wrapping-release-actions¶

# Wrapping the release actions: docker/login-action with docker/build-push-action,
# and goreleaser/goreleaser-action. Releases are where a CI workflow has effects,
# so every wrapper here is `cache = False` (a pass says nothing about a
# publish that must happen) and the steps exist only for a tag.
#
# starci has no way yet to hand a step a secret. The empty `env` values below
# only name what each step needs; getting a real value to them is up to
# whatever runs the step, so treat this as the shape of the wrapper and not as
# something to run as it is.

def docker_push(image, tags, registry = "ghcr.io", needs = []):
    """docker/login-action followed by docker/build-push-action."""
    full = ["{}/{}:{}".format(registry, image, t) for t in tags]
    return step(
        "push image",
        image = "docker:27-cli",
        run = "echo \"$REGISTRY_TOKEN\" | docker login {} -u \"$REGISTRY_USER\" --password-stdin && docker build {} . && {}".format(
            registry,
            " ".join(["-t " + t for t in full]),
            " && ".join(["docker push " + t for t in full]),
        ),
        env = {"REGISTRY_USER": "", "REGISTRY_TOKEN": ""},
        cache = False,
        needs = needs,
    )

def goreleaser(version = "~> v2", args = "release --clean", needs = []):
    """goreleaser/goreleaser-action."""
    return step(
        "goreleaser",
        image = "goreleaser/goreleaser:latest",
        run = "goreleaser " + args,
        env = {"GITHUB_TOKEN": ""},
        cache = False,
        needs = needs,
    )

def ci(ctx):
    test = step("test", image = "golang:1.26", run = "go test ./...", inputs = ["**/*.go", "go.mod", "go.sum"])
    steps = [test]
    if ctx.event == "tag":
        # v1.2.3 also moves the 1.2 and 1 tags a user may be following.
        version = ctx.tag.lstrip("v")
        tags = [version, ".".join(version.split(".")[:2]), version.split(".")[0], "latest"]
        steps += [
            docker_push("sam/app", tags, needs = [test]),
            goreleaser(needs = [test]),
        ]
    return steps

# Generated by `starci compile` from wrapping-release-actions.ci.star. Edit that, not this.
#
# Each job is one step of the plan: the same image, command, tools and
# packages, given only the step's inputs. A job skips its work when it has
# already passed with the same inputs.
#
# What does not carry over:
#  - The script looks at the tag's name. That does not carry over: every tag is
#    treated alike.
#  - Passes are remembered in this repository's Actions cache, which GitHub
#    scopes by branch and evicts when old. starci's own store has neither
#    limit.

name: CI

on:
  push:
    branches: ['**']
    tags: ['**']
  pull_request:
  workflow_dispatch:

jobs:
  test:
    name: "test"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          sparse-checkout-cone-mode: false
          sparse-checkout: |
            /**/*.go
            /go.mod
            /go.sum
      - name: Has this already passed with these inputs?
        id: passed
        uses: actions/cache@v4
        with:
          path: ${{ runner.temp }}/starci-passed
          key: starci-passed-test-7226615a5584a071-${{ hashFiles('**/*.go', 'go.mod', 'go.mod/**', 'go.sum', 'go.sum/**') }}
      - name: "test"
        if: steps.passed.outputs.cache-hit != 'true'
        env:
          STARCI_RUN: |-
            go test ./...
        run: |
          docker run --rm \
            -v "$PWD:/workspace" \
            -w /workspace \
            golang:1.26 sh -c "$STARCI_RUN"
      - name: Remember this pass
        if: steps.passed.outputs.cache-hit != 'true'
        run: mkdir -p "$RUNNER_TEMP/starci-passed" && date > "$RUNNER_TEMP/starci-passed/at"

  push-image:
    name: "push image"
    runs-on: ubuntu-latest
    needs: [test]
    if: ${{ (github.event_name == 'push' && github.ref_type == 'tag') }}
    steps:
      - uses: actions/checkout@v4
      - name: "push image"
        env:
          STARCI_RUN: |-
            echo "$REGISTRY_TOKEN" | docker login ghcr.io -u "$REGISTRY_USER" --password-stdin && docker build -t ghcr.io/sam/app:0.0.0 -t ghcr.io/sam/app:0.0 -t ghcr.io/sam/app:0 -t ghcr.io/sam/app:latest . && docker push ghcr.io/sam/app:0.0.0 && docker push ghcr.io/sam/app:0.0 && docker push ghcr.io/sam/app:0 && docker push ghcr.io/sam/app:latest
        run: |
          docker run --rm \
            -v "$PWD:/workspace" \
            -w /workspace \
            -e 'REGISTRY_TOKEN=' \
            -e 'REGISTRY_USER=' \
            docker:27-cli sh -c "$STARCI_RUN"

  goreleaser:
    name: "goreleaser"
    runs-on: ubuntu-latest
    needs: [test]
    if: ${{ (github.event_name == 'push' && github.ref_type == 'tag') }}
    steps:
      - uses: actions/checkout@v4
      - name: "goreleaser"
        env:
          STARCI_RUN: |-
            goreleaser release --clean
        run: |
          docker run --rm \
            -v "$PWD:/workspace" \
            -w /workspace \
            -e 'GITHUB_TOKEN=' \
            goreleaser/goreleaser:latest sh -c "$STARCI_RUN"

# Generated by `starci compile --target circleci` from wrapping-release-actions.ci.star. Edit that, not this.
#
# Each job is one step of the plan: the same image, command, tools and
# packages, given only the step's inputs. A job skips its work when it has
# already passed with the same inputs.
#
# What does not carry over:
#  - The script reads ctx.event, so its plan depends on the commit. This file
#    is the plan for a commit about which nothing is known, and is the same for
#    every push: steps the script would add or drop for a particular branch or
#    set of changed files are not represented.
#  - Passes are remembered in this project's CircleCI cache, which expires.
#    starci's own store does not.

version: 2.1

jobs:
  test:
    machine:
      image: ubuntu-2404:current
    resource_class: medium
    steps:
      - checkout
      - run:
          name: "Keep only this step's inputs"
          command: |
            git sparse-checkout set --no-cone '/**/*.go' '/go.mod' '/go.sum'
      - run:
          name: "Identify the inputs"
          command: |
            git ls-files -s -- ':(top,glob)**/*.go' ':(top,literal)go.mod' ':(top,literal)go.sum' > /tmp/starci-inputs
      - restore_cache:
          name: Has this already passed with these inputs?
          keys:
            - starci-passed-test-7226615a5584a071-{{ checksum "/tmp/starci-inputs" }}
      - run:
          name: "Stop here if it has"
          command: |
            if [ -e ~/starci-passed/at ]; then
              echo "Passed before with the same inputs, on $(cat ~/starci-passed/at). Nothing to do."
              circleci-agent step halt
            fi
      - run:
          name: "test"
          environment:
            STARCI_RUN: |-
              go test ./...
          command: |
            docker run --rm \
              -v "$PWD:/workspace" \
              -w /workspace \
              golang:1.26 sh -c "$STARCI_RUN"
      - run:
          name: "Remember this pass"
          command: |
            mkdir -p ~/starci-passed && date > ~/starci-passed/at
      - save_cache:
          key: starci-passed-test-7226615a5584a071-{{ checksum "/tmp/starci-inputs" }}
          paths:
            - ~/starci-passed

workflows:
  ci:
    jobs:
      - test