Refactor publish pipeline around Git tags (GEA-12976) (#217)

.editorconfig

@@ -11,3 +11,7 @@ indent_style = tab
 
 [*.md]
 trim_trailing_whitespace = false
+
+[*.sh]
+indent_size = 4
+indent_style = space

.gitlab-ci.yml

@@ -16,7 +16,8 @@ stages:
   - unit_tests
   - integration_tests
   - examples
+  - publish
 
 include:
-  - /pangea-sdk/.sdk-ci.yml
   - /examples/.examples-ci.yml
+  - /pangea-sdk/.sdk-ci.yml

.pre-commit-config.yaml

@@ -4,8 +4,7 @@ repos:
     hooks:
       - id: check-json
       - id: end-of-file-fixer
-      -
-        id: trailing-whitespace
+      - id: trailing-whitespace
         exclude: .md
       - id: check-merge-conflict
       - id: debug-statements

CONTRIBUTING.md

@@ -6,6 +6,24 @@ Future support is incoming.
 To install our linters, simply run `./dev/setup_repo.sh`
 These linters will run on every `git commit` operation.
 
+## Publishing
+
+Publishing pangea-sdk to pkg.go.dev is handled via a private GitLab CI pipeline.
+This pipeline is triggered when a Git tag is pushed to the repository. Git tags
+should be formatted as `pangea-sdk/vX.Y.Z`, where `vX.Y.Z` is the version number
+to publish.
+
+1. Update the `version` constant in `pangea-sdk/v3/pangea/pangea.go`.
+2. Update the release notes in `CHANGELOG.md`.
+3. Author a commit with these changes and land it on `main`.
+4. `git tag -m pangea-sdk/vX.Y.Z pangea-sdk/vX.Y.Z 0000000`. Replace `vX.Y.Z`
+  with the new version number and `0000000` with the commit SHA from the
+  previous step.
+5. `git push --tags origin main`.
+
+From here the GitLab CI pipeline will pick up the pushed Git tag and publish
+the package to pkg.go.dev.
+
 ## Contributors
 
 - Andrés Tournour ([email protected]). Code.

dev/validate_tag.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+
+set -e
+
+if [ $# -lt 1 ]; then
+    echo "usage: validate_tag.sh <git_tag>"
+    exit 1
+fi
+
+GIT_TAG=$1
+
+if [[ ! $GIT_TAG == "pangea-sdk/v"* ]]; then
+    echo "Git tag must begin with a 'pangea-sdk/v'."
+    exit 1
+fi
+
+PACKAGE_NAME=$(echo "$GIT_TAG" | cut -d "/" -f 1)
+VERSION=$(echo "$GIT_TAG" | cut -d "/" -f 2)
+
+if [[ ! "$VERSION" == *"v"* ]]; then
+    echo "Git tag must contain a version number that's prefixed with 'v'."
+    exit 1
+fi
+
+# Trim the 'v'.
+VERSION="${VERSION:1}"
+
+# Move to repo root.
+PARENT_PATH=$(cd "$(dirname "${BASH_SOURCE[0]}")"; pwd -P)
+pushd "$PARENT_PATH/.."
+
+GO_CONST_VERSION=$(grep -Eo "version.+=.+" pangea-sdk/v3/pangea/pangea.go | head -1)
+
+if [[ ! "$GO_CONST_VERSION" == *"$VERSION"* ]]; then
+    echo "Git tag version '$VERSION' does not match Go constant version '$GO_CONST_VERSION'."
+    exit 1
+fi
+
+popd

examples/.examples-ci.yml

@@ -2,7 +2,7 @@ go-sdk-examples:
   stage: examples
   parallel:
     matrix:
-      - GO_VERSION: ['1.19', '1.20', '1.21']
+      - GO_VERSION: ["1.19", "1.20", "1.21"]
         EXAMPLE_FOLDER:
           - audit
           - authn
@@ -34,3 +34,5 @@ go-sdk-examples:
   script:
     - cd examples/${EXAMPLE_FOLDER}
     - bash ../../dev/run_examples.sh
+  rules:
+    - if: $CI_COMMIT_BRANCH

pangea-sdk/.sdk-ci.yml

@@ -1,14 +1,13 @@
-.go-sdk-base:
+.sdk-base:
   before_script:
     - cd pangea-sdk/v3
-    - go install github.com/boumenot/gocover-cobertura@latest
   rules:
     - if: $CI_PIPELINE_SOURCE == "push"
 
-go-sdk-test-it:
+sdk-test-it:
   stage: integration_tests
   variables:
-  # Set each service test environment
+    # Set each service test environment
     SERVICE_AUDIT_ENV: LVE
     SERVICE_AUTHN_ENV: LVE
     SERVICE_EMBARGO_ENV: LVE
@@ -23,22 +22,21 @@ go-sdk-test-it:
   before_script:
     - echo $ENV
     - echo $CLOUD
-  # Update environment variables
-  # Domain
+    # Update environment variables
+    # Domain
     - export PANGEA_INTEGRATION_DOMAIN_${ENV}="$(eval echo \$PANGEA_INTEGRATION_DOMAIN_${ENV}_${CLOUD})"
-  # Tokens
+    # Tokens
     - export PANGEA_INTEGRATION_TOKEN_${ENV}="$(eval echo \$PANGEA_INTEGRATION_TOKEN_${ENV}_${CLOUD})"
     - export PANGEA_INTEGRATION_VAULT_TOKEN_${ENV}="$(eval echo \$PANGEA_INTEGRATION_VAULT_TOKEN_${ENV}_${CLOUD})"
     - export PANGEA_INTEGRATION_CUSTOM_SCHEMA_TOKEN_${ENV}="$(eval echo \$PANGEA_INTEGRATION_CUSTOM_SCHEMA_TOKEN_${ENV}_${CLOUD})"
     - export PANGEA_INTEGRATION_MULTI_CONFIG_TOKEN_${ENV}="$(eval echo \$PANGEA_INTEGRATION_MULTI_CONFIG_TOKEN_${ENV}_${CLOUD})"
-  # Config IDs
+    # Config IDs
     - export PANGEA_AUDIT_CONFIG_ID_1_${ENV}="$(eval echo \$PANGEA_AUDIT_CONFIG_ID_1_${ENV}_${CLOUD})"
     - export PANGEA_AUDIT_CONFIG_ID_2_${ENV}="$(eval echo \$PANGEA_AUDIT_CONFIG_ID_2_${ENV}_${CLOUD})"
     - export PANGEA_REDACT_CONFIG_ID_1_${ENV}="$(eval echo \$PANGEA_REDACT_CONFIG_ID_1_${ENV}_${CLOUD})"
     - export PANGEA_REDACT_CONFIG_ID_2_${ENV}="$(eval echo \$PANGEA_REDACT_CONFIG_ID_2_${ENV}_${CLOUD})"
 
     - cd pangea-sdk/v3
-    - go install github.com/boumenot/gocover-cobertura@latest
 
   parallel:
     matrix:
@@ -76,35 +74,45 @@ go-sdk-test-it:
         ENV: ${SERVICE_VAULT_ENV}
         TEST: vault
   rules:
-    - if: '$CLOUD == "GCP" && $TEST == "file_scan"'
+    - if: $CI_COMMIT_BRANCH && '$CLOUD == "GCP" && $TEST == "file_scan"'
       allow_failure: true
-    - if: '$CLOUD == "GCP" && $TEST != "file_scan"'
+    - if: $CI_COMMIT_BRANCH && '$CLOUD == "GCP" && $TEST != "file_scan"'
       allow_failure: true
-    - if: '$CLOUD != "GCP"'
+    - if: $CI_COMMIT_BRANCH && '$CLOUD != "GCP"'
       allow_failure: false
   script:
     - go test -count=1 -tags integration -v ./service/${TEST}/...
 
-go-sdk-lint:
-  extends: .go-sdk-base
+sdk-lint:
+  extends: .sdk-base
   stage: lint
   script:
     - make verify
 
-go-sdk-generate-docs:
-  extends: .go-sdk-base
+sdk-generate-docs:
+  extends: .sdk-base
   stage: lint
   allow_failure: true
   script:
     - make docgen
   artifacts:
     expire_in: 1 month
     expose_as: go_sdk
-    paths: ['pangea-sdk/v3/go_sdk.json']
+    paths: ["pangea-sdk/v3/go_sdk.json"]
     when: on_success
 
-go-sdk-unit-testing:
-  extends: .go-sdk-base
+sdk-unit-testing:
+  extends: .sdk-base
   stage: unit_tests
   script:
     - make unit
+
+sdk-publish:
+  stage: publish
+  variables:
+    GOPROXY: proxy.golang.org
+  script:
+    - bash ./dev/validate_tag.sh "$CI_COMMIT_TAG"
+    - go list -m github.com/pangeacyber/pangea-go/pangea-sdk/v3@"$CI_COMMIT_TAG"
+  rules:
+    - if: $CI_COMMIT_TAG