127 lines
4.7 KiB
Bash
Executable File
127 lines
4.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
# Build and upload the Terraform provider to the registry S3 bucket.
|
||
#
|
||
# GPG signing key requirements:
|
||
# - A private key is required for signing SHA256SUMS.
|
||
# - The private key must be available at:
|
||
# ${ROOT_DIR}/secrets/private_key.asc
|
||
# - The private key is intentionally ignored by git.
|
||
#
|
||
# If the key is missing, generate it with a no-passphrase batch run, then
|
||
# export it to the expected location. Example (email only, no passphrase):
|
||
# GPG_DIR=${ROOT_DIR}/secrets
|
||
# GNUPGHOME=$(mktemp -d)
|
||
# cat > /tmp/gpg_batch <<'EOF'
|
||
# %no-protection
|
||
# Key-Type: RSA
|
||
# Key-Length: 3072
|
||
# Subkey-Type: RSA
|
||
# Subkey-Length: 3072
|
||
# Name-Real: tazet@narod.ru
|
||
# Name-Email: tazet@narod.ru
|
||
# Expire-Date: 0
|
||
# EOF
|
||
# gpg --batch --homedir "$GNUPGHOME" --gen-key /tmp/gpg_batch
|
||
# gpg --batch --homedir "$GNUPGHOME" --armor --export-secret-keys > "$GPG_DIR/private_key.asc"
|
||
# gpg --batch --homedir "$GNUPGHOME" --armor --export > "$GPG_DIR/public_key.asc"
|
||
# rm -rf "$GNUPGHOME" /tmp/gpg_batch
|
||
set -euo pipefail
|
||
|
||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||
ROOT_DIR="${ROOT_DIR:-$(cd "${SCRIPT_DIR}/../.." && pwd)}"
|
||
PROVIDER_DIR="${PROVIDER_DIR:-${ROOT_DIR}/provider}"
|
||
BUILD_DIR="${BUILD_DIR:-${ROOT_DIR}/artifacts/provider_build}"
|
||
GPG_KEY_FILE="${GPG_KEY_FILE:-${ROOT_DIR}/secrets/private_key.asc}"
|
||
|
||
# Гейт дрейфа: прямая сборка из общего provider/ запрещена.
|
||
# В provider/internal/resources_gen может лежать устаревшая копия (каталог
|
||
# в .gitignore, дрейф не виден в git). Канонический путь — через
|
||
# 03_build_and_upload_provider.sh: он собирает из временной копии со
|
||
# свежесгенерированным кодом. Детект дрейфа: TOOLS/scripts/check_generated_drift.sh.
|
||
if [[ "$PROVIDER_DIR" == "${ROOT_DIR}/provider" ]]; then
|
||
echo "Error: refused to build directly from the shared provider dir." >&2
|
||
echo " It may contain a stale generated copy of another stand." >&2
|
||
echo " Use: TOOLS/scripts/03_build_and_upload_provider.sh --profile <dev|test|prod>" >&2
|
||
exit 2
|
||
fi
|
||
|
||
VERSION="${1:-2.0.3}"
|
||
REGISTRY_HOSTNAME="${REGISTRY_HOSTNAME:-tf-registry.containerk8s.services.ngcloud.ru}"
|
||
NAMESPACE="${NAMESPACE:-nubes}"
|
||
PROVIDER_NAME="${PROVIDER_NAME:-nubes}"
|
||
S3_BUCKET="${S3_BUCKET:-nubes-terraform-registry}"
|
||
|
||
S3_ENDPOINT="${S3_ENDPOINT:-https://s3.msk-1.ngcloud.ru}"
|
||
S3_ACCESS_KEY="${S3_ACCESS_KEY:-}"
|
||
S3_SECRET_KEY="${S3_SECRET_KEY:-}"
|
||
|
||
if [[ -z "$S3_ACCESS_KEY" || -z "$S3_SECRET_KEY" ]]; then
|
||
echo "Error: S3_ACCESS_KEY/S3_SECRET_KEY must be set" >&2
|
||
exit 2
|
||
fi
|
||
|
||
if [[ ! -f "$GPG_KEY_FILE" ]]; then
|
||
echo "Error: GPG key file not found at $GPG_KEY_FILE" >&2
|
||
exit 2
|
||
fi
|
||
|
||
if [[ ! -d "$PROVIDER_DIR" ]]; then
|
||
echo "Error: provider source dir not found: $PROVIDER_DIR" >&2
|
||
exit 2
|
||
fi
|
||
|
||
s3_endpoint_url="$S3_ENDPOINT"
|
||
if [[ "$s3_endpoint_url" != http* ]]; then
|
||
s3_endpoint_url="https://${s3_endpoint_url}"
|
||
fi
|
||
|
||
rm -rf "$BUILD_DIR"
|
||
mkdir -p "$BUILD_DIR"
|
||
|
||
build_and_zip() {
|
||
local os="$1"
|
||
local arch="$2"
|
||
local binary="terraform-provider-nubes_v${VERSION}"
|
||
|
||
if [[ "$os" == "windows" ]]; then
|
||
binary+=".exe"
|
||
fi
|
||
|
||
echo "Building for ${os}/${arch}..."
|
||
(cd "$PROVIDER_DIR" && CGO_ENABLED=0 GOOS="$os" GOARCH="$arch" go build -ldflags="-X main.version=${VERSION} -X main.address=${REGISTRY_HOSTNAME}/${NAMESPACE}/${PROVIDER_NAME}" -o "${BUILD_DIR}/${binary}" .)
|
||
|
||
(cd "$BUILD_DIR" && python3 -m zipfile -c "terraform-provider-nubes_${VERSION}_${os}_${arch}.zip" "$binary")
|
||
rm -f "${BUILD_DIR:?}/${binary}"
|
||
}
|
||
|
||
build_and_zip linux amd64
|
||
build_and_zip windows amd64
|
||
build_and_zip darwin amd64
|
||
|
||
( cd "$BUILD_DIR" && sha256sum *.zip > "terraform-provider-nubes_${VERSION}_SHA256SUMS" )
|
||
|
||
GNUPGHOME="$(mktemp -d)"
|
||
export GNUPGHOME
|
||
trap 'rm -rf "$GNUPGHOME"' EXIT
|
||
|
||
gpg --batch --import "$GPG_KEY_FILE" >/dev/null
|
||
key_id=$(gpg --list-keys --with-colons | awk -F: '/^pub/{print $5; exit}')
|
||
if [[ -z "$key_id" ]]; then
|
||
echo "Error: failed to read key id from $GPG_KEY_FILE" >&2
|
||
exit 2
|
||
fi
|
||
|
||
gpg --batch --yes --detach-sign --default-key "$key_id" \
|
||
--output "${BUILD_DIR}/terraform-provider-nubes_${VERSION}_SHA256SUMS.sig" \
|
||
"${BUILD_DIR}/terraform-provider-nubes_${VERSION}_SHA256SUMS"
|
||
|
||
mc alias set prod-s3 "$s3_endpoint_url" "$S3_ACCESS_KEY" "$S3_SECRET_KEY" --api S3v4
|
||
S3_PATH="prod-s3/${S3_BUCKET}/${REGISTRY_HOSTNAME}/${NAMESPACE}/${PROVIDER_NAME}/${VERSION}/"
|
||
|
||
echo "Uploading to: ${S3_PATH}"
|
||
mc cp "${BUILD_DIR}"/*.zip "$S3_PATH"
|
||
mc cp "${BUILD_DIR}/terraform-provider-nubes_${VERSION}_SHA256SUMS" "$S3_PATH"
|
||
mc cp "${BUILD_DIR}/terraform-provider-nubes_${VERSION}_SHA256SUMS.sig" "$S3_PATH"
|
||
|
||
echo "Done. Version ${VERSION} uploaded."
|