Merge pull request #19418 from cevich/dry_run_actions

[CI:DOCS] GHA: Support testing build/sign workflows

.github/workflows/mac-pkg.yml

@@ -8,8 +8,18 @@ on:
       version:
         description: 'Release version to build and upload (e.g. "v4.2.1")'
         required: true
+      dryrun:
+        description: 'Perform all the steps except uploading to the release page'
+        required: true
+        default: "true"  # 'choice' type requires string value
+        type: choice
+        options:
+          - "true"  # Must be quoted string, boolean value not supported.
+          - "false"
+
 permissions:
   contents: write
+
 jobs:
   build:
     runs-on: macos-latest
@@ -26,10 +36,24 @@ jobs:
 
       KEYCHAIN_PWD: ${{ secrets.MACOS_CI_KEYCHAIN_PWD }}
     steps:
+    - name: Consolidate dryrun setting to always be true or false
+      id: actual_dryrun
+      run: |
+        # The 'release' trigger will not have a 'dryrun' input set. Handle
+        # this case in a readable/maintainable way.
+        if [[ -z "${{ inputs.dryrun }}" ]]
+        then
+          echo "dryrun=false" >> $GITHUB_OUTPUT
+        else
+          echo "dryrun=${{ inputs.dryrun }}" >> $GITHUB_OUTPUT
+        fi
+    - name: Dry Run Status
+      run: |
+        echo "::notice::This workflow execution will be a dry-run: ${{ steps.actual_dryrun.outputs.dryrun }}"
     - name: Determine Version
       id: getversion
       run: |
-        if [ -z "${{ inputs.version }}" ]
+        if [[ -z "${{ inputs.version }}" ]]
         then
               VERSION=${{ github.event.release.tag_name }}
         else
@@ -48,7 +72,7 @@ jobs:
         if [[ "$status" == "404" ]] ; then
           echo "buildarm=true" >> $GITHUB_OUTPUT
         else
-          echo "ARM installer already exists, skipping"
+          echo "::warning::ARM installer already exists, skipping"
           echo "buildarm=false" >> $GITHUB_OUTPUT
         fi
 
@@ -56,23 +80,31 @@ jobs:
         if [[ "$status" == "404" ]] ; then
           echo "buildamd=true" >> $GITHUB_OUTPUT
         else
-          echo "AMD installer already exists, skipping"
+          echo "::warning::AMD installer already exists, skipping"
           echo "buildamd=false" >> $GITHUB_OUTPUT
         fi
     - name: Checkout Version
-      # If no binaries need to be built, then there's no reason to Checkout
+      if: >-
-      if: steps.check.outputs.buildamd == 'true' || steps.check.outputs.buildarm == 'true'
+        steps.check.outputs.buildamd == 'true' ||
+        steps.check.outputs.buildarm == 'true' ||
+        steps.actual_dryrun.outputs.dryrun == 'true'
       uses: actions/checkout@v3
       with:
         ref: ${{steps.getversion.outputs.version}}
     - name: Set up Go
-      # If no binaries need to be built, then there's no reason to set up Go
+      # Conditional duplication sucks - GHA doesn't grok YAML anchors/aliases
-      if: steps.check.outputs.buildamd == 'true' || steps.check.outputs.buildarm == 'true'
+      if: >-
+        steps.check.outputs.buildamd == 'true' ||
+        steps.check.outputs.buildarm == 'true' ||
+        steps.actual_dryrun.outputs.dryrun == 'true'
       uses: actions/setup-go@v4
       with:
         go-version: stable
     - name: Create Keychain
-      if: steps.check.outputs.buildamd == 'true' || steps.check.outputs.buildarm == 'true'
+      if: >-
+        steps.check.outputs.buildamd == 'true' ||
+        steps.check.outputs.buildarm == 'true' ||
+        steps.actual_dryrun.outputs.dryrun == 'true'
       run: |
         echo $APPLICATION_CERTIFICATE | base64 --decode -o appcert.p12
         echo $INSTALLER_CERTIFICATE | base64 --decode -o instcert.p12
@@ -86,26 +118,32 @@ jobs:
 
         xcrun notarytool store-credentials "notarytool-profile" --apple-id "$NOTARIZE_USERNAME" --team-id "$NOTARIZE_TEAM" --password "$NOTARIZE_PASSWORD" &> /dev/null
     - name: Build and Sign ARM
-      if: steps.check.outputs.buildarm == 'true'
+      if: steps.check.outputs.buildarm == 'true' || steps.actual_dryrun.outputs.dryrun == 'true'
       working-directory: contrib/pkginstaller
       run: |
         make ARCH=aarch64 notarize &> /dev/null
         cd out && shasum -a 256 podman-installer-macos-arm64.pkg >> shasums
     - name: Build and Sign AMD
-      if: steps.check.outputs.buildamd == 'true'
+      if: steps.check.outputs.buildamd == 'true' || steps.actual_dryrun.outputs.dryrun == 'true'
       working-directory: contrib/pkginstaller
       run: |
         make ARCH=amd64 notarize &> /dev/null
         cd out && shasum -a 256 podman-installer-macos-amd64.pkg >> shasums
     - name: Artifact
-      if: steps.check.outputs.buildamd == 'true' || steps.check.outputs.buildarm == 'true'
+      if: >-
+        steps.check.outputs.buildamd == 'true' ||
+        steps.check.outputs.buildarm == 'true' ||
+        steps.actual_dryrun.outputs.dryrun == 'true'
       uses: actions/upload-artifact@v3
       with:
         name: installers
         path: |
           contrib/pkginstaller/out/podman-installer-macos-*.pkg
     - name: Upload to Release
-      if: steps.check.outputs.buildamd == 'true' || steps.check.outputs.buildarm == 'true'
+      if: >-
+        steps.actual_dryrun.outputs.dryrun == 'false' &&
+        (steps.check.outputs.buildamd == 'true' ||
+         steps.check.outputs.buildarm == 'true')
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: |

.github/workflows/upload-win-installer.yml

@@ -8,12 +8,38 @@ on:
       version:
         description: 'Release version to build and upload (e.g. "4.2.1")'
         required: true
+      dryrun:
+        description: 'Perform all the steps except uploading to the release page'
+        required: true
+        default: "true"  # 'choice' type requires string value
+        type: choice
+        options:
+          - "true"  # Must be quoted string, boolean value not supported.
+          - "false"
+
+permissions:
+  contents: write
+
 jobs:
   build:
     runs-on: windows-latest
     env:
         FETCH_BASE_URL: ${{ github.server_url }}/${{ github.repository }}
     steps:
+    - name: Consolidate dryrun setting to always be true or false
+      id: actual_dryrun
+      run: |
+        # The 'release' trigger will not have a 'dryrun' input set. Handle
+        # this case in a readable/maintainable way.
+        $inputs_dryrun = "${{ inputs.dryrun }}"
+        if ($inputs_dryrun.Length -lt 1) {
+          Write-Output "dryrun=false" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+        } else {
+          Write-Output "dryrun=${{ inputs.dryrun }}" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+        }
+    - name: Dry Run Status
+      run: |
+        Write-Output "::notice::This workflow execution will be a dry-run: ${{ steps.actual_dryrun.outputs.dryrun }}"
     - name: Determine version
       id: getversion
       run: |
@@ -21,12 +47,14 @@ jobs:
         if ($version.Length -lt 1) {
           $version = "${{ github.event.release.tag_name }}"
           if ($version.Length -lt 1) {
-            Write-Host "Could not determine version!"
+            Write-Host "::error::Could not determine version!"
             Exit 1
           }
         }
-        Write-Output "::set-output name=version::$version"
+        Write-Output "version=$version" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
     - uses: actions/checkout@v3
+      with:
+        ref: ${{steps.getversion.outputs.version}}
     - name: Check
       id: check
       run: |
@@ -34,20 +62,29 @@ jobs:
         .\check.ps1 ${{steps.getversion.outputs.version}}
         $code = $LASTEXITCODE
         if ($code -eq 2) {
-          Write-Output "::set-output name=already-exists::true"
+          Write-Output "already-exists=true" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
           Pop-Location
           Exit 0
         }
-        Write-Output "UPLOAD_ASSET_NAME=$env:UPLOAD_ASSET_NAME" | Out-File -FilePath $env:GITHUB_ENV -Append
+        Write-Output "upload_asset_name=$env:UPLOAD_ASSET_NAME" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
         Pop-Location
         Exit $code
+    # The podman release process requires a cross-compile of the windows binaries be uploaded to
+    # the release page as a hard-coded filename.  If non-existent, this workflow will fail in
+    # non-obvious ways with a non-obvious error message.  Address that here.
+    - name: Confirm upload_asset_name is non-empty
+      if: ${{ steps.check.outputs.upload_asset_name == '' }}
+      run: |
+          Write-Output "::error::check.ps1 script failed to find manually uploaded podman-remote-release-windows_md64.zip github release asset for version ${{steps.getversion.outputs.version}}."
+          Exit 1
     - name: Set up Go
       uses: actions/setup-go@v4
-      if: steps.check.outputs.already-exists != 'true'
+      # N/B: already-exists may be an empty-string or "false", handle both cases.
+      if: steps.check.outputs.already-exists != 'true' || steps.actual_dryrun.outputs.dryrun == 'true'
       with:
         go-version: stable
     - name: Setup Signature Tooling
-      if: steps.Check.outputs.already-exists != 'true'
+      if: steps.Check.outputs.already-exists != 'true' || steps.actual_dryrun.outputs.dryrun == 'true'
       run: |
           dotnet tool install --global AzureSignTool --version 3.0.0
           echo "CERT_NAME=${{secrets.AZ_CERT_NAME}}" | Out-File -FilePath $env:GITHUB_ENV -Append
@@ -57,20 +94,29 @@ jobs:
           echo "CLIENT_SECRET=${{secrets.AZ_CLIENT_SECRET}}" | Out-File -FilePath $env:GITHUB_ENV -Append
     - name: Build
       id: build
-      if: steps.check.outputs.already-exists != 'true'
+      if: steps.check.outputs.already-exists != 'true' || steps.actual_dryrun.outputs.dryrun == 'true'
       run: |
         Push-Location contrib\win-installer
         .\build.ps1 ${{steps.getversion.outputs.version}} prod
         $code = $LASTEXITCODE
         if ($code -eq 2) {
-          Write-Output "::set-output name=artifact-missing::true"
+          Write-Output "artifact-missing=true" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
           Pop-Location
           Exit 0
         }
         Pop-Location
         Exit $code
+    - name: Artifact
+      if: steps.check.outputs.already-exists != 'true' || steps.actual_dryrun.outputs.dryrun == 'true'
+      uses: actions/upload-artifact@v3
+      with:
+        name: installer
+        path: ${{ steps.check.outputs.upload_asset_name }}
     - name: Upload
-      if: steps.check.outputs.already-exists != 'true' && steps.build.outputs.artifact-missing != 'true'
+      if: >-
+        steps.actual_dryrun.outputs.dryrun == 'false' &&
+        steps.check.outputs.already-exists != 'true' &&
+        steps.build.outputs.artifact-missing != 'true'
       env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: |
@@ -79,7 +125,7 @@ jobs:
         if ($version[0] -ne "v") {
           $version = "v$version"
         }
-        gh release upload $version $ENV:UPLOAD_ASSET_NAME
+        gh release upload $version ${{ steps.check.outputs.upload_asset_name }}
         if ($LASTEXITCODE -ne 0) {
           .\check.ps1 $version
           if ($LASTEXITCODE -eq 2) {