use GitHub Actions for CI and publishing (#100)

Co-authored-by: Armin <[email protected]>

.github/workflows/build.yml

@@ -0,0 +1,86 @@
+name: Build
+
+on:
+  push:
+    branches: [master]
+    tags-ignore:
+      - '**'
+
+  pull_request:
+    branches: [master]
+
+  release:
+    types: [published]
+
+jobs:
+  Verify:
+    runs-on: ubuntu-latest
+
+    env:
+      GOPATH: /home/runner/go
+
+    steps:
+    - uses: actions/checkout@v2
+      with:
+        fetch-depth: 0
+
+    - name: Set up Go
+      uses: actions/setup-go@v2
+      with:
+        go-version: 1.14
+
+    - name: Cache Godel assets
+      uses: actions/cache@v2
+      with:
+        path: ~/.godel
+        key: ${{ runner.os }}-godel-${{ hashFiles('godelw', 'godel/config/godel.yml') }}
+        restore-keys: |
+          ${{ runner.os }}-godel-
+
+    - name: Verify
+      run: ./godelw verify --apply=false
+
+  Dist:
+    runs-on: ubuntu-latest
+    needs:
+      - Verify
+
+    env:
+      GOPATH: /home/runner/go
+
+    steps:
+    - uses: actions/checkout@v2
+      with:
+        fetch-depth: 0
+
+    - name: Set up Go
+      uses: actions/setup-go@v2
+      with:
+        go-version: 1.14
+
+    - name: Cache Godel assets
+      uses: actions/cache@v2
+      with:
+        path: ~/.godel
+        key: ${{ runner.os }}-godel-${{ hashFiles('godelw', 'godel/config/godel.yml') }}
+        restore-keys: |
+          ${{ runner.os }}-godel-
+
+    - name: Build distribution
+      run: ./godelw dist
+
+    - name: Archive distribution
+      uses: actions/upload-artifact@v2
+      with:
+        name: dist
+        path: |
+          out/dist/bouncer/*/os-arch-bin/*.tgz
+
+    #
+    # Steps after this point should only run when publishing
+    # Include them here to avoid exporting the Docker container as an artifact
+    #
+
+    - name: Publish release assets
+      if: ${{ github.event_name == 'release' }}
+      run: ./godelw publish github --add-v-prefix --api-url=${GITHUB_API_URL} --user=palantir --repository=bouncer --token=${{ secrets.GITHUB_TOKEN }}

godel/config/godel.properties

@@ -1,2 +1,2 @@
-distributionURL=https://palantir.bintray.com/releases/com/palantir/godel/godel/2.26.0/godel-2.26.0.tgz
-distributionSHA256=03ae0b15f6c7d04c9250bde58a60f0404f9c4410fb7171f0ee326c658d03f6c7
+distributionURL=https://github.com/palantir/godel/releases/download/v2.36.0/godel-2.36.0.tgz
+distributionSHA256=91137f4fb9e1b4491d6dd821edf6ed39eb66f21410bf645a062f687049c45492

godelw

@@ -3,9 +3,9 @@
 set -euo pipefail
 
 # Version and checksums for godel. Values are populated by the godel "dist" task.
-VERSION=2.26.0
-DARWIN_CHECKSUM=195d6a32f0fb357d131d444c78b3f49f7ecef2cdfdf00ee707427c76970c45ef
-LINUX_CHECKSUM=2ff4039d95fcb85891d8d9affa0294bcba40ba3b31d7fee34ca31f6f81db9c44
+VERSION=2.36.0
+DARWIN_CHECKSUM=ac46bc231177ddd78343ef66fab222de7a91d9e691f8480f1d644561a08e92d0
+LINUX_CHECKSUM=604db3bba458be15360c0a9669119b6797cebf013d839de88d0a7eca59adf03e
 
 # Downloads file at URL to destination path using wget or curl. Prints an error and exits if wget or curl is not present.
 function download {
@@ -162,15 +162,15 @@ GODEL_BASE_DIR=${GODEL_HOME:-$HOME/.godel}
 OS=""
 EXPECTED_CHECKSUM=""
 case "$(uname)" in
-  Darwin*)
+Darwin*)
     OS=darwin
     EXPECTED_CHECKSUM=$DARWIN_CHECKSUM
     ;;
-  Linux*)
+Linux*)
     OS=linux
     EXPECTED_CHECKSUM=$LINUX_CHECKSUM
     ;;
-  *)
+*)
     echo "Unsupported operating system: $(uname)"
     exit 1
     ;;
@@ -198,8 +198,11 @@ if [ ! -f "$CMD" ]; then
     mkdir -p "$GODEL_BASE_DIR/downloads"
 
     # download tgz and verify its contents
-    DOWNLOAD_DST=$GODEL_BASE_DIR/downloads/godel-$VERSION.tgz
+    # Download to unique location that includes PID ($$) and use trap ensure that temporary download file is cleaned up
+    # if script is terminated before the file is moved to its destination.
+    DOWNLOAD_DST=$GODEL_BASE_DIR/downloads/godel-$VERSION-$$.tgz
     download "$DOWNLOAD_URL" "$DOWNLOAD_DST"
+    trap 'rm -rf "$DOWNLOAD_DST"' EXIT
     if [ -n "$DOWNLOAD_CHECKSUM" ]; then
         verify_checksum "$DOWNLOAD_DST" "$DOWNLOAD_CHECKSUM"
     fi
@@ -211,9 +214,12 @@ if [ ! -f "$CMD" ]; then
     tar zxvf "$DOWNLOAD_DST" -C "$TMP_DIST_DIR" >/dev/null 2>&1
     verify_godel_version "$TMP_DIST_DIR" "$VERSION" "$OS"
 
+    # rename downloaded file to remove PID portion
+    mv "$DOWNLOAD_DST" "$GODEL_BASE_DIR/downloads/godel-$VERSION.tgz"
+
     # if destination directory for distribution already exists, remove it
     if [ -d "$GODEL_BASE_DIR/dists/godel-$VERSION" ]; then
-          rm -rf "$GODEL_BASE_DIR/dists/godel-$VERSION"
+        rm -rf "$GODEL_BASE_DIR/dists/godel-$VERSION"
     fi
 
     # ensure that parent directory of destination exists
@@ -222,6 +228,17 @@ if [ ! -f "$CMD" ]; then
     # move expanded distribution directory to destination location. The location of the unarchived directory is known to
     # be in the same directory tree as the destination, so "mv" should always work.
     mv "$TMP_DIST_DIR/godel-$VERSION" "$GODEL_BASE_DIR/dists/godel-$VERSION"
+
+    # edge case cleanup: if the destination directory "$GODEL_BASE_DIR/dists/godel-$VERSION" was created prior to the
+    # "mv" operation above, then the move operation will move the source directory into the destination directory. In
+    # this case, remove the directory. It should always be safe to remove this directory because if the directory
+    # existed in the distribution and was non-empty, then the move operation would fail (because non-empty directories
+    # cannot be overwritten by mv). All distributions of a given version are also assumed to be identical. The only
+    # instance in which this would not work is if the distribution purposely contained an empty directory that matched
+    # the name "godel-$VERSION", and this is assumed to never be true.
+    if [ -d "$GODEL_BASE_DIR/dists/godel-$VERSION/godel-$VERSION" ]; then
+        rm -rf "$GODEL_BASE_DIR/dists/godel-$VERSION/godel-$VERSION"
+    fi
 fi
 
 verify_checksum "$CMD" "$EXPECTED_CHECKSUM"