Skip to content

Commit 51fcbb0

Browse files
shubham-stepsecurityshubham-stepsecurity
committed
feat(mdm): migrate script to go module
1 parent e9e5cee commit 51fcbb0

47 files changed

Lines changed: 6257 additions & 101 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/go.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: Go
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
lint:
14+
name: Lint
15+
runs-on: macos-latest
16+
steps:
17+
- uses: actions/checkout@v4
18+
- uses: actions/setup-go@v5
19+
with:
20+
go-version-file: go.mod
21+
- uses: golangci/golangci-lint-action@v6
22+
with:
23+
version: latest
24+
25+
test:
26+
name: Test
27+
runs-on: macos-latest
28+
steps:
29+
- uses: actions/checkout@v4
30+
- uses: actions/setup-go@v5
31+
with:
32+
go-version-file: go.mod
33+
- run: make test
34+
35+
smoke:
36+
name: Smoke Tests
37+
runs-on: macos-latest
38+
needs: test
39+
steps:
40+
- uses: actions/checkout@v4
41+
- uses: actions/setup-go@v5
42+
with:
43+
go-version-file: go.mod
44+
- run: make smoke

‎.github/workflows/release.yml‎

Lines changed: 83 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,10 @@ jobs:
99
release:
1010
name: Build, Sign & Release
1111
runs-on: ubuntu-latest
12-
environment: release
1312
permissions:
14-
contents: write # create tag, release, and upload assets
15-
id-token: write # Sigstore OIDC keyless signing
16-
attestations: write # SLSA build provenance
13+
contents: write # create tag, release, and upload assets
14+
id-token: write # OIDC token for cosign keyless signing and build provenance
15+
attestations: write # SLSA build provenance
1716

1817
steps:
1918
- name: Harden the runner (Audit all outbound calls)
@@ -23,13 +22,15 @@ jobs:
2322

2423
- name: Checkout repository
2524
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
25+
with:
26+
fetch-depth: 0
2627

27-
- name: Extract version from script
28+
- name: Extract version from source
2829
id: version
2930
run: |
30-
version=$(grep -m1 '^AGENT_VERSION=' stepsecurity-dev-machine-guard.sh | sed 's/AGENT_VERSION="//;s/"//')
31+
version=$(grep -m1 'Version.*=' internal/buildinfo/version.go | sed 's/.*"\(.*\)".*/\1/')
3132
if [ -z "$version" ]; then
32-
echo "::error::Could not extract AGENT_VERSION from script"
33+
echo "::error::Could not extract Version from internal/buildinfo/version.go"
3334
exit 1
3435
fi
3536
tag="v${version}"
@@ -40,52 +41,97 @@ jobs:
4041
- name: Check tag does not already exist
4142
run: |
4243
if git rev-parse "refs/tags/${{ steps.version.outputs.tag }}" >/dev/null 2>&1; then
43-
echo "::error::Tag ${{ steps.version.outputs.tag }} already exists. Bump AGENT_VERSION in the script before releasing."
44+
echo "::error::Tag ${{ steps.version.outputs.tag }} already exists. Bump Version in internal/buildinfo/version.go before releasing."
4445
exit 1
4546
fi
4647
48+
- name: Create tag
49+
run: |
50+
git config user.name "github-actions[bot]"
51+
git config user.email "github-actions[bot]@users.noreply.github.com"
52+
git tag -a "${{ steps.version.outputs.tag }}" -m "Release ${{ steps.version.outputs.tag }}"
53+
git push origin "${{ steps.version.outputs.tag }}"
54+
55+
- name: Set up Go
56+
uses: actions/setup-go@v5
57+
with:
58+
go-version-file: go.mod
59+
60+
- name: Run GoReleaser
61+
uses: goreleaser/goreleaser-action@v6
62+
with:
63+
distribution: goreleaser
64+
version: latest
65+
args: release --clean
66+
env:
67+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
68+
4769
- name: Install cosign
4870
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
4971

50-
- name: Sign script with Sigstore (keyless)
72+
- name: Locate built binaries
73+
id: binaries
5174
run: |
52-
cosign sign-blob stepsecurity-dev-machine-guard.sh \
53-
--bundle stepsecurity-dev-machine-guard.sh.bundle \
54-
--yes
75+
# GoReleaser keeps binaries in build subdirs (e.g. _amd64_v1, _arm64_v8.0)
76+
AMD64=$(find dist -type f -name 'stepsecurity-dev-machine-guard' -path '*darwin_amd64*' | head -1)
77+
ARM64=$(find dist -type f -name 'stepsecurity-dev-machine-guard' -path '*darwin_arm64*' | head -1)
5578
56-
- name: Verify signature
79+
for label in "amd64:${AMD64}" "arm64:${ARM64}"; do
80+
name="${label%%:*}"
81+
path="${label#*:}"
82+
if [ -z "$path" ] || [ ! -f "$path" ]; then
83+
echo "::error::Binary not found for ${name}"
84+
echo "dist/ contents:"
85+
find dist -type f
86+
exit 1
87+
fi
88+
done
89+
90+
echo "amd64=${AMD64}" >> "$GITHUB_OUTPUT"
91+
echo "arm64=${ARM64}" >> "$GITHUB_OUTPUT"
92+
echo "Found amd64: ${AMD64}"
93+
echo "Found arm64: ${ARM64}"
94+
95+
- name: Sign artifacts with Sigstore (keyless)
5796
run: |
58-
cosign verify-blob stepsecurity-dev-machine-guard.sh \
59-
--bundle stepsecurity-dev-machine-guard.sh.bundle \
60-
--certificate-identity-regexp "github.com/step-security/dev-machine-guard" \
61-
--certificate-oidc-issuer "https://token.actions.githubusercontent.com"
97+
cosign sign-blob "${{ steps.binaries.outputs.amd64 }}" \
98+
--bundle dist/stepsecurity-dev-machine-guard_darwin_amd64.bundle --yes
99+
cosign sign-blob "${{ steps.binaries.outputs.arm64 }}" \
100+
--bundle dist/stepsecurity-dev-machine-guard_darwin_arm64.bundle --yes
101+
cosign sign-blob stepsecurity-dev-machine-guard.sh \
102+
--bundle dist/stepsecurity-dev-machine-guard.sh.bundle --yes
62103
63104
- name: Generate checksums
64105
run: |
65-
sha256sum stepsecurity-dev-machine-guard.sh > checksums.txt
66-
sha256sum stepsecurity-dev-machine-guard.sh.bundle >> checksums.txt
67-
echo "Checksums:"
68-
cat checksums.txt
106+
SUMS="dist/stepsecurity-dev-machine-guard_${{ steps.version.outputs.version }}_SHA256SUMS"
107+
sha256sum "${{ steps.binaries.outputs.amd64 }}" >> "$SUMS"
108+
sha256sum "${{ steps.binaries.outputs.arm64 }}" >> "$SUMS"
109+
sha256sum stepsecurity-dev-machine-guard.sh >> "$SUMS"
69110
70-
- name: Create tag
111+
- name: Upload signature bundles and checksums to release
112+
env:
113+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
71114
run: |
72-
git config user.name "github-actions[bot]"
73-
git config user.email "github-actions[bot]@users.noreply.github.com"
74-
git tag -a "${{ steps.version.outputs.tag }}" -m "Release ${{ steps.version.outputs.tag }}"
75-
git push origin "${{ steps.version.outputs.tag }}"
115+
gh release upload "${{ steps.version.outputs.tag }}" \
116+
dist/stepsecurity-dev-machine-guard_darwin_amd64.bundle \
117+
dist/stepsecurity-dev-machine-guard_darwin_arm64.bundle \
118+
dist/stepsecurity-dev-machine-guard.sh.bundle \
119+
dist/stepsecurity-dev-machine-guard_${{ steps.version.outputs.version }}_SHA256SUMS \
120+
--clobber
76121
77-
- name: Create GitHub Release
78-
uses: step-security/action-gh-release@d45511d7589f080cf54961ff056b9705a74fd160 # v2.5.0
79-
with:
80-
tag_name: ${{ steps.version.outputs.tag }}
81-
name: ${{ steps.version.outputs.tag }}
82-
generate_release_notes: true
83-
files: |
84-
stepsecurity-dev-machine-guard.sh
85-
stepsecurity-dev-machine-guard.sh.bundle
86-
checksums.txt
122+
- name: Mark release as immutable (not a draft, not a prerelease)
123+
env:
124+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
125+
run: |
126+
gh release edit "${{ steps.version.outputs.tag }}" \
127+
--draft=false \
128+
--prerelease=false \
129+
--latest
87130
88131
- name: Attest build provenance
89132
uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
90133
with:
91-
subject-path: stepsecurity-dev-machine-guard.sh
134+
subject-path: |
135+
${{ steps.binaries.outputs.amd64 }}
136+
${{ steps.binaries.outputs.arm64 }}
137+
stepsecurity-dev-machine-guard.sh

‎.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,9 @@
1717
!docs/**/*.html
1818
!images/**/*.html
1919

20+
# Go build artifacts
21+
/stepsecurity-dev-machine-guard
22+
dist/
23+
2024
# Temporary files
2125
todo-remove/

‎.goreleaser.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
version: 2
2+
project_name: stepsecurity-dev-machine-guard
3+
4+
builds:
5+
- id: stepsecurity-dev-machine-guard
6+
main: ./cmd/stepsecurity-dev-machine-guard
7+
binary: stepsecurity-dev-machine-guard
8+
goos:
9+
- darwin
10+
goarch:
11+
- amd64
12+
- arm64
13+
mod_timestamp: "{{ .CommitTimestamp }}"
14+
flags:
15+
- -trimpath
16+
ldflags:
17+
- -s -w
18+
- -X github.com/step-security/dev-machine-guard/internal/buildinfo.GitCommit={{.FullCommit}}
19+
- -X github.com/step-security/dev-machine-guard/internal/buildinfo.ReleaseTag={{.Tag}}
20+
- -X github.com/step-security/dev-machine-guard/internal/buildinfo.ReleaseBranch={{.Branch}}
21+
env:
22+
- CGO_ENABLED=0
23+
24+
archives:
25+
- format: binary
26+
name_template: "{{ .Binary }}_{{ .Os }}_{{ .Arch }}"
27+
28+
checksum:
29+
name_template: "{{ .ProjectName }}_{{ .Version }}_SHA256SUMS"
30+
algorithm: sha256
31+
32+
release:
33+
extra_files:
34+
- glob: stepsecurity-dev-machine-guard.sh

‎Makefile‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
BINARY := stepsecurity-dev-machine-guard
2+
MODULE := github.com/step-security/dev-machine-guard
3+
VERSION := $(shell grep -m1 'Version' internal/buildinfo/version.go | sed 's/.*"//;s/".*//')
4+
COMMIT := $(shell git rev-parse --short HEAD 2>/dev/null || echo "unknown")
5+
BRANCH := $(shell git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "unknown")
6+
TAG := $(shell git describe --tags --exact-match 2>/dev/null || echo "dev")
7+
LDFLAGS := -s -w \
8+
-X $(MODULE)/internal/buildinfo.GitCommit=$(COMMIT) \
9+
-X $(MODULE)/internal/buildinfo.ReleaseTag=$(TAG) \
10+
-X $(MODULE)/internal/buildinfo.ReleaseBranch=$(BRANCH)
11+
12+
.PHONY: build test lint clean smoke
13+
14+
build:
15+
go build -trimpath -ldflags "$(LDFLAGS)" -o $(BINARY) ./cmd/stepsecurity-dev-machine-guard
16+
17+
test:
18+
go test ./... -v -race -count=1
19+
20+
lint:
21+
golangci-lint run ./...
22+
23+
clean:
24+
rm -f $(BINARY)
25+
26+
smoke: build
27+
bash tests/test_smoke_go.sh

0 commit comments

Comments
 (0)