Skip to content

Commit f9dafcb

Browse files
jai-deepsourcejai-deepsource
committed
Migrate build system to just and update dependencies
- Replace Makefile with justfile, add VERSION file for version tracking - Replace goreleaser release pipeline with build-and-deploy workflow - Add install script template - Move version/ package to buildinfo/ - Swap DataDog/zstd (cgo) for klauspost/compress/zstd (pure Go) - Replace deprecated io/ioutil usage with os and io - Bump Go version to 1.25 in CI - Update SARIF schema URL to official OASIS source - Add TCP readiness check for mock server in tests - Update README with auth docs and current command list
1 parent 60b0a48 commit f9dafcb

File tree

28 files changed

+645
-296
lines changed

28 files changed

+645
-296
lines changed

‎.github/workflows/CI.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
- name: Set up Go 1.x
1717
uses: actions/setup-go@v5
1818
with:
19-
go-version: '1.24'
19+
go-version: '1.25'
2020

2121
- name: Check out code into the Go module directory
2222
uses: actions/checkout@v2
@@ -25,15 +25,15 @@ jobs:
2525
ref: ${{ github.event.pull_request.head.sha }}
2626

2727
- name: Build the binary
28-
run: make build
28+
run: just build
2929

3030
- name: Setup tests
31-
run: make test_setup
31+
run: just test-setup
3232
env:
3333
CODE_PATH: /home/runner/code
3434

3535
- name: Run tests
36-
run: make test
36+
run: just test
3737
env:
3838
CODE_PATH: /home/runner/code
3939

‎.github/workflows/build-and-deploy.yml‎

Lines changed: 355 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,355 @@
1+
name: Build and Deploy
2+
3+
on:
4+
push:
5+
tags:
6+
- 'v*.*.*'
7+
- 'v*.*.*-*'
8+
9+
permissions:
10+
contents: read
11+
12+
env:
13+
GO_VERSION: '1.25'
14+
15+
jobs:
16+
resolve-env:
17+
runs-on: ubuntu-latest
18+
outputs:
19+
environment: ${{ steps.resolve.outputs.environment }}
20+
base_url: ${{ steps.resolve.outputs.base_url }}
21+
bucket: ${{ steps.resolve.outputs.bucket }}
22+
version: ${{ steps.resolve.outputs.version }}
23+
steps:
24+
- name: Resolve environment from tag
25+
id: resolve
26+
run: |
27+
TAG="${GITHUB_REF#refs/tags/v}"
28+
if [[ "$TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
29+
echo "environment=prod" >> "$GITHUB_OUTPUT"
30+
echo "base_url=https://deepsource.com/cli" >> "$GITHUB_OUTPUT"
31+
echo "bucket=${{ secrets.R2_PROD_BUCKET_NAME }}" >> "$GITHUB_OUTPUT"
32+
else
33+
echo "environment=dev" >> "$GITHUB_OUTPUT"
34+
echo "base_url=https://deepsource.one/cli" >> "$GITHUB_OUTPUT"
35+
echo "bucket=${{ secrets.R2_DEV_BUCKET_NAME }}" >> "$GITHUB_OUTPUT"
36+
fi
37+
echo "version=${TAG}" >> "$GITHUB_OUTPUT"
38+
39+
build-linux:
40+
needs: resolve-env
41+
runs-on: ubuntu-latest
42+
strategy:
43+
matrix:
44+
include:
45+
- goarch: amd64
46+
cc: x86_64-linux-gnu-gcc
47+
cxx: x86_64-linux-gnu-g++
48+
- goarch: arm64
49+
cc: aarch64-linux-gnu-gcc
50+
cxx: aarch64-linux-gnu-g++
51+
steps:
52+
- uses: actions/checkout@v4
53+
- uses: actions/setup-go@v5
54+
with:
55+
go-version: ${{ env.GO_VERSION }}
56+
57+
- name: Install cross-compiler
58+
if: matrix.goarch == 'arm64'
59+
run: sudo apt-get update && sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
60+
61+
- name: Generate completions
62+
run: bash scripts/gen-completions.sh
63+
64+
- name: Build
65+
env:
66+
CGO_ENABLED: '1'
67+
GOOS: linux
68+
GOARCH: ${{ matrix.goarch }}
69+
CC: ${{ matrix.cc }}
70+
CXX: ${{ matrix.cxx }}
71+
run: |
72+
cd cmd/deepsource && go build -tags static_all \
73+
-ldflags "-X 'main.version=${{ needs.resolve-env.outputs.version }}' -X 'main.Date=$(date -u +%Y-%m-%d)' -X 'main.SentryDSN=${{ secrets.SENTRY_DSN }}'" \
74+
-o deepsource .
75+
76+
- name: Package
77+
run: |
78+
ARCHIVE="deepsource_${{ needs.resolve-env.outputs.version }}_linux_${{ matrix.goarch }}.tar.gz"
79+
tar -czf "$ARCHIVE" -C cmd/deepsource deepsource -C ../../ completions
80+
sha256sum "$ARCHIVE" > "${ARCHIVE}.sha256"
81+
echo "ARCHIVE=${ARCHIVE}" >> "$GITHUB_ENV"
82+
83+
- uses: actions/upload-artifact@v4
84+
with:
85+
name: build-linux-${{ matrix.goarch }}
86+
path: |
87+
deepsource_*.tar.gz
88+
deepsource_*.tar.gz.sha256
89+
90+
build-darwin:
91+
needs: resolve-env
92+
runs-on: macos-latest
93+
strategy:
94+
matrix:
95+
goarch: [amd64, arm64]
96+
steps:
97+
- uses: actions/checkout@v4
98+
- uses: actions/setup-go@v5
99+
with:
100+
go-version: ${{ env.GO_VERSION }}
101+
102+
- name: Generate completions
103+
run: bash scripts/gen-completions.sh
104+
105+
- name: Build
106+
env:
107+
CGO_ENABLED: '1'
108+
GOOS: darwin
109+
GOARCH: ${{ matrix.goarch }}
110+
run: |
111+
cd cmd/deepsource && go build -tags static_all \
112+
-ldflags "-X 'main.version=${{ needs.resolve-env.outputs.version }}' -X 'main.Date=$(date -u +%Y-%m-%d)' -X 'main.SentryDSN=${{ secrets.SENTRY_DSN }}'" \
113+
-o deepsource .
114+
115+
- name: Codesign
116+
env:
117+
APPLE_CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
118+
APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
119+
run: |
120+
# Import certificate
121+
CERT_PATH="$RUNNER_TEMP/certificate.p12"
122+
KEYCHAIN_PATH="$RUNNER_TEMP/signing.keychain-db"
123+
KEYCHAIN_PASSWORD="$(openssl rand -hex 16)"
124+
125+
echo "$APPLE_CERTIFICATE_BASE64" | base64 --decode > "$CERT_PATH"
126+
127+
security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
128+
security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
129+
security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
130+
security import "$CERT_PATH" -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
131+
security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
132+
security list-keychains -d user -s "$KEYCHAIN_PATH" login.keychain
133+
134+
# Sign the binary
135+
codesign --force --options runtime \
136+
--sign "Developer ID Application: DeepSource Corp" \
137+
cmd/deepsource/deepsource
138+
139+
- name: Notarize
140+
env:
141+
APPLE_ID: ${{ secrets.APPLE_ID }}
142+
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
143+
APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
144+
run: |
145+
# Create zip for notarization
146+
ditto -c -k cmd/deepsource/deepsource notarize.zip
147+
xcrun notarytool submit notarize.zip \
148+
--apple-id "$APPLE_ID" \
149+
--team-id "$APPLE_TEAM_ID" \
150+
--password "$APPLE_APP_PASSWORD" \
151+
--wait
152+
153+
- name: Verify signing
154+
run: |
155+
codesign --verify --verbose cmd/deepsource/deepsource
156+
spctl --assess --type execute cmd/deepsource/deepsource || true
157+
158+
- name: Package
159+
run: |
160+
ARCHIVE="deepsource_${{ needs.resolve-env.outputs.version }}_darwin_${{ matrix.goarch }}.tar.gz"
161+
tar -czf "$ARCHIVE" -C cmd/deepsource deepsource -C ../../ completions
162+
shasum -a 256 "$ARCHIVE" > "${ARCHIVE}.sha256"
163+
164+
- uses: actions/upload-artifact@v4
165+
with:
166+
name: build-darwin-${{ matrix.goarch }}
167+
path: |
168+
deepsource_*.tar.gz
169+
deepsource_*.tar.gz.sha256
170+
171+
build-windows:
172+
needs: resolve-env
173+
runs-on: ubuntu-latest
174+
steps:
175+
- uses: actions/checkout@v4
176+
- uses: actions/setup-go@v5
177+
with:
178+
go-version: ${{ env.GO_VERSION }}
179+
180+
- name: Install cross-compiler
181+
run: sudo apt-get update && sudo apt-get install -y gcc-mingw-w64-x86-64
182+
183+
- name: Build
184+
env:
185+
CGO_ENABLED: '1'
186+
GOOS: windows
187+
GOARCH: amd64
188+
CC: x86_64-w64-mingw32-gcc
189+
CXX: x86_64-w64-mingw32-g++
190+
run: |
191+
cd cmd/deepsource && go build -tags static_all \
192+
-ldflags "-X 'main.version=${{ needs.resolve-env.outputs.version }}' -X 'main.Date=$(date -u +%Y-%m-%d)' -X 'main.SentryDSN=${{ secrets.SENTRY_DSN }}'" \
193+
-o deepsource.exe .
194+
195+
- name: Package
196+
run: |
197+
ARCHIVE="deepsource_${{ needs.resolve-env.outputs.version }}_windows_amd64.zip"
198+
zip "$ARCHIVE" -j cmd/deepsource/deepsource.exe
199+
sha256sum "$ARCHIVE" > "${ARCHIVE}.sha256"
200+
201+
- uses: actions/upload-artifact@v4
202+
with:
203+
name: build-windows-amd64
204+
path: |
205+
deepsource_*.zip
206+
deepsource_*.zip.sha256
207+
208+
deploy:
209+
needs: [resolve-env, build-linux, build-darwin, build-windows]
210+
runs-on: ubuntu-latest
211+
steps:
212+
- uses: actions/checkout@v4
213+
214+
- uses: actions/download-artifact@v4
215+
with:
216+
path: artifacts
217+
merge-multiple: true
218+
219+
- name: Generate manifest
220+
run: |
221+
VERSION="${{ needs.resolve-env.outputs.version }}"
222+
BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
223+
224+
get_sha() {
225+
cat "artifacts/${1}.sha256" | awk '{print $1}'
226+
}
227+
228+
cat > artifacts/manifest.json <<EOF
229+
{
230+
"version": "${VERSION}",
231+
"buildTime": "${BUILD_TIME}",
232+
"platforms": {
233+
"darwin_amd64": {
234+
"archive": "deepsource_${VERSION}_darwin_amd64.tar.gz",
235+
"sha256": "$(get_sha "deepsource_${VERSION}_darwin_amd64.tar.gz")"
236+
},
237+
"darwin_arm64": {
238+
"archive": "deepsource_${VERSION}_darwin_arm64.tar.gz",
239+
"sha256": "$(get_sha "deepsource_${VERSION}_darwin_arm64.tar.gz")"
240+
},
241+
"linux_amd64": {
242+
"archive": "deepsource_${VERSION}_linux_amd64.tar.gz",
243+
"sha256": "$(get_sha "deepsource_${VERSION}_linux_amd64.tar.gz")"
244+
},
245+
"linux_arm64": {
246+
"archive": "deepsource_${VERSION}_linux_arm64.tar.gz",
247+
"sha256": "$(get_sha "deepsource_${VERSION}_linux_arm64.tar.gz")"
248+
},
249+
"windows_amd64": {
250+
"archive": "deepsource_${VERSION}_windows_amd64.zip",
251+
"sha256": "$(get_sha "deepsource_${VERSION}_windows_amd64.zip")"
252+
}
253+
}
254+
}
255+
EOF
256+
257+
- name: Generate install script
258+
run: |
259+
sed "s|__BASE_URL__|${{ needs.resolve-env.outputs.base_url }}|g" \
260+
scripts/install.sh.template > artifacts/install.sh
261+
262+
- name: Upload to R2
263+
env:
264+
AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
265+
AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
266+
AWS_DEFAULT_REGION: auto
267+
run: |
268+
ENDPOINT="https://${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com"
269+
BUCKET="${{ needs.resolve-env.outputs.bucket }}"
270+
271+
# Upload archives and checksums (immutable)
272+
for f in artifacts/deepsource_*; do
273+
aws s3 cp "$f" "s3://${BUCKET}/cli/build/$(basename "$f")" \
274+
--endpoint-url "$ENDPOINT" \
275+
--cache-control "public, max-age=31536000, immutable"
276+
done
277+
278+
# Upload manifest and install script (short cache)
279+
for f in artifacts/manifest.json artifacts/install.sh; do
280+
aws s3 cp "$f" "s3://${BUCKET}/cli/$(basename "$f")" \
281+
--endpoint-url "$ENDPOINT" \
282+
--cache-control "public, max-age=60"
283+
done
284+
285+
publish-homebrew:
286+
needs: [resolve-env, deploy]
287+
if: needs.resolve-env.outputs.environment == 'prod'
288+
runs-on: ubuntu-latest
289+
steps:
290+
- uses: actions/download-artifact@v4
291+
with:
292+
path: artifacts
293+
merge-multiple: true
294+
295+
- name: Generate formula
296+
run: |
297+
VERSION="${{ needs.resolve-env.outputs.version }}"
298+
BASE="${{ needs.resolve-env.outputs.base_url }}/build"
299+
300+
DARWIN_AMD64_SHA="$(cat artifacts/deepsource_${VERSION}_darwin_amd64.tar.gz.sha256 | awk '{print $1}')"
301+
DARWIN_ARM64_SHA="$(cat artifacts/deepsource_${VERSION}_darwin_arm64.tar.gz.sha256 | awk '{print $1}')"
302+
LINUX_AMD64_SHA="$(cat artifacts/deepsource_${VERSION}_linux_amd64.tar.gz.sha256 | awk '{print $1}')"
303+
LINUX_ARM64_SHA="$(cat artifacts/deepsource_${VERSION}_linux_arm64.tar.gz.sha256 | awk '{print $1}')"
304+
305+
cat > deepsource.rb <<FORMULA
306+
class Deepsource < Formula
307+
desc "Command line interface to DeepSource"
308+
homepage "https://github.com/deepsourcelabs/cli"
309+
license "BSD-2-Clause"
310+
version "${VERSION}"
311+
312+
on_macos do
313+
if Hardware::CPU.intel?
314+
url "${BASE}/deepsource_${VERSION}_darwin_amd64.tar.gz"
315+
sha256 "${DARWIN_AMD64_SHA}"
316+
end
317+
if Hardware::CPU.arm?
318+
url "${BASE}/deepsource_${VERSION}_darwin_arm64.tar.gz"
319+
sha256 "${DARWIN_ARM64_SHA}"
320+
end
321+
end
322+
323+
on_linux do
324+
if Hardware::CPU.intel?
325+
url "${BASE}/deepsource_${VERSION}_linux_amd64.tar.gz"
326+
sha256 "${LINUX_AMD64_SHA}"
327+
end
328+
if Hardware::CPU.arm?
329+
url "${BASE}/deepsource_${VERSION}_linux_arm64.tar.gz"
330+
sha256 "${LINUX_ARM64_SHA}"
331+
end
332+
end
333+
334+
def install
335+
bin.install "deepsource"
336+
bash_completion.install "completions/deepsource.bash" => "deepsource"
337+
zsh_completion.install "completions/deepsource.zsh" => "_deepsource"
338+
fish_completion.install "completions/deepsource.fish"
339+
end
340+
end
341+
FORMULA
342+
343+
- name: Push formula to homebrew-cli
344+
env:
345+
DS_BOT_PAT: ${{ secrets.DS_BOT_PAT }}
346+
run: |
347+
git clone "https://deepsourcebot:${DS_BOT_PAT}@github.com/DeepSourceCorp/homebrew-cli.git" homebrew-cli
348+
cp deepsource.rb homebrew-cli/Formula/deepsource.rb
349+
cd homebrew-cli
350+
git config user.name "deepsourcebot"
351+
git config user.email "bot@deepsource.io"
352+
git checkout -B cli-release
353+
git add Formula/deepsource.rb
354+
git commit -m "Update deepsource to ${{ needs.resolve-env.outputs.version }}"
355+
git push -f origin cli-release

0 commit comments

Comments
 (0)