validate_pr.yaml

name: validate pull request

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main
  release:
    types:
      - published

permissions:
  contents: none

jobs:
  validate:
    name: validate
    strategy:
      matrix:
        arch: [ x64, arm64 ]
    runs-on: ubuntu-${{ matrix.arch }}
    permissions:
      contents: read
      id-token: write
    container:
      image: ghcr.io/grafana/grafana-build-tools:v1.33.1@sha256:d9d13ce2394495341708f9b902883f7fa55782e3bd11b200f3faa53443f44508
      volumes:
        # This works as long as we are using self-hosted runners.
        #
        # Self-hosted runners have this file which is used to configure
        # buildkitd. The file is injected when the image is created.
        - /etc/buildkitd.toml:/etc/buildkitd.toml
    steps:
      - name: retrieve secrets
        id: get-secrets
        uses: grafana/shared-workflows/actions/get-vault-secrets@7d18a46aafb8b875ed76a0bc98852d74b91e7f91 # v1.0.0
        with:
          repo_secrets: |
            SM_CI_APP_ID=synthetic-monitoring-ci:app-id
            SM_CI_APP_PRIVATE_KEY=synthetic-monitoring-ci:private-key

      - name: create GitHub app token
        id: app-token
        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
        with:
          app-id: ${{ env.SM_CI_APP_ID }}
          private-key: ${{ env.SM_CI_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}

      - name: checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          fetch-tags: true
          persist-credentials: false

      - name: set up global git config
        run: |
          # The directory where the code has been checked out ends up belonging
          # to a different user, so git complains about permissions. Indicate
          # that it's safe to ignore.
          git config --global --add safe.directory '*'

      - name: identify platform
        id: id-platform
        run: |
          platform_goos=$(go env GOOS)
          platform_goarch=$(go env GOARCH)
          {
            echo "platform_goos=${platform_goos}";
            echo "platform_goarch=${platform_goarch}";
            echo "platform=${platform_goos}/${platform_goarch}"
          } >> "$GITHUB_OUTPUT"

      - name: create Git credentials
        id: git-credentials
        env:
          GITHUB_ACTOR: ${{ github.actor }}
          APP_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          echo "machine github.com login ${GITHUB_ACTOR} password ${APP_TOKEN}" >> ~/.netrc
          chmod 600 ~/.netrc

      - name: ensure dependencies are up-to-date
        run: |
          make deps
          scripts/enforce-clean

      - name: version
        id: version
        run: |
          make version
          echo "value=$(cat dist/version)" >> "$GITHUB_OUTPUT"

      - name: build
        run: make build-native
 
      - name: lint
        run: make lint

      - name: test
        run: make test

      - name: find Dockerfile
        id: find-dockerfile
        run: |
          if test -e Dockerfile ; then
            echo "found=true" >> "$GITHUB_OUTPUT"
          else
            echo "found=false" >> "$GITHUB_OUTPUT"
          fi

      - name: test docker build
        uses: grafana/shared-workflows/actions/build-push-to-dockerhub@05f46dbfcfffa2b38c50cd11b1f86ec823ebc73e # build-push-to-dockerhub/v0.4.2
        if: always() && steps.find-dockerfile.outputs.found == 'true'
        with:
          push: false
          cache-from: type=local,src=${{ runner.temp }}/.buildx-cache
          cache-to: type=local,dest=${{ runner.temp }}/.buildx-cache,mode=min
          platforms: |-
            ${{ steps.id-platform.outputs.platform }}
          tags: |-
            type=raw,value=${{ steps.version.outputs.value }}
            type=sha,prefix=sha-,format=short
            latest

      - name: prepare artifact
        run: |
          GOOS="${{ steps.id-platform.outputs.platform_goos }}"
          GOARCH="${{ steps.id-platform.outputs.platform_goarch }}"
          tar -cf "dist/binaries-${GOOS}-${GOARCH}.tar" "dist/${GOOS}-${GOARCH}/"

      - name: upload artifact
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        id: upload-artifact
        with:
          name: binaries-${{ steps.id-platform.outputs.platform_goos }}-${{ steps.id-platform.outputs.platform_goarch }}
          path: dist/binaries-${{ steps.id-platform.outputs.platform_goos }}-${{ steps.id-platform.outputs.platform_goarch }}.tar
          retention-days: 1

  release:
    # Do not try to release unless we are sure all the supported platforms have
    # been validated.
    #
    # Because this is running _after_ the release has been created by release
    # please, if the above validations fail, we end up without artifacts in the
    # release. That's arguably better than having *some* artifacts and not
    # others.
    name: release
    needs:
      - validate
    if: github.event_name == 'release'
    runs-on: ubuntu-arm64-small
    permissions:
      contents: read
      id-token: write
    steps:
      - name: retrieve secrets
        id: get-secrets
        uses: grafana/shared-workflows/actions/get-vault-secrets@7d18a46aafb8b875ed76a0bc98852d74b91e7f91 # v1.0.0
        with:
          repo_secrets: |
            SM_CI_APP_ID=synthetic-monitoring-ci:app-id
            SM_CI_APP_PRIVATE_KEY=synthetic-monitoring-ci:private-key

      - name: create GitHub app token
        id: app-token
        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
        with:
          app-id: ${{ env.SM_CI_APP_ID }}
          private-key: ${{ env.SM_CI_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}

      - name: checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 1
          fetch-tags: false
          persist-credentials: false

      - name: download artifacts
        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
        with:
          pattern: binaries-*
          github-token: ${{ steps.app-token.outputs.token }}

      - name: extract binaries
        run: |
          find binaries-* -name 'binaries-*.tar' -print0 | xargs -r -0 -n1 tar -xvpf

      - name: upload artifact to release
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          GITHUB_REF_NAME: ${{ github.ref_name }}
        run: |-
          ./scripts/release-binaries "${GITHUB_REF_NAME}"