builds.yml

name: Builds
#
#
# this workflow:
#    - runs tests
#    - builds artifacts
#    - signs executables
#    - builds msi, rpm and deb packages
#    - creates the release draft for git tags
#
# help: https://github.github.io/actions-cheat-sheet/actions-cheat-sheet.html

on:
  push:
  pull_request:

# set go version for all steps
env:
  GOVERSION: 1.22.x

jobs:
  get-version:
    runs-on: ubuntu-latest
    outputs:
      minor:    ${{ steps.get-minor-version.outputs.minor }}
      major:    ${{ steps.get-major-version.outputs.major }}
      revision: ${{ steps.get-total-revision.outputs.revision }}
      sha:      ${{ steps.get-short-sha.outputs.sha }}
      version:  ${{ steps.get-version.outputs.version }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - id: get-major-version
        run: echo "major=$(./buildtools/get_version | cut -d . -f 1 | sed -e 's/[^0-9]*//g')" >> $GITHUB_OUTPUT
      - id: get-minor-version
        run: echo "minor=$(./buildtools/get_version | cut -d . -f 2 | sed -e 's/[^0-9]*//g')" >> $GITHUB_OUTPUT
      - id: get-total-revision
        run: REV=$(./buildtools/get_version | cut -d . -f 3 | sed -e 's/[^0-9]*//g'); echo "revision=${REV:-0}" >> $GITHUB_OUTPUT
      - id: get-short-sha
        run: echo "sha=$( git rev-parse --short HEAD )" >> $GITHUB_OUTPUT
      - id: get-version
        run: echo "version=$(./buildtools/get_version)" >> $GITHUB_OUTPUT


  test-linux:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GOVERSION }}
      - run: make citest


  test-win:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GOVERSION }}
      - run: |
          echo "Testing with ${{ env.GOVERSION }}"
          go work init
          go work use .
          $Env:GOWORK = "off"
          go mod vendor
          $Env:GOWORK = ""
          go test -v ./pkg/... ; if ($LASTEXITCODE -ne 0) { exit 1 }

  test-osx:
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GOVERSION }}
      - run: make test

  test-bsd:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Test in FreeBSD
      uses: vmactions/freebsd-vm@v1
      with:
        usesh: true
        copyback: false
        prepare: |
          pkg install -y gmake
          pkg install -y go
          pkg install -y bash
          freebsd-version
          sysctl hw.model
          sysctl hw.ncpu
          sysctl hw.physmem
          sysctl hw.usermem

        run: |
          gmake test

  build:
    strategy:
      fail-fast: false
      matrix:
        go-os: [linux, freebsd]
        go-arch: [i386, x86_64, aarch64]
    needs: [get-version]
    runs-on: ubuntu-latest
    env:
      BIN: "snclient-${{needs.get-version.outputs.version}}-${{ matrix.go-os }}-${{ matrix.go-arch }}"
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GOVERSION }}
      - run: |
          echo "Building ${{ env.BIN }}"
          GOOS=${{ matrix.go-os }} GOARCH=${{ matrix.go-arch }} make build
      - uses: actions/upload-artifact@v4.4.3
        with:
          name: "${{ env.BIN }}"
          path: "snclient"
          if-no-files-found: error


  build-osx:
    strategy:
      fail-fast: false
      matrix:
        go-os: [darwin]
        go-arch: [x86_64, aarch64]
    needs: [get-version]
    runs-on: macos-latest
    env:
      BIN: "snclient-${{needs.get-version.outputs.version}}-${{ matrix.go-os }}-${{ matrix.go-arch }}"
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GOVERSION }}
      - run: |
          echo "Building ${{ env.BIN }}"
          GOOS=${{ matrix.go-os }} GOARCH=${{ matrix.go-arch }} make build
      - uses: actions/upload-artifact@v4.4.3
        with:
          name: "${{ env.BIN }}"
          path: "snclient"
          if-no-files-found: error


  build-win:
    strategy:
      fail-fast: false
      matrix:
        go-os: [windows]
        go-arch: [i386, x86_64, aarch64]
    needs: [get-version]
    runs-on: ubuntu-latest
    env:
      BIN: "snclient-${{needs.get-version.outputs.version}}-${{ matrix.go-os }}-${{ matrix.go-arch }}"
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GOVERSION }}
      - run: |
          echo "Building ${{ env.BIN }}.exe"
          rm -rf winres rsrc_windows_*
          make rsrc_windows
          GOOS=${{ matrix.go-os }} GOARCH=${{ matrix.go-arch }} make build
          mv snclient snclient.exe
      - uses: actions/upload-artifact@v4.4.3
        with:
          name: "${{ env.BIN }}"
          path: "snclient.exe"
          if-no-files-found: error


  sign-win:
    strategy:
      fail-fast: false
      matrix:
        go-os: [windows]
        go-arch: [i386, x86_64, aarch64]
    needs: [get-version, build-win]
    runs-on: windows-latest
    env:
      BIN: "snclient-${{needs.get-version.outputs.version}}-${{ matrix.go-os }}-${{ matrix.go-arch }}"
      CERTURL: ${{ secrets.AZURE_VAULT_CERT_URL }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: "${{ env.BIN }}"
          path: "."

      - name: "install Azure Sign Tool"
        if: ${{ env.CERTURL != '' }}
        run: |
          dotnet tool install --global --version 6.0.0 AzureSignTool

      - name: "Sign snclient.exe"
        if: ${{ env.CERTURL != '' }}
        run: |
          AzureSignTool.exe sign `
            --description="SNClient+ Agent (https://omd.consol.de/docs/snclient/)" `
            --description-url="https://omd.consol.de/docs/snclient/" `
            --file-digest=sha384 `
            --azure-key-vault-url="${{ secrets.AZURE_VAULT_CERT_URL }}" `
            --azure-key-vault-client-id="${{ secrets.AZURE_VAULT_APPLICATION_ID }}" `
            --azure-key-vault-tenant-id="${{ secrets.AZURE_VAULT_TENANT_ID }}" `
            --azure-key-vault-client-secret="${{ secrets.AZURE_VAULT_SECRET_VALUE }}" `
            --azure-key-vault-certificate="ConSol-Codesign" `
            -tr http://timestamp.digicert.com `
            -td sha384 `
            -v `
            "snclient.exe"

      - name: "Verify snclient.exe"
        if: ${{ env.CERTURL != '' }}
        run: |
          Write-Host "Verify snclient.exe"
          & "C:/Program Files (x86)/Windows Kits/10/bin/10.0.17763.0/x86/signtool.exe" verify /pa snclient.exe

      - uses: actions/upload-artifact@v4.4.3
        with:
          name: "${{ env.BIN }}"
          path: "snclient.exe"
          if-no-files-found: error
          overwrite: true


  dist-linux-osx:
    needs: [get-version]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GOVERSION }}
      - run: sudo apt-get update
      - run: sudo apt-get install help2man tofrodos
      - run: |
          echo "Creating dist folder for linux/osx"
          make dist
          rm dist/snclient
      - uses: actions/upload-artifact@v4.4.3
        with:
          name: "dist"
          path: "dist"
          if-no-files-found: error


  dist-win:
    needs: [get-version]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GOVERSION }}
      - run: sudo apt-get update
      - run: sudo apt-get install help2man tofrodos
      - run: |
          echo "Creating dist folder for windows"
          make windist
          rm dist/snclient
      - uses: actions/upload-artifact@v4.4.3
        with:
          name: "windist"
          path: "windist"
          if-no-files-found: error


  pkg-msi:
    strategy:
      matrix:
        go-os: [windows]
        go-arch: [i386, x86_64, aarch64]
    needs: [get-version, build-win, dist-win, sign-win]
    runs-on: windows-latest
    env:
      BIN: "snclient-${{needs.get-version.outputs.version}}-${{ matrix.go-os }}-${{ matrix.go-arch }}"
      CERTURL: ${{ secrets.AZURE_VAULT_CERT_URL }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: "${{ env.BIN }}"
          path: "windist"
      - uses: actions/download-artifact@v4
        with:
          name: "windist"
          path: "windist"

      - run: |
          Write-Host "Building ${{ env.BIN }}.msi"
          # Set-PSDebug -Trace 2
          & .\packaging\windows\build_msi.ps1 `
            -out "${{ env.BIN }}.msi" `
            -arch "${{ matrix.go-arch }}" `
            -major "${{needs.get-version.outputs.major}}" `
            -minor "${{needs.get-version.outputs.minor}}" `
            -rev "${{needs.get-version.outputs.revision}}" `
            -sha "${{ needs.get-version.outputs.sha }}"

      - name: "install Azure Sign Tool"
        if: ${{ env.CERTURL != '' }}
        run: |
          dotnet tool install --global --version 6.0.0 AzureSignTool

      - name: "Sign snclient.msi"
        if: ${{ env.CERTURL != '' }}
        run: |
          AzureSignTool.exe sign `
            --description="SNClient+ Agent (https://omd.consol.de/docs/snclient/)" `
            --description-url="https://omd.consol.de/docs/snclient/" `
            --file-digest=sha384 `
            --azure-key-vault-url="${{ secrets.AZURE_VAULT_CERT_URL }}" `
            --azure-key-vault-client-id="${{ secrets.AZURE_VAULT_APPLICATION_ID }}" `
            --azure-key-vault-tenant-id="${{ secrets.AZURE_VAULT_TENANT_ID }}" `
            --azure-key-vault-client-secret="${{ secrets.AZURE_VAULT_SECRET_VALUE }}" `
            --azure-key-vault-certificate="ConSol-Codesign" `
            -tr http://timestamp.digicert.com `
            -td sha384 `
            -v `
            "${{ env.BIN }}.msi"

      - name: "Verify snclient.msi"
        if: ${{ env.CERTURL != '' }}
        run: |
          Write-Host "Verify snclient.msi"
          & "C:/Program Files (x86)/Windows Kits/10/bin/10.0.17763.0/x86/signtool.exe" verify /pa ${{ env.BIN }}.msi

      - uses: actions/upload-artifact@v4.4.3
        with:
          name: "${{ env.BIN }}.msi"
          path: "${{ env.BIN }}.msi"
          if-no-files-found: error


  pkg-deb:
    strategy:
      matrix:
        go-os: [linux]
        go-arch: [i386, x86_64, aarch64]
    runs-on: ubuntu-latest
    needs: [get-version, build, dist-linux-osx]
    env:
      BIN: "snclient-${{needs.get-version.outputs.version}}-${{ matrix.go-os }}-${{ matrix.go-arch }}"
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GOVERSION }}
      - uses: actions/download-artifact@v4
        with:
          name: "${{ env.BIN }}"
          path: "dist"
      - uses: actions/download-artifact@v4
        with:
          name: "dist"
          path: "dist"
      - run: sudo apt-get update
      - run: sudo apt-get install devscripts
      - run: |
          echo "Building ${{ env.BIN }}.deb"
          export DEBEMAIL="Sven Nierlein <sven.nierlein@consol.de>"
          export DEBFULLNAME="Sven Nierlein"
          GOOS=${{ matrix.go-os }} GOARCH=${{ matrix.go-arch }} VERSION=${{needs.get-version.outputs.version}} make deb
          mv snclient*.deb ${{ env.BIN }}.deb
      - uses: actions/upload-artifact@v4.4.3
        with:
          name: "${{ env.BIN }}.deb"
          path: "${{ env.BIN }}.deb"
          if-no-files-found: error


  pkg-rpm:
    strategy:
      matrix:
        go-os: [linux]
        go-arch: [i386, x86_64, aarch64]
    runs-on: ubuntu-latest
    needs: [get-version, build, dist-linux-osx]
    env:
      BIN: "snclient-${{needs.get-version.outputs.version}}-${{ matrix.go-os }}-${{ matrix.go-arch }}"
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GOVERSION }}
      - uses: actions/download-artifact@v4
        with:
          name: "${{ env.BIN }}"
          path: "dist"
      - uses: actions/download-artifact@v4
        with:
          name: "dist"
          path: "dist"
      - run: |
          echo "Building ${{ env.BIN }}.rpm"
          GOOS=${{ matrix.go-os }} GOARCH=${{ matrix.go-arch }} VERSION=${{needs.get-version.outputs.version}} make rpm
          mv snclient*.rpm ${{ env.BIN }}.rpm
      - uses: actions/upload-artifact@v4.4.3
        with:
          name: "${{ env.BIN }}.rpm"
          path: "${{ env.BIN }}.rpm"
          if-no-files-found: error


  pkg-osx:
    strategy:
      matrix:
        go-os: [darwin]
        go-arch: [x86_64, aarch64]
    runs-on: macos-latest
    needs: [get-version, build-osx, dist-linux-osx]
    env:
      BIN: "snclient-${{needs.get-version.outputs.version}}-${{ matrix.go-os }}-${{ matrix.go-arch }}"
      DIST: "snclient-${{needs.get-version.outputs.version}}-osx-${{ matrix.go-arch }}"
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GOVERSION }}
      - uses: actions/download-artifact@v4
        with:
          name: "${{ env.BIN }}"
          path: "dist"
      - uses: actions/download-artifact@v4
        with:
          name: "dist"
          path: "dist"
      - run: |
          echo "Building ${{ env.DIST }}.pkg"
          export PATH="/usr/local/opt/openssl@3/bin:$PATH"
          make osx
          mv snclient*.pkg ${{ env.DIST }}.pkg
      - uses: actions/upload-artifact@v4.4.3
        with:
          name: "${{ env.DIST }}.pkg"
          path: "${{ env.DIST }}.pkg"
          if-no-files-found: error
      - uses: geekyeggo/delete-artifact@v5
        with:
            name: "${{ env.BIN }}"


  # remove those artifacts which have been converted to .deb or .rpm files
  clean-tmp-files:
    strategy:
      matrix:
        go-os: [linux]
        go-arch: [i386, x86_64, aarch64]
    runs-on: ubuntu-latest
    needs: [get-version,pkg-rpm,pkg-deb]
    env:
      BIN: "snclient-${{needs.get-version.outputs.version}}-${{ matrix.go-os }}-${{ matrix.go-arch }}"
    steps:
      - uses: geekyeggo/delete-artifact@v5
        with:
            name: "${{ env.BIN }}"


  integration-test-linux:
    strategy:
      matrix:
        go-os: [linux]
        go-arch: [x86_64]
    runs-on: ubuntu-latest
    needs: [get-version,pkg-deb]
    env:
      BIN: "snclient-${{needs.get-version.outputs.version}}-${{ matrix.go-os }}-${{ matrix.go-arch }}"
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GOVERSION }}
      - uses: actions/download-artifact@v4
        with:
          name: "${{ env.BIN }}.deb"
      - name: "Linux Integration Tests"
        run: |
          mv ${{ env.BIN }}.deb t/snclient.deb
          cd t
          SNCLIENT_INSTALL_TEST=1 go test -v


  integration-test-osx:
    strategy:
      matrix:
        go-os: [darwin]
        go-arch: [x86_64]
    runs-on: macos-latest
    needs: [get-version,pkg-osx]
    env:
      BIN: "snclient-${{needs.get-version.outputs.version}}-osx-${{ matrix.go-arch }}"
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GOVERSION }}
      - uses: actions/download-artifact@v4
        with:
          name: "${{ env.BIN }}.pkg"
      - name: "OSX Integration Tests"
        run: |
          mv ${{ env.BIN }}.pkg t/snclient.pkg
          cd t
          SNCLIENT_INSTALL_TEST=1 go test -v


  integration-test-windows:
    strategy:
      matrix:
        go-os: [windows]
        go-arch: [x86_64]
    runs-on: windows-latest
    needs: [get-version,pkg-msi]
    env:
      BIN: "snclient-${{needs.get-version.outputs.version}}-${{ matrix.go-os }}-${{ matrix.go-arch }}"
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GOVERSION }}
      - uses: actions/download-artifact@v4
        with:
          name: "windist"
          path: "windist"
      - uses: actions/download-artifact@v4
        with:
          name: "${{ env.BIN }}"
          path: "windist"
      - uses: actions/download-artifact@v4
        with:
          name: "${{ env.BIN }}.msi"
      - name: "Windows Integration Tests"
        run: |
          Move-Item -Path ${{ env.BIN }}.msi -Destination .\t\snclient.msi
          Copy-Item .\windist\windows_exporter-amd64.exe .\windist\windows_exporter.exe
          cd t
          $env:SNCLIENT_INSTALL_TEST = 1
          go test -v ; if ($LASTEXITCODE -ne 0) { exit 1 }
        shell: powershell


  # remove tmp artifacts
  clean-tmp-dist:
    runs-on: ubuntu-latest
    needs: [integration-test-linux, integration-test-osx, integration-test-windows]
    steps:
      - uses: geekyeggo/delete-artifact@v5
        with:
            name: |
                dist
                windist

  clean-tmp-winbin:
    strategy:
      matrix:
        go-os: [windows]
        go-arch: [i386, x86_64, aarch64]
    needs: [get-version, integration-test-windows]
    runs-on: windows-latest
    env:
      BIN: "snclient-${{needs.get-version.outputs.version}}-${{ matrix.go-os }}-${{ matrix.go-arch }}"
    steps:
      - uses: geekyeggo/delete-artifact@v5
        with:
            name: ${{ env.BIN }}

  make-release:
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    needs: [get-version,pkg-msi,pkg-deb,pkg-rpm,pkg-osx,integration-test-linux,integration-test-windows, integration-test-osx, test-linux, test-win, test-osx, test-bsd]
    outputs:
      release-upload-url: ${{ steps.create-release.outputs.upload_url }}
    steps:
      - uses: actions/checkout@v4
      - run: make release_notes.txt
      - id: create-release
        uses: softprops/action-gh-release@v2
        with:
          name: "v${{needs.get-version.outputs.version}}"
          tag_name: "v${{needs.get-version.outputs.version}}"
          draft: true
          body_path: "release_notes.txt"


  upload-windows-release-assets:
    if: startsWith(github.ref, 'refs/tags/')
    strategy:
      matrix:
        go-os: [windows]
        go-arch: [i386, x86_64, aarch64]
    runs-on: ubuntu-latest
    needs: [get-version,make-release]
    env:
      BIN: "snclient-${{needs.get-version.outputs.version}}-${{ matrix.go-os }}-${{ matrix.go-arch }}"
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: "${{ env.BIN }}.msi"
      - run: gh release upload v${{needs.get-version.outputs.version}} ${{ env.BIN }}.msi


  upload-linux-deb-assets:
    if: startsWith(github.ref, 'refs/tags/')
    strategy:
      matrix:
        go-os: [linux]
        go-arch: [i386, x86_64, aarch64]
    runs-on: ubuntu-latest
    needs: [get-version,make-release]
    env:
      BIN: "snclient-${{needs.get-version.outputs.version}}-${{ matrix.go-os }}-${{ matrix.go-arch }}"
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: "${{ env.BIN }}.deb"
      - run: gh release upload v${{needs.get-version.outputs.version}} ${{ env.BIN }}.deb


  upload-linux-rpm-assets:
    if: startsWith(github.ref, 'refs/tags/')
    strategy:
      matrix:
        go-os: [linux]
        go-arch: [i386, x86_64, aarch64]
    runs-on: ubuntu-latest
    needs: [get-version,make-release]
    env:
      BIN: "snclient-${{needs.get-version.outputs.version}}-${{ matrix.go-os }}-${{ matrix.go-arch }}"
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: "${{ env.BIN }}.rpm"
      - run: gh release upload v${{needs.get-version.outputs.version}} ${{ env.BIN }}.rpm


  upload-osx-pkg-assets:
    if: startsWith(github.ref, 'refs/tags/')
    strategy:
      matrix:
        go-os: [darwin]
        go-arch: [x86_64, aarch64]
    runs-on: ubuntu-latest
    needs: [get-version,make-release]
    env:
      BIN:  "snclient-${{needs.get-version.outputs.version}}-osx-${{ matrix.go-arch }}"
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: "${{ env.BIN }}.pkg"
      - run: gh release upload v${{needs.get-version.outputs.version}} ${{ env.BIN }}.pkg


  upload-binary-release-assets:
    if: startsWith(github.ref, 'refs/tags/')
    strategy:
      matrix:
        go-os: [freebsd]
        go-arch: [i386, x86_64, aarch64]
    runs-on: ubuntu-latest
    needs: [get-version,make-release]
    env:
      BIN: "snclient-${{needs.get-version.outputs.version}}-${{ matrix.go-os }}-${{ matrix.go-arch }}"
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: "${{ env.BIN }}"
      - run: tar cvzf ./${{ env.BIN }}.tar.gz ./*
      - run: gh release upload v${{needs.get-version.outputs.version}} ${{ env.BIN }}.tar.gz