release_builds.yml

name: Releases

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'
      - 'v[0-9]+.[0-9]+.[0-9]+-alpha.[0-9]+'
      - 'v[0-9]+.[0-9]+.[0-9]+-beta.[0-9]+'
      - 'v[0-9]+.[0-9]+.[0-9]+-rc.[0-9]+'

      - 'v[0-9]+.[0-9]+.[0-9]+-sumo-[0-9]+'
      - 'v[0-9]+.[0-9]+.[0-9]+-sumo-[0-9]+-alpha.[0-9]+'
      - 'v[0-9]+.[0-9]+.[0-9]+-sumo-[0-9]+-beta.[0-9]+'
      - 'v[0-9]+.[0-9]+.[0-9]+-sumo-[0-9]+-rc.[0-9]+'

defaults:
  run:
    shell: bash

jobs:

  build:
    name: Build
    runs-on: ${{ matrix.runs_on }}
    strategy:
      matrix:
        include:
          - arch_os: linux_amd64
            runs_on: ubuntu-20.04
          - arch_os: linux_arm64
            runs_on: ubuntu-20.04
          - arch_os: windows_amd64
            runs_on: windows-2022
            builder_bin_path: '${RUNNER_TEMP}\bin'
            builder_bin_ext: .exe
    steps:
      - uses: actions/checkout@v3

      - name: Fetch current branch
        run: ./ci/fetch_current_branch.sh

      - name: Setup go
        uses: actions/setup-go@v3
        with:
          go-version: '1.19'

      # As described in
      # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
      - uses: actions/cache@v3
        with:
          path: |
            /home/runner/go/pkg/mod
            /home/runner/.cache/go-build
            /c/Users/runneradmin/go/pkg/mod
            /c/Users/runneradmin/AppData/Local/go-build
          key: ${{matrix.arch_os}}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{matrix.arch_os}}-go-

      - name: Set default BUILDER_BIN_PATH
        run: echo "BUILDER_BIN_PATH=${HOME}/bin" >> $GITHUB_ENV

      - name: Override BUILDER_BIN_PATH if set in matrix
        run: echo "BUILDER_BIN_PATH=${{matrix.builder_bin_path}}" >> $GITHUB_ENV
        if: matrix.builder_bin_path != ''

      - name: Extract tag
        id: extract_tag
        run: echo "::set-output name=tag::$(echo ${GITHUB_REF#refs/tags/v})"

      - name: Print tag
        run: echo "${{ steps.extract_tag.outputs.tag }}"

      - name: Add opentelemetry-collector-builder installation dir to PATH
        run: echo "$BUILDER_BIN_PATH" >> $GITHUB_PATH

      - name: Install opentelemetry-collector-builder
        run: make install-builder
        working-directory: ./otelcolbuilder

      - name: Prepare tags in otelcolbuilder's config
        run: make prepare-tag TAG=${{ steps.extract_tag.outputs.tag }}

      - name: Build
        run: make otelcol-sumo-${{matrix.arch_os}}
        working-directory: ./otelcolbuilder

      - name: Set filename
        id: set_filename
        run: echo "::set-output name=filename::$(echo otelcol-sumo-${{ steps.extract_tag.outputs.tag }}-${{matrix.arch_os}})${{matrix.builder_bin_ext}}"

      - name: Rename to include tag in filename
        run: cp otelcol-sumo-${{matrix.arch_os}}${{matrix.builder_bin_ext}} ${{ steps.set_filename.outputs.filename }}
        working-directory: ./otelcolbuilder/cmd

      - name: Show included modules
        working-directory: ./otelcolbuilder/cmd
        run: |
          go version -m ${{ steps.set_filename.outputs.filename }} | \
          grep -E "/(receiver|exporter|processor|extension)/" | \
          tee otelcol-sumo-${{matrix.arch_os}}_modules.txt

      - name: Sign Windows binary
        if: runner.os == 'Windows'
        uses: skymatic/code-sign-action@v2
        with:
          certificate: '${{ secrets.MICROSOFT_CERTIFICATE }}'
          password: '${{ secrets.MICROSOFT_CERTIFICATE_PASSWORD }}'
          certificatesha1: '${{ secrets.MICROSOFT_CERTHASH }}'
          certificatename: '${{ secrets.MICROSOFT_CERTNAME }}'
          description: '${{ secrets.MICROSOFT_DESCRIPTION }}'
          folder: ./otelcolbuilder/cmd

      - name: Store binary as action artifact
        uses: actions/upload-artifact@v3
        with:
          name: ${{matrix.arch_os}}
          path: ./otelcolbuilder/cmd/${{ steps.set_filename.outputs.filename }}
          if-no-files-found: error

  build-darwin:
    name: Build darwin
    runs-on: ${{ matrix.runs_on }}
    strategy:
      matrix:
        include:
          - arch_os: darwin_amd64
            runs_on: macos-latest
          - arch_os: darwin_arm64
            runs_on: macos-latest
    steps:
      - uses: actions/checkout@v3

      - name: Fetch current branch
        run: ./ci/fetch_current_branch.sh

      - name: Setup go
        uses: actions/setup-go@v3
        with:
          go-version: '1.19'

      # As described in
      # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
      - uses: actions/cache@v3
        with:
          path: |
            /Users/runner/go/pkg/mod
            /Users/runner/Library/Caches/go-build
          key: ${{matrix.arch_os}}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{matrix.arch_os}}-go-

      - name: Extract tag
        id: extract_tag
        run: echo "::set-output name=tag::$(echo ${GITHUB_REF#refs/tags/v})"

      - name: Add opentelemetry-collector-builder installation dir to PATH
        run: echo "$HOME/bin" >> $GITHUB_PATH

      - name: Install opentelemetry-collector-builder
        run: make install-builder
        working-directory: ./otelcolbuilder

      - name: Prepare tags in otelcolbuilder's config
        run: make prepare-tag TAG=${{ steps.extract_tag.outputs.tag }}

      - name: Build
        run: make otelcol-sumo-${{matrix.arch_os}}
        working-directory: ./otelcolbuilder

      - name: Set filename
        id: set_filename
        run: echo "::set-output name=filename::$(echo otelcol-sumo-${{ steps.extract_tag.outputs.tag }}-${{matrix.arch_os}})"

      - name: Import Code-Signing Certificates
        uses: Apple-Actions/import-codesign-certs@v1
        with:
          # The certificates in a PKCS12 file encoded as a base64 string
          p12-file-base64: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12_BASE64 }}
          # The password used to import the PKCS12 file.
          p12-password: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}

      # NOTE: gon's brew tap (as many others) has stopped working for some reason.
      # Related issue: https://github.com/mitchellh/gon/issues/56
      # - name: Install gon via HomeBrew for code signing and app notarization
      #   run: |
      #     brew tap mitchellh/gon
      #     brew install mitchellh/gon/gon

      - name: Install gon for code signing and app notarization
        run: |
          curl -Lo gon.dmg https://github.com/mitchellh/gon/releases/download/v0.2.3/gon_macos.dmg
          sudo hdiutil attach gon.dmg
          cp /Volumes/gon/gon "$HOME/bin"

      - name: Sign the mac binaries with Gon
        env:
          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
        working-directory: ./otelcolbuilder/
        run: make ${{matrix.arch_os}}-sign

      - name: Rename .dmg to include tag in filename
        run: cp otelcol-sumo-${{matrix.arch_os}}.dmg ${{ steps.set_filename.outputs.filename }}.dmg
        working-directory: ./otelcolbuilder/cmd

      - name: Rename binary to include tag in filename
        run: cp otelcol-sumo-${{matrix.arch_os}} ${{ steps.set_filename.outputs.filename }}
        working-directory: ./otelcolbuilder/cmd

      - name: Show included modules
        working-directory: ./otelcolbuilder/cmd
        run: |
          go version -m ${{ steps.set_filename.outputs.filename }} | \
          grep -E "/(receiver|exporter|processor|extension)/" | \
          tee otelcol-sumo-${{matrix.arch_os}}_modules.txt

      # Store binary and .dmg into pipeline artifacts after they have been signed

      - name: Store .dmg as action artifact
        uses: actions/upload-artifact@v3
        with:
          name: ${{matrix.arch_os}}.dmg
          path: ./otelcolbuilder/cmd/${{ steps.set_filename.outputs.filename }}.dmg
          if-no-files-found: error

      - name: Store binary as action artifact
        uses: actions/upload-artifact@v3
        with:
          name: ${{matrix.arch_os}}
          path: ./otelcolbuilder/cmd/${{ steps.set_filename.outputs.filename }}
          if-no-files-found: error

  # pipeline to build FIPS compliance binary on Go+BoringCrypto
  build-fips:
    name: Build
    runs-on: ubuntu-20.04
    strategy:
      matrix:
        go: [ '1.18.7b7' ]
        arch_os: [ 'linux_amd64' ]
    steps:
      - uses: actions/checkout@v3

      - name: Fetch current branch
        run: ./ci/fetch_current_branch.sh

      - name: Install Go+BoringCrypto
        run: |
          curl -LJ "https://go-boringcrypto.storage.googleapis.com/go${{ matrix.go }}.linux-amd64.tar.gz" -o go.linux-amd64.tar.gz \
            && sudo rm -rf /usr/local/go \
            && sudo tar -C /usr/local -xzf go.linux-amd64.tar.gz \
            && sudo rm go.linux-amd64.tar.gz \
            && sudo ln -s /usr/local/go/bin/go /usr/local/bin

      # As described in
      # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
      - uses: actions/cache@v3
        with:
          path: |
            /home/runner/go/pkg/mod
            /home/runner/.cache/go-build
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-

      - name: Extract tag
        id: extract_tag
        run: echo "::set-output name=tag::$(echo ${GITHUB_REF#refs/tags/v})"

      - name: Add opentelemetry-collector-builder installation dir to PATH
        run: echo "$HOME/bin" >> $GITHUB_PATH

      - name: Install opentelemetry-collector-builder
        run: make install-builder
        working-directory: ./otelcolbuilder

      - name: Prepare tags in otelcolbuilder's config
        run: make prepare-tag TAG=${{ steps.extract_tag.outputs.tag }}

      - name: Build
        run: make otelcol-sumo-${{matrix.arch_os}} FIPS_SUFFIX="-fips" CGO_ENABLED=1
        working-directory: ./otelcolbuilder

      - name: Set filename
        id: set_filename
        run: echo "::set-output name=filename::$(echo otelcol-sumo-${{ steps.extract_tag.outputs.tag }}-fips-${{matrix.arch_os}})"

      - name: Rename to include tag in filename
        run: cp otelcol-sumo-fips-${{matrix.arch_os}} ${{ steps.set_filename.outputs.filename }}
        working-directory: ./otelcolbuilder/cmd

      - name: Show BoringSSL symbols
        working-directory: ./otelcolbuilder/cmd
        run: |
          go tool nm ${{ steps.set_filename.outputs.filename }} | \
          grep "_Cfunc__goboringcrypto_"

      - name: Show included modules
        working-directory: ./otelcolbuilder/cmd
        run: |
          go version -m ${{ steps.set_filename.outputs.filename }} | \
          grep -E "/(receiver|exporter|processor|extension)/" | \
          tee otelcol-sumo-fips-${{matrix.arch_os}}_modules.txt

      - name: Store binary as action artifact
        uses: actions/upload-artifact@v3
        with:
          name: ${{matrix.arch_os}}
          path: ./otelcolbuilder/cmd/${{ steps.set_filename.outputs.filename }}
          if-no-files-found: error

  build-container-images:
    name: Build container
    runs-on: ubuntu-20.04
    needs:
      - build
      - build-fips
    strategy:
      matrix:
        arch_os: [ 'linux_amd64', 'linux_arm64']
    steps:
      - uses: actions/checkout@v3

      - name: Extract tag
        id: extract_tag
        run: echo "::set-output name=tag::$(echo ${GITHUB_REF#refs/tags/v})"

      - name: Print tag
        run: echo "${{ steps.extract_tag.outputs.tag }}"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2.1.0

      - name: Set up Buildx
        id: buildx
        uses: docker/setup-buildx-action@v2.4.1

      - name: Show Buildx platforms
        run: echo ${{ steps.buildx.outputs.platforms }}

      - name: Set filename
        id: set_filename
        run: echo "::set-output name=filename::$(echo otelcol-sumo-${{ steps.extract_tag.outputs.tag }}-${{matrix.arch_os}})"

      - name: Set filename for FIPS
        id: set_filename_fips
        run: echo "::set-output name=filename_fips::$(echo otelcol-sumo-${{ steps.extract_tag.outputs.tag }}-fips-${{matrix.arch_os}})"

      - name: Login to Open Source ECR
        run: make login
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

      - name: Download binary action artifact from build phase (regular binary and FIPS binary)
        uses: actions/download-artifact@v3
        with:
          name: ${{matrix.arch_os}}
          path: artifacts/

      - name: Build and push FIPS image to Open Source ECR
        if: matrix.arch_os == 'linux_amd64'
        run: |
          cp artifacts/${{ steps.set_filename_fips.outputs.filename_fips }} otelcol-sumo
          make build-push-container-multiplatform \
            BUILD_TAG=${{ steps.extract_tag.outputs.tag }}-fips \
            PLATFORM=${{ matrix.arch_os }} \
            LATEST_TAG_FIPS_SUFFIX="-fips"

      - name: Build and push image to Open Source ECR
        run: |
          cp artifacts/${{ steps.set_filename.outputs.filename }} otelcol-sumo
          make build-push-container-multiplatform \
            BUILD_TAG=${{ steps.extract_tag.outputs.tag }} \
            PLATFORM=${{ matrix.arch_os }}

  push-docker-manifest:
    name: Push joint container manifest
    runs-on: ubuntu-20.04
    needs:
      # Require darwin build to succeed to prevent pushing container images
      # when darwin build fails.
      - build-darwin
      - build-container-images
    steps:
      - uses: actions/checkout@v3

      - name: Extract tag
        id: extract_tag
        run: echo "::set-output name=tag::$(echo ${GITHUB_REF#refs/tags/v})"

      - name: Print tag
        run: echo "${{ steps.extract_tag.outputs.tag }}"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2.1.0

      - name: Set up Buildx
        id: buildx
        uses: docker/setup-buildx-action@v2.4.1

      - name: Show Buildx platforms
        run: echo ${{ steps.buildx.outputs.platforms }}

      - name: Login to Open Source ECR
        run: make login
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

      - name: Push joint FIPS container manifest for all platforms to Open Source ECR
        run: |
          make push-container-manifest \
            BUILD_TAG=${{ steps.extract_tag.outputs.tag }}-fips \
            PLATFORMS="linux/amd64" \
            LATEST_TAG_FIPS_SUFFIX="-fips"

      - name: Push joint container manifest for all platforms to Open Source ECR
        run: |
          make push-container-manifest \
            BUILD_TAG=${{ steps.extract_tag.outputs.tag }} \
            PLATFORMS="linux/amd64 linux/arm64"

  package-msi:
    name: Package MSI
    runs-on: windows-2019
    needs:
      - build
    steps:
      - uses: actions/checkout@v3

      - name: Fetch current branch
        run: ./ci/fetch_current_branch.sh

      - name: Add msbuild to PATH
        uses: microsoft/setup-msbuild@v1.3

      - name: Fetch binary artifact for windows/amd64
        uses: actions/download-artifact@v3
        with:
          name: windows_amd64
          path: ./otelcolbuilder/cmd

      - name: Rename binary for windows/amd64
        working-directory: ./otelcolbuilder/cmd
        run: mv otelcol-sumo-*-sumo-*-windows_amd64.exe otelcol-sumo-windows_amd64.exe

      - name: Set VERSION_TAG
        run: echo "VERSION_TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV

      - name: Set PRODUCT_VERSION
        run: echo "PRODUCT_VERSION=$(./ci/get_productversion.sh)" >> $GITHUB_ENV

      - name: Build MSI for windows/amd64
        working-directory: ./packaging/msi/wix
        run: msbuild.exe -p:Configuration=Release -p:Platform=x64 -p:ProductVersion=$PRODUCT_VERSION -Restore

      - name: Sign MSI
        uses: skymatic/code-sign-action@v2
        with:
          certificate: '${{ secrets.MICROSOFT_CERTIFICATE }}'
          password: '${{ secrets.MICROSOFT_CERTIFICATE_PASSWORD }}'
          certificatesha1: '${{ secrets.MICROSOFT_CERTHASH }}'
          certificatename: '${{ secrets.MICROSOFT_CERTNAME }}'
          description: '${{ secrets.MICROSOFT_DESCRIPTION }}'
          folder: ./packaging/msi/wix/bin/x64/en-US

      - name: Store MSI as action artifact for windows/amd64
        uses: actions/upload-artifact@v3
        with:
          name: windows_amd64_msi
          path: ./packaging/msi/wix/bin/x64/en-US/*.msi
          if-no-files-found: error

  create-release:
    name: Create Github release
    runs-on: ubuntu-20.04
    needs:
      - build
      - build-darwin
      - build-fips
      - build-container-images
      - push-docker-manifest
      - package-msi
    steps:
      - name: Extract tag
        id: extract_tag
        run: echo "::set-output name=tag::$(echo ${GITHUB_REF#refs/tags/v})"

      - name: Print tag
        run: echo "v${{ steps.extract_tag.outputs.tag }}"

      - name: Download all binaries stored as artifact
        uses: actions/download-artifact@v3
        with:
          path: artifacts/

      - uses: ncipollo/release-action@v1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          draft: true
          prerelease: false

          allowUpdates: true
          omitBodyDuringUpdate: true
          omitNameDuringUpdate: true

          body: |
            ## v${{ steps.extract_tag.outputs.tag }}

            **TODO**

            ### Upstream releases
            ** TODO: Add upstream versions in the links below**
            Core: https://github.com/open-telemetry/opentelemetry-collector/releases/tag/v
            Contrib: https://github.com/open-telemetry/opentelemetry-collector-contrib/releases/tag/v

            ### Changelog

            **TODO**

            ### Container images:

            ```
            docker pull public.ecr.aws/sumologic/sumologic-otel-collector:${{ steps.extract_tag.outputs.tag }}
            ```

          artifacts: "artifacts/*/*"
          artifactErrorsFailBuild: true
          replacesArtifacts: true