description: "tfctl is a comprehensive, official CLI for the HCP Terraform / Terraform Enterprise platform."
          arch: ${{ matrix.goarch }}
          version: ${{ needs.set-product-version.outputs.product-version }}
          maintainer: "HashiCorp"
          homepage: "https://github.com/hashicorp/tfctl-cli"
          license: "MPL-2.0"
          binary: "dist/${{ env.PKG_NAME }}"
          deb_depends: "openssl"
          rpm_depends: "openssl"
          config_dir: ".release/linux/package/"

      - name: Set Package Names
        if: ${{ matrix.goos == 'linux' }}
        run: |
          echo "RPM_PACKAGE=$(basename out/*.rpm)" >> "$GITHUB_ENV"
          echo "DEB_PACKAGE=$(basename out/*.deb)" >> "$GITHUB_ENV"

      - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        if: ${{ matrix.goos == 'linux' }}
        with:
          name: ${{ env.RPM_PACKAGE }}
          path: out/${{ env.RPM_PACKAGE }}

      - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        if: ${{ matrix.goos == 'linux' }}
        with:
          name: ${{ env.DEB_PACKAGE }}
          path: out/${{ env.DEB_PACKAGE }}

  build-darwin:
    needs:
      - get-go-version
      - set-product-version
    runs-on: macos-latest
    strategy:
      matrix:
        goos: [darwin]
        goarch: ["amd64", "arm64"]
      fail-fast: true

    name: Go ${{ needs.get-go-version.outputs.go-version }} ${{ matrix.goos }} ${{ matrix.goarch }} build

    env:
      GOOS: ${{ matrix.goos }}
      GOARCH: ${{ matrix.goarch }}

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: hashicorp/actions-go-build@b9e2cfba3013adccdc112b01cba922d83c78fac5 # v1.1.1
        env:
          BASE_VERSION: ${{ needs.set-product-version.outputs.product-base-version }}
          PRERELEASE_VERSION: ${{ needs.set-product-version.outputs.product-prerelease-version}}
          METADATA_VERSION: ${{ env.METADATA }}
        with:
          product_name: ${{ env.PKG_NAME }}
          product_version: ${{ needs.set-product-version.outputs.product-version }}
          go_version: ${{ needs.get-go-version.outputs.go-version }}
          os: ${{ matrix.goos }}
          arch: ${{ matrix.goarch }}
          reproducible: report
          instructions: |
            make go/build

  # build-docker-default:
  #   name: Docker release-default ${{matrix.runner}}/${{ matrix.arch }}
  #   needs:
  #     - set-product-version
  #     - build-linux
  #   runs-on: ${{ matrix.runner }}
  #   strategy:
  #     matrix:
  #       include:
  #         - { runner: "ubuntu-22.04", arch: "amd64", dockerfile: "Dockerfile" }
  #         - { runner: "ubuntu-22.04", arch: "arm64", dockerfile: "Dockerfile" }
  #         - { runner: "ubuntu-22.04", arch: "arm", dockerfile: "Dockerfile" }
  #     fail-fast: false # recommended during development
  #   env:
  #     # Windows Warning: Do not set environment variables that case-conflict with variables used within an action
  #     # on windows this will cause the action to not be able to set the environment variables.
  #     # In this case setting `env.version` here means the action will be unable to set `env.VERSION` internally and fail.
  #     repo: ${{ github.event.repository.name }}
  #     product_version: ${{ needs.set-product-version.outputs.product-version }}
  #   steps:
  #     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
  #     - name: Docker Build (Action)
  #       uses: hashicorp/actions-docker-build@v2
  #       with:
  #         smoke_test: |
  #           TEST_VERSION="$(docker run "${IMAGE_NAME}" --version 2>&1)"
  #           if [ "${TEST_VERSION}" != "v${{ env.product_version }}" ]; then
  #             printf "fail: container smoke test, got=%q want=%q\n" "${TEST_VERSION}" "${{ env.product_version }}"
  #             exit 1
  #           fi
  #           printf "ok: container smoke test\n"
  #         pkg_name: ${{ env.PKG_NAME }}_${{ env.product_version }}
  #         bin_name: ${{ env.PKG_NAME }}
  #         version: ${{ env.product_version }}
  #         dockerfile: ${{ matrix.dockerfile }}
  #         target: single
  #         arch: ${{ matrix.arch }}
  #         # The ECR tag used below is to allow us to test by pushing to a private ECR registry.
  #         # If you want to pubish to ECR use the following syntax instead - public.ecr.aws/hashicorp/${{env.PKG_NAME}}:${{env.version}}.
  #         # Please note - if you haven't previously been publishing to ECR you will need to reach out to team-rel-eng
  #         # - https://hashicorp.atlassian.net/wiki/spaces/RDXPOC/pages/2298218311/How+to+Push+a+Docker+image+to+ECR
  #         tags: |
  #           docker.io/hashicorp/${{ env.PKG_NAME }}:${{ env.product_version }}
  #           986891699432.dkr.ecr.us-east-1.amazonaws.com/hashicorp/${{ env.PKG_NAME }}:${{ env.product_version }}
  #         # dev_tags are tags that get automatically pushed whenever successful
  #         # builds make it to the stable channel. The intention is for these tags
  #         # to be used for early testing of new code prior to official releases
  #         # going out. The stable channel implies that all tests and scans have
  #         # completed successfully, so these images should be _stable_ but are not
  #         # intended for production use.
  #         #
  #         # Here we have two example dev tags. The first (ending -dev) is a tag
  #         # that will be updated over-and-over as new builds arrive in stable.
  #         #
  #         # The second (using the git SHA) will produce a new separate tag for
  #         # each commit that is built. (These can still be overridden if the same
  #         # commit is built successfully a second time, but that is a less likely
  #         # scenario.) These kinds of dev tags are useful if you want to be able
  #         # to use Docker images built from those specific commits.
  #         #
  #         # NOTE: dev_tags MUST publish to the 'hashicorppreview' DockerHub org, it
  #         # will fail to any other DockerHub org or registry. You can optionally
  #         # prepend docker.io
  #         dev_tags: |
  #           docker.io/hashicorppreview/${{ env.PKG_NAME }}:${{ env.product_version }}-dev
  #           docker.io/hashicorppreview/${{ env.PKG_NAME }}:${{ env.product_version }}-${{ github.sha }}