build-1password-cli.yml

---
# This workflow uses actions that are not certified by GitHub. They are provided
# by a third-party and are governed by separate terms of service, privacy
# policy, and support documentation.

name: Build 1password-cli
on:
  workflow_dispatch:
  push:
    branches: [main]
    paths:
      - ".github/workflows/build-1password-cli.yml"
      - "packages/1password-cli/**"
  pull_request:
    branches: [main]
    paths:
      - ".github/workflows/build-1password-cli.yml"
      - "packages/1password-cli/**"
  schedule:
    - cron: "0 0 * * *"

defaults:
  run:
    shell: bash

env:
  DOCKER_BUILDKIT: 1
  REGISTRY: ${{ vars.REGISTRY }}

permissions: read-all

jobs:
  lookup:
    runs-on: ubuntu-latest
    name: Lookup current version
    permissions:
      packages: write
      contents: read
    strategy:
      fail-fast: false

    container:
      image: ghcr.io/northwood-labs/package-builder/ubuntu-v22.04:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    outputs:
      cache_hit: ${{ steps.check.outputs.cache-hit }}
      package_version: ${{ steps.lookup_version.outputs.package_version }}

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          egress-policy: audit

      - name: Lookup latest version of package
        id: lookup_version
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "package_version=$(curl -sSLf https://app-updates.agilebits.com/check/1/0/CLI2/en/2000001/N | jq -Mr '.version')" >> $GITHUB_OUTPUT

      - name: Check to see if we've already built this version
        uses: actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        id: check
        with:
          key: "1password-cli-${{ steps.lookup_version.outputs.package_version }}"
          path: "packages/1password-cli/dist"
          lookup-only: true

  build:
    if: needs.lookup.outputs.cache_hit != 'true'
    needs: lookup
    runs-on: ubuntu-latest
    name: Build and cache
    strategy:
      fail-fast: false

    container:
      image: ghcr.io/northwood-labs/package-builder/ubuntu-v22.04:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
      options: --privileged

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          egress-policy: audit

      - name: Git clone
        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
        with:
          ref: ${{ github.base_ref }}

      - name: Build the package
        working-directory: packages/1password-cli
        env:
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
          GORELEASER_KEY: "${{ secrets.GORELEASER_KEY }}"
          GPG_KEY_B64: ${{ secrets.GPG_KEY_B64 }}
          RSA_KEY_B64: ${{ secrets.RSA_KEY_B64 }}
          NFPM_PASSPHRASE: "${{ secrets.GPG_PWD }}"
        run: |
          # We just need to set a git tag. None of the rest of this matters.
          git init
          git config user.email "you@example.com"
          git config user.name "Your Name"
          git add .
          git commit -m "Test"
          git remote add origin https://example.com
          git tag "${{ needs.lookup.outputs.package_version }}"

          # Decode the contents into files.
          echo -n "${GPG_KEY_B64}" | base64 --decode > 3C7658F0.asc
          echo -n "${RSA_KEY_B64}" | base64 --decode > signing.pem

          # Build the package
          goreleaser release --clean --nightly --skip=announce,publish,validate --verbose

      - name: Cache the packages
        uses: actions/cache/save@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        id: cache-packages
        with:
          key: "1password-cli-${{ needs.lookup.outputs.package_version }}"
          path: packages/1password-cli/dist

  upload:
    if: needs.lookup.outputs.cache_hit != 'true'
    needs: build
    name: Upload to S3
    uses: northwood-labs/package-building/.github/workflows/upload-to-s3.yml@main
    secrets: inherit
    with:
      package-name: "1password-cli"
      package-version: ${{ needs.lookup.outputs.package_version }}

  metadata_rpm:
    if: needs.lookup.outputs.cache_hit != 'true'
    needs: upload
    name: RPM metadata
    uses: northwood-labs/package-building/.github/workflows/generate-rpm-meta.yml@main
    secrets: inherit

  metadata_deb:
    if: needs.lookup.outputs.cache_hit != 'true'
    needs: upload
    name: DEB metadata
    uses: northwood-labs/package-building/.github/workflows/generate-deb-meta.yml@main
    secrets: inherit