Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 14 additions & 2 deletions .github/workflows/releases.yml
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,11 @@ permissions:

jobs:
GoReleaser:
permissions:
contents: write
packages: write
env:
PLUGIN_REVISION: "1"
runs-on: namespace-profile-linux-amd64-4vcpu
steps:
- uses: namespacelabs/nscloud-checkout-action@v9
Expand All @@ -19,15 +24,22 @@ jobs:
with:
token: ${{ secrets.NUMARY_GITHUB_TOKEN }}

- name: Validate Auth plugin with race detection
run: nix develop --impure --command just test-fctl-plugin test-fctl-plugin-publisher

- run: nix develop --impure --command just release
env:
GITHUB_TOKEN: ${{ secrets.NUMARY_GITHUB_TOKEN }}
SPEAKEASY_API_KEY: ${{ secrets.SPEAKEASY_API_KEY }}
FURY_TOKEN: ${{ secrets.FURY_TOKEN }}
GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}

- name: Publish Auth fctl plugin and release catalogue
run: nix develop --impure --command just publish-fctl-plugin-release
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Add the OpenAPI file to the release assets
run: gh release upload "$TAG_NAME" ./openapi.yaml#openapi.yaml
run: nix develop --impure --command just upload-release-openapi
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
TAG_NAME: ${{ github.ref_name }}
2 changes: 2 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -2,3 +2,5 @@ vendor
.idea
coverage.*
auth

/build/
49 changes: 49 additions & 0 deletions .goreleaser.fctl-plugin.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
version: 2
project_name: fctl-plugin-auth
dist: build/fctl-plugin

env:
- PLUGIN_REVISION={{ envOrDefault "PLUGIN_REVISION" "1" }}
- AUTH_SERVICE_VERSION={{ envOrDefault "AUTH_SERVICE_VERSION" .Version }}

builds:
- id: fctl-plugin-auth
binary: fctl-plugin-auth
dir: misc/fctl-plugin
main: ./cmd/fctl-plugin-auth
env:
- CGO_ENABLED=0
ldflags:
- -s -w
- -X main.serviceVersion={{ .Env.AUTH_SERVICE_VERSION }}
- -X main.revision={{ .Env.PLUGIN_REVISION }}
goos:
- linux
- darwin
- windows
goarch:
- amd64
- arm64

archives:
- ids:
- fctl-plugin-auth
name_template: "{{ .ProjectName }}_v{{ .Env.AUTH_SERVICE_VERSION }}_r{{ .Env.PLUGIN_REVISION }}_{{ .Os }}-{{ .Arch }}"
formats:
- tar.gz
format_overrides:
- goos: windows
formats:
- zip
files:
- src: misc/fctl-plugin/README.md
dst: README.md

checksum:
name_template: checksums.txt

release:
disable: true
changelog:
disable: true
34 changes: 34 additions & 0 deletions .goreleaser.yml
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,9 @@ includes:
- from_url:
url: https://raw.githubusercontent.com/formancehq/earthly/refs/heads/main/.goreleaser.default-v2.yaml

env:
- PLUGIN_REVISION={{ envOrDefault "PLUGIN_REVISION" "1" }}

builds:
- binary: auth
id: auth
Expand All @@ -22,13 +25,44 @@ builds:
- amd64
- arm64

- binary: fctl-plugin-auth
id: fctl-plugin-auth
dir: misc/fctl-plugin
main: ./cmd/fctl-plugin-auth
ldflags:
- -s -w
- -X main.serviceVersion={{ .Version }}
- -X main.revision={{ .Env.PLUGIN_REVISION }}
env:
- CGO_ENABLED=0
goos:
- linux
- darwin
- windows
goarch:
- amd64
- arm64

archives:
- id: "{{.ProjectName}}"
ids:
- auth
formats: [tar.gz]
name_template: "{{.ProjectName}}_{{.Os}}-{{.Arch}}"

- id: fctl-plugin-auth
ids:
- fctl-plugin-auth
formats:
- tar.gz
format_overrides:
- goos: windows
formats:
- zip
name_template: "fctl-plugin-auth_v{{ .Version }}_r{{ .Env.PLUGIN_REVISION }}_{{ .Os }}-{{ .Arch }}"
files:
- src: misc/fctl-plugin/README.md
dst: README.md

release:
prerelease: auto
Expand Down
65 changes: 64 additions & 1 deletion Justfile
Original file line number Diff line number Diff line change
Expand Up @@ -8,14 +8,16 @@ pc: pre-commit

lint:
@golangci-lint run --fix --build-tags it --timeout 5m
@cd misc/fctl-plugin && golangci-lint run --config .golangci.yml --fix --timeout 5m

tidy:
@go mod tidy
@cd misc/fctl-plugin && go mod tidy

generate:
@go generate ./...

tests:
tests: test-fctl-plugin
@go test -race -covermode=atomic \
-coverprofile coverage.txt \
-tags it \
Expand All @@ -32,3 +34,64 @@ release-ci:

release:
@goreleaser release --clean

# Independent Auth CLI/library module; no Auth server dependencies.
test-fctl-plugin:
@cd misc/fctl-plugin && go test -race ./...

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 [minor] Include plugin tests in the uploaded coverage reports

When just tests runs, test-fctl-plugin executes go test -race ./... without a coverage profile, while the subsequent root-module test writes only coverage.txt. As the README explicitly notes, root-module tests do not discover this nested module. Consequently the new plugin contributes no coverage data to the normal reporting path, so coverage regressions in it are invisible to the required coverage tracking despite its tests running.

Suggestion: Generate a separate atomic coverage profile for the nested module and include it in the CI coverage upload alongside the root profile. Keep race detection enabled and avoid having the root test overwrite the plugin profile.


build-fctl-plugin version="dev" revision="1":
@cd misc/fctl-plugin && CGO_ENABLED=0 go build -ldflags '-X main.serviceVersion={{version}} -X main.revision={{revision}}' -o ../../build/fctl-plugin-auth ./cmd/fctl-plugin-auth

# Six platform executables and checksums, without publication.
package-fctl-plugin version="dev" revision="1":
@AUTH_SERVICE_VERSION={{version}} PLUGIN_REVISION={{revision}} goreleaser release --config .goreleaser.fctl-plugin.yml --snapshot --clean --skip=publish

fctl-plugin-manifest:
@./build/fctl-plugin-auth --manifest > ./build/fctl-plugin-manifest.json

# Release publication uses the native executable from this exact GoReleaser run.
publish-fctl-plugin-release:
#!/usr/bin/env bash
set -euo pipefail
: "${GITHUB_REF_NAME:?release tag is required}"
: "${GITHUB_TOKEN:?GitHub Actions token is required}"
: "${GITHUB_ACTOR:?publishing actor is required}"
[[ "$GITHUB_REF_NAME" == v* ]] || { echo 'Expected an Auth v-prefixed release tag' >&2; exit 1; }
version="${GITHUB_REF_NAME#v}"
revision="${PLUGIN_REVISION:-1}"
native="$(jq -er '[.[] | select(.type == "Binary" and .extra.ID == "fctl-plugin-auth" and .goos == "linux" and .goarch == "amd64")] | if length == 1 then .[0].path else error("expected one native Auth plugin") end' dist/artifacts.json)"
: "${GITHUB_REPOSITORY:?release repository is required}"
release_root="$PWD"
auth_dir="$(mktemp -d)"
trap 'rm -rf "$auth_dir"; rm -f "$release_root/dist/fctl-plugin-catalogue.json.tmp" "$release_root/dist/fctl-plugin-manifest.json.tmp"' EXIT
export DOCKER_CONFIG="$auth_dir"
"$native" --manifest > dist/fctl-plugin-manifest.json.tmp
printf '%s' "$GITHUB_TOKEN" | oras login ghcr.io --username "$GITHUB_ACTOR" --password-stdin
cd misc/fctl-plugin
go run ./cmd/fctl-plugin-publish --manifest ../../dist/fctl-plugin-manifest.json.tmp --artifacts ../../dist/artifacts.json --source-root ../.. --service-version "$version" --revision "$revision" > ../../dist/fctl-plugin-catalogue.json.tmp
cd ../..
mv dist/fctl-plugin-catalogue.json.tmp dist/fctl-plugin-catalogue.json
GH_TOKEN="$GITHUB_TOKEN" gh release upload "$GITHUB_REF_NAME" dist/fctl-plugin-catalogue.json --clobber --repo "$GITHUB_REPOSITORY"

# Real ORAS layout fixture; no registry authentication or writes.
test-fctl-plugin-publisher:
@cd misc/fctl-plugin && go test -race -tags it ./internal/catalogue ./cmd/fctl-plugin-publish

upload-release-openapi:
@gh release upload "$GITHUB_REF_NAME" ./openapi.yaml#openapi.yaml --repo "$GITHUB_REPOSITORY"

# Read-only check after an administrator enables public GHCR downloads.
verify-fctl-plugin-anonymous catalogue="dist/fctl-plugin-catalogue.json":
#!/usr/bin/env bash
set -euo pipefail
catalogue_path="$(realpath '{{catalogue}}')"
fixture="$(mktemp -d)"
trap 'rm -rf "$fixture"' EXIT
printf '{"auths":{}}' > "$fixture/config.json"
jq -e '.schemaVersion == 1 and (.releases | length == 6)' "$catalogue_path" > /dev/null
while IFS=$'\t' read -r registry repository digest checksum; do
reference="${registry#https://}/$repository@$digest"
oras pull --registry-config "$fixture/config.json" --output "$fixture/artifact" "$reference"
printf '%s %s\n' "$checksum" "$fixture/artifact/fctl-plugin-auth" | sha256sum --check
rm -rf "$fixture/artifact"
done < <(jq -r '.releases[] | [.artifact.registry, .artifact.repository, .artifact.digest, .sha256] | @tsv' "$catalogue_path")
5 changes: 5 additions & 0 deletions flake.nix
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,11 @@
go_1_26
gotools
just
bash
coreutils
jq
gh
oras
];
unstablePackages = with pkgs-unstable; [
golangci-lint
Expand Down
1 change: 1 addition & 0 deletions misc/fctl-plugin/.gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
/build/
70 changes: 70 additions & 0 deletions misc/fctl-plugin/.golangci.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,70 @@
# yaml-language-server: $schema=https://golangci-lint.run/jsonschema/golangci.jsonschema.json
version: "2"

formatters:
enable:
- gci
- gofmt
- goimports
settings:
gci:
sections:
- standard
- default
- prefix(github.com/formancehq/)
- localmodule
custom-order: true

run:
timeout: 5m

linters:
default: none
enable:
- bodyclose
- contextcheck
- errcheck
- errorlint
- exhaustive
- gocognit
- gosec
- govet
- ineffassign
- modernize
- nilerr
- noctx
- nolintlint
- revive
- staticcheck
- unused
- usetesting
settings:
errcheck:
check-blank: true
check-type-assertions: true
disable-default-exclusions: true
exhaustive:
# A default branch must not hide a newly added enum value.
default-signifies-exhaustive: false
gocognit:
min-complexity: 15
nolintlint:
allow-unused: false
require-explanation: true
require-specific: true
revive:
rules:
- name: blank-imports
- name: context-as-argument
- name: context-keys-type
- name: dot-imports
- name: empty-block
- name: error-naming
- name: error-return
- name: error-strings
- name: errorf
- name: increment-decrement
- name: receiver-naming
- name: time-naming
- name: unexported-return
- name: var-naming
Loading
Loading