ci: add attestations and artifact-metadata permissions to release wor… #85
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: CI | |
| on: | |
| workflow_call: ~ | |
| pull_request: | |
| branches: | |
| - main | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| env: | |
| # Ref: https://docs.astral.sh/uv/concepts/projects/sync/#checking-if-the-lockfile-is-up-to-date | |
| UV_FROZEN: "true" | |
| ## Concurrency only allowed in the main branch. | |
| ## So old builds running for old commits within the same Pull Request are cancelled | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install environment | |
| uses: ./.github/workflows/env-install | |
| - name: Lint | |
| run: uv run poe lint | |
| build: | |
| permissions: | |
| id-token: write | |
| attestations: write | |
| artifact-metadata: write | |
| needs: | |
| - lint | |
| strategy: | |
| matrix: | |
| os: | |
| - macos-15 | |
| - macos-15-intel | |
| - ubuntu-latest | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install environment | |
| uses: ./.github/workflows/env-install | |
| - name: Build | |
| run: uv run poe build | |
| - uses: actions/attest@v4 | |
| with: | |
| subject-path: "dist/*" | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: terranova-${{ matrix.os }} | |
| path: "dist/*" | |
| test: | |
| needs: | |
| - build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install environment | |
| uses: ./.github/workflows/env-install | |
| - name: Install terraform binary | |
| uses: hashicorp/setup-terraform@v4 | |
| with: | |
| terraform_wrapper: false | |
| - name: Test | |
| run: uv run poe test | |
| sanitize: | |
| needs: | |
| - test | |
| strategy: | |
| matrix: | |
| os: | |
| - macos-15 | |
| - macos-15-intel | |
| - ubuntu-latest | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install environment | |
| uses: ./.github/workflows/env-install | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| merge-multiple: true | |
| path: dist | |
| - name: Verify macOS amd64 binary | |
| run: | | |
| chmod +x ./dist/terranova-*-darwin-amd64 | |
| ./dist/terranova-*-darwin-amd64 --version || exit 1 | |
| if: runner.arch == 'X64' && runner.os == 'macOS' | |
| - name: Verify macOS arm64 binary | |
| run: | | |
| chmod +x ./dist/terranova-*-darwin-arm64 | |
| ./dist/terranova-*-darwin-arm64 --version || exit 1 | |
| if: runner.arch == 'ARM64' && runner.os == 'macOS' | |
| - name: Verify linux amd64 binary | |
| run: | | |
| chmod +x ./dist/terranova-*-linux-amd64 | |
| ./dist/terranova-*-linux-amd64 --version || exit 1 | |
| if: runner.arch == 'X64' && runner.os == 'Linux' | |
| - name: Verify linux arm64 binary | |
| run: | | |
| chmod +x ./dist/terranova-*-linux-arm64 | |
| ./dist/terranova-*-linux-arm64 --version || exit 1 | |
| if: runner.arch == 'ARM64' && runner.os == 'Linux' |