“Naeel”
dd56bcda83
TOOLS/ — generators + scripts + config + ARCHITECTURE.md ├── yaml-generator/ (code) ├── resource-generator/ (code) ├── docs-generator/ (code) ├── scripts/ (← devops/*.sh) ├── config/ (← devops/profiles/ + devops/config/) │ ├── test/ profile.env, services_list.txt, operation_timeouts.json │ ├── prod/ │ └── dev/ └── ARCHITECTURE.md (← devops/ARCHITECTURE.md) generated/ — pipeline output only (gitignored) ├── test/resources_yaml/, go/, docs/, provider_build/ ├── prod/ └── dev/ provider/ — code only, no generated files resources_yaml/ — DELETED (generated) internal/resources_gen/ — DELETED (generated) devops/ — removed (replaced by TOOLS/scripts + TOOLS/config + generated/) Generators now fail if NUBES_*_DIR not set (no defaults to provider/). Provider requires pipeline to populate resources_gen/ before build.
116 lines
3.8 KiB
Bash
Executable File
116 lines
3.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Build and upload the Terraform provider to the registry S3 bucket.
|
|
#
|
|
# GPG signing key requirements:
|
|
# - A private key is required for signing SHA256SUMS.
|
|
# - The private key must be available at:
|
|
# ${ROOT_DIR}/secrets/private_key.asc
|
|
# - The private key is intentionally ignored by git.
|
|
#
|
|
# If the key is missing, generate it with a no-passphrase batch run, then
|
|
# export it to the expected location. Example (email only, no passphrase):
|
|
# GPG_DIR=${ROOT_DIR}/secrets
|
|
# GNUPGHOME=$(mktemp -d)
|
|
# cat > /tmp/gpg_batch <<'EOF'
|
|
# %no-protection
|
|
# Key-Type: RSA
|
|
# Key-Length: 3072
|
|
# Subkey-Type: RSA
|
|
# Subkey-Length: 3072
|
|
# Name-Real: tazet@narod.ru
|
|
# Name-Email: tazet@narod.ru
|
|
# Expire-Date: 0
|
|
# EOF
|
|
# gpg --batch --homedir "$GNUPGHOME" --gen-key /tmp/gpg_batch
|
|
# gpg --batch --homedir "$GNUPGHOME" --armor --export-secret-keys > "$GPG_DIR/private_key.asc"
|
|
# gpg --batch --homedir "$GNUPGHOME" --armor --export > "$GPG_DIR/public_key.asc"
|
|
# rm -rf "$GNUPGHOME" /tmp/gpg_batch
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
ROOT_DIR="${ROOT_DIR:-$(cd "${SCRIPT_DIR}/../.." && pwd)}"
|
|
PROVIDER_DIR="${PROVIDER_DIR:-${ROOT_DIR}/provider}"
|
|
BUILD_DIR="${BUILD_DIR:-${ROOT_DIR}/artifacts/provider_build}"
|
|
GPG_KEY_FILE="${GPG_KEY_FILE:-${ROOT_DIR}/secrets/private_key.asc}"
|
|
|
|
VERSION="${1:-2.0.2}"
|
|
REGISTRY_HOSTNAME="${REGISTRY_HOSTNAME:-terra.k8c.ru}"
|
|
NAMESPACE="${NAMESPACE:-nubes}"
|
|
PROVIDER_NAME="${PROVIDER_NAME:-nubes}"
|
|
S3_BUCKET="${S3_BUCKET:-terraform-registry}"
|
|
|
|
S3_ENDPOINT="${S3_ENDPOINT:-}"
|
|
S3_ACCESS_KEY="${S3_ACCESS_KEY:-}"
|
|
S3_SECRET_KEY="${S3_SECRET_KEY:-}"
|
|
|
|
if [[ -z "$S3_ENDPOINT" || -z "$S3_ACCESS_KEY" || -z "$S3_SECRET_KEY" ]]; then
|
|
echo "Error: S3_ENDPOINT/S3_ACCESS_KEY/S3_SECRET_KEY must be set" >&2
|
|
echo "Hint: see ${ROOT_DIR}/secrets/.s3cfg_registry" >&2
|
|
exit 2
|
|
fi
|
|
|
|
if [[ ! -f "$GPG_KEY_FILE" ]]; then
|
|
echo "Error: GPG key file not found at $GPG_KEY_FILE" >&2
|
|
exit 2
|
|
fi
|
|
|
|
if [[ ! -d "$PROVIDER_DIR" ]]; then
|
|
echo "Error: provider source dir not found: $PROVIDER_DIR" >&2
|
|
exit 2
|
|
fi
|
|
|
|
s3_endpoint_url="$S3_ENDPOINT"
|
|
if [[ "$s3_endpoint_url" != http* ]]; then
|
|
s3_endpoint_url="https://${s3_endpoint_url}"
|
|
fi
|
|
|
|
rm -rf "$BUILD_DIR"
|
|
mkdir -p "$BUILD_DIR"
|
|
|
|
build_and_zip() {
|
|
local os="$1"
|
|
local arch="$2"
|
|
local binary="terraform-provider-nubes_v${VERSION}"
|
|
|
|
if [[ "$os" == "windows" ]]; then
|
|
binary+=".exe"
|
|
fi
|
|
|
|
echo "Building for ${os}/${arch}..."
|
|
(cd "$PROVIDER_DIR" && CGO_ENABLED=0 GOOS="$os" GOARCH="$arch" go build -ldflags "-X main.version=${VERSION}" -o "${BUILD_DIR}/${binary}" .)
|
|
|
|
(cd "$BUILD_DIR" && python3 -m zipfile -c "terraform-provider-nubes_${VERSION}_${os}_${arch}.zip" "$binary")
|
|
rm -f "${BUILD_DIR:?}/${binary}"
|
|
}
|
|
|
|
build_and_zip linux amd64
|
|
build_and_zip windows amd64
|
|
build_and_zip darwin amd64
|
|
|
|
( cd "$BUILD_DIR" && sha256sum *.zip > "terraform-provider-nubes_${VERSION}_SHA256SUMS" )
|
|
|
|
GNUPGHOME="$(mktemp -d)"
|
|
export GNUPGHOME
|
|
trap 'rm -rf "$GNUPGHOME"' EXIT
|
|
|
|
gpg --batch --import "$GPG_KEY_FILE" >/dev/null
|
|
key_id=$(gpg --list-keys --with-colons | awk -F: '/^pub/{print $5; exit}')
|
|
if [[ -z "$key_id" ]]; then
|
|
echo "Error: failed to read key id from $GPG_KEY_FILE" >&2
|
|
exit 2
|
|
fi
|
|
|
|
gpg --batch --yes --detach-sign --default-key "$key_id" \
|
|
--output "${BUILD_DIR}/terraform-provider-nubes_${VERSION}_SHA256SUMS.sig" \
|
|
"${BUILD_DIR}/terraform-provider-nubes_${VERSION}_SHA256SUMS"
|
|
|
|
mc alias set registry "$s3_endpoint_url" "$S3_ACCESS_KEY" "$S3_SECRET_KEY" --api S3v4
|
|
S3_PATH="registry/${S3_BUCKET}/${REGISTRY_HOSTNAME}/${NAMESPACE}/${PROVIDER_NAME}/${VERSION}/"
|
|
|
|
echo "Uploading to: ${S3_PATH}"
|
|
mc cp "${BUILD_DIR}"/*.zip "$S3_PATH"
|
|
mc cp "${BUILD_DIR}/terraform-provider-nubes_${VERSION}_SHA256SUMS" "$S3_PATH"
|
|
mc cp "${BUILD_DIR}/terraform-provider-nubes_${VERSION}_SHA256SUMS.sig" "$S3_PATH"
|
|
|
|
echo "Done. Version ${VERSION} uploaded."
|