build-sign-binaries.yaml

name: Build and Sign Blockchain Binaries

on:
  push:
    branches:
      - master
      - 'release/[0-9]+.[0-9]+.x'
  workflow_dispatch:

jobs:
  build-container-blockchain-binaries:
    uses: celo-org/reusable-workflows/.github/workflows/container-cicd.yaml@v1.12.3
    with:
      workload-id-provider: 'projects/1094498259535/locations/global/workloadIdentityPools/gh-celo-blockchain/providers/github-by-repos'
      service-account: 'celo-blockchain@devopsre.iam.gserviceaccount.com'
      artifact-registry: us-west1-docker.pkg.dev/devopsre/celo-blockchain-public/geth-xgo-builder
      tag: ${{ github.sha }}
      platforms: linux/amd64
      context: .
      file: Dockerfile.binaries
      trivy: true
          
  upload-cloud-storage:
    runs-on: ubuntu-latest
    needs:
      - build-container-blockchain-binaries
    permissions:
      contents: 'read'
      id-token: 'write'
    env:
      BUILD_TARGETS: linux/amd64,linux/arm64
      TAG_NAME: ${{ github.ref_name }}
      BRANCH_NAME: ${{ github.ref_name }}
      REPO_NAME: ${{ github.repository }}
      COMMIT_SHA: ${{ github.sha }}

    steps:
      - name: 'Checkout'
        uses: actions/checkout@v4

      - id: 'auth-gcp-master'
        name: 'Authenticate to Google Cloud'
        uses: 'google-github-actions/auth@v1'
        with:
          workload_identity_provider: 'projects/1094498259535/locations/global/workloadIdentityPools/gh-celo-blockchain/providers/github-by-repos'
          service_account: 'celo-blockchain@devopsre.iam.gserviceaccount.com'
          access_token_lifetime: '40m'

      - name: 'Set up Cloud SDK'
        uses: 'google-github-actions/setup-gcloud@877d4953d2c70a0ba7ef3290ae968eb24af233bb'

      - name: 'Configure docker for gcloud auth'
        run: 'gcloud auth configure-docker us-west1-docker.pkg.dev'

      - name: 'Get timestamp'
        run: |
          timestamp=$(date +%s)
          echo "COMMIT_TIMESTAMP=${timestamp}" >> $GITHUB_ENV

      - name: 'Go Run all-tools'
        run: |
          docker run --rm \
            -v $(pwd)/build/bin:/build \
            -v $(pwd)/build/archives:/archives \
            -v $(pwd):/go/src/github.com/celo-org/celo-blockchain \
            --env BUILD_TARGETS=$_BUILD_TARGETS \
            --env TAG_NAME=$TAG_NAME \
            --env BRANCH_NAME=$BRANCH_NAME \
            --env REPO_NAME=$REPO_NAME \
            --env COMMIT_SHA=$COMMIT_SHA \
            --env COMMIT_TIMESTAMP=${{ env.COMMIT_TIMESTAMP }} \
            --env CLOUDBUILD=True \
            --env CI=True \
            --entrypoint /bin/sh \
            us-west1-docker.pkg.dev/devopsre/celo-blockchain-public/geth-xgo-builder:$COMMIT_SHA \
              -c "go run build/ci.go xgo --alltools -- -targets=$BUILD_TARGETS -v -dest /build"

      - name: 'Go Run xgo-archive'
        run: |
          docker run --rm \
            -v $(pwd)/build/bin:/build \
            -v $(pwd)/build/archives:/archives \
            -v $(pwd):/go/src/github.com/celo-org/celo-blockchain \
            --env BUILD_TARGETS=$_BUILD_TARGETS \
            --env TAG_NAME=$TAG_NAME \
            --env BRANCH_NAME=$BRANCH_NAME \
            --env REPO_NAME=$REPO_NAME \
            --env COMMIT_SHA=$COMMIT_SHA \
            --env COMMIT_TIMESTAMP=${{ env.COMMIT_TIMESTAMP }} \
            --env CLOUDBUILD=True \
            --env CI=True \
            --entrypoint /bin/sh \
            us-west1-docker.pkg.dev/devopsre/celo-blockchain-public/geth-xgo-builder:$COMMIT_SHA \
              -c "go run build/ci.go xgo-archive -targets=$BUILD_TARGETS -in /build -out /archives"

      - name: 'Upload to storage bucket'
        uses: google-github-actions/upload-cloud-storage@v1
        with:
          path: './build/archives'
          destination: celo-blockchain-binaries/binaries/${{ env.BRANCH_NAME }}
          parent: false