From 8633814b28903f03ed58b10345dbcdbd21a8ca69 Mon Sep 17 00:00:00 2001 From: sakisv Date: Wed, 27 May 2026 19:24:47 +0300 Subject: [PATCH 1/6] Add version flag --- config.go | 9 +++++++++ main.go | 2 ++ 2 files changed, 11 insertions(+) diff --git a/config.go b/config.go index c2de7ca..f19b366 100644 --- a/config.go +++ b/config.go @@ -4,6 +4,7 @@ import ( "errors" "fmt" "log" + "os" "slices" "strings" @@ -173,8 +174,16 @@ func loadConfig() NoclickopsConfig { pflag.BoolP(configValues[DeleteDownloadedStateFiles], "d", false, "If specified, any downloaded statefiles will be deleted at the end") pflag.BoolP(configValues[ForceDownload], "f", false, "If specified, it will download all the files from the bucket even they overwrite existing ones") pflag.BoolP(configValues[GenerateHTMLReport], "g", false, "If specified, it will generate an html report in the current directory") + + // this is different because we use it and exit straight away + versionFlag := pflag.BoolP("version", "V", false, "Print version and exit") pflag.Parse() + if *versionFlag { + fmt.Printf("noclickops %s\n", version) + os.Exit(0) + } + // use this to pass control to viper // This means that any references to `statefile` will be resolved in the // right order (i.e. default, config, env, commandline) diff --git a/main.go b/main.go index 105d5af..097cb89 100644 --- a/main.go +++ b/main.go @@ -8,6 +8,8 @@ import ( "github.com/noclickops/common" ) +var version = "dev" + func main() { config := loadConfig() From 24c2cdea769ceccd57b7942feb79b9693c1ce91a Mon Sep 17 00:00:00 2001 From: sakisv Date: Wed, 27 May 2026 19:26:43 +0300 Subject: [PATCH 2/6] Add workflow to create releases for linux and mac --- .github/workflows/release.yml | 80 +++++++++++++++++++++++++++++++++++ 1 file changed, 80 insertions(+) create mode 100644 .github/workflows/release.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..7a0ebc7 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,80 @@ +--- +name: Release +permissions: + contents: write +on: + push: + tags: + - "v[0-9]+.[0-9]+.[0-9]+" + +jobs: + test: + name: test + runs-on: ubuntu-latest + steps: + - name: checkout code + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 + - name: setup go + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 + with: + go-version: "1.25" + - name: install stringer + run: go install golang.org/x/tools/cmd/stringer@v0.44.0 + - name: run go generate + run: go generate ./... + - name: check if new files have been generated + run: git diff --exit-code + - name: run tests + run: go test ./... -count=1 + + build: + name: build ${{ matrix.goos }}/${{ matrix.goarch }} + needs: test + runs-on: ubuntu-latest + strategy: + matrix: + include: + - goos: linux + goarch: amd64 + - goos: linux + goarch: arm64 + - goos: darwin + goarch: amd64 + - goos: darwin + goarch: arm64 + steps: + - name: checkout code + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 + - name: setup go + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 + with: + go-version: "1.25" + - name: build + env: + GOOS: ${{ matrix.goos }} + GOARCH: ${{ matrix.goarch }} + run: | + go build \ + -ldflags="-w -X main.version=${{ github.ref_name }}" \ + -o noclickops-${{ matrix.goos }}-${{ matrix.goarch }} \ + . + - name: upload artifact + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: noclickops-${{ matrix.goos }}-${{ matrix.goarch }} + path: noclickops-${{ matrix.goos }}-${{ matrix.goarch }} + + release: + name: release + needs: build + runs-on: ubuntu-latest + steps: + - name: download artifacts + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + merge-multiple: true + - name: create release + uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0 + with: + files: noclickops-* + generate_release_notes: true From 7d49367e6c101ef42a6721c14f77c100546017f1 Mon Sep 17 00:00:00 2001 From: sakisv Date: Wed, 27 May 2026 19:35:24 +0300 Subject: [PATCH 3/6] Use `GITHUB_REF_NAME` instead of `github.ref_name` zizmore flagged this as "may expand into attacker-controllable code" --- .github/workflows/release.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7a0ebc7..8c7f121 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -45,17 +45,20 @@ jobs: steps: - name: checkout code uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 + with: + persist-credentials: false - name: setup go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version: "1.25" + cache: false - name: build env: GOOS: ${{ matrix.goos }} GOARCH: ${{ matrix.goarch }} run: | go build \ - -ldflags="-w -X main.version=${{ github.ref_name }}" \ + -ldflags="-w -X main.version=${GITHUB_REF_NAME}" \ -o noclickops-${{ matrix.goos }}-${{ matrix.goarch }} \ . - name: upload artifact From bada7b1870ec72970357a3ff52a2d32d7bb010b9 Mon Sep 17 00:00:00 2001 From: sakisv Date: Wed, 27 May 2026 19:40:24 +0300 Subject: [PATCH 4/6] Set `persist-credentials: false` for the checkout action zizmore flagged it and there's an old issue that's still open about this: https://github.com/actions/checkout/issues/485 --- .github/workflows/release.yml | 2 ++ .github/workflows/run-tests.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8c7f121..9c89a99 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,6 +14,8 @@ jobs: steps: - name: checkout code uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 + with: + persist-credentials: false - name: setup go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: diff --git a/.github/workflows/run-tests.yml b/.github/workflows/run-tests.yml index 630f57f..1410281 100644 --- a/.github/workflows/run-tests.yml +++ b/.github/workflows/run-tests.yml @@ -14,6 +14,8 @@ jobs: steps: - name: checkout code uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 + with: + persist-credentials: false - name: setup go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: From b77eafed6689eae9b0645b43d1691a5521004b03 Mon Sep 17 00:00:00 2001 From: sakisv Date: Wed, 27 May 2026 19:46:42 +0300 Subject: [PATCH 5/6] Restrict default release workflow permissions to read Override in the `release` step --- .github/workflows/release.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9c89a99..a6fd56a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,7 +1,7 @@ --- name: Release permissions: - contents: write + contents: read on: push: tags: @@ -73,6 +73,8 @@ jobs: name: release needs: build runs-on: ubuntu-latest + permissions: + contents: write steps: - name: download artifacts uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 From 64e73a0678b390ce2e948cc594eb24fbc0db23b4 Mon Sep 17 00:00:00 2001 From: sakisv Date: Wed, 27 May 2026 19:47:56 +0300 Subject: [PATCH 6/6] Add `cache: false` when building a release --- .github/workflows/release.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a6fd56a..bb87e0d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,6 +20,7 @@ jobs: uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version: "1.25" + cache: false - name: install stringer run: go install golang.org/x/tools/cmd/stringer@v0.44.0 - name: run go generate