Refactor Actions and Add Python-Specific Actions (#6)

Author: blink1073

README.md

@@ -5,6 +5,28 @@
 
 This repository contains GitHub Actions that are common to drivers.
 
+## Setup
+
+There is a common setup action that is meant to be run before all
+other actions.  It handles fetching secrets from AWS Secrets Manager,
+signing into Artifactory, setting up Garasign credentials, and
+setting up environment variables used in other actions.
+The action requires `id-token: write` permissions.
+
+```yaml
+- name: setup
+  uses: mongodb/drivers-github-tools/setup@v2
+  with:
+    aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
+    aws_region_name: ${{ vars.AWS_REGION_NAME }}
+    aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
+```
+
+> [!Note]
+> You *must* use the `actions/checkout` action prior to calling the `setup` action,
+> Since the `setup` action sets up git config that would be overridden by the
+> `actions/checkout action`
+
 ## Signing tools
 
 The actions in the `garasign` folder are used to sign artifacts using the team's
@@ -15,78 +37,119 @@ GPG key.
 Use this action to create signed git artifacts:
 
 ```yaml
-- name: "Create signed commit"
-  uses: mongodb/drivers-github-tools/garasign/git-sign@main
+- name: Setup
+  uses: mongodb/drivers-github-tools/setup@v2
   with:
-    command: "git commit -m 'Commit' -s --gpg-sign=${{ vars.GPG_KEY_ID }}"
-    garasign_username: ${{ secrets.GRS_CONFIG_USER1_USERNAME }}
-    garasign_password: ${{ secrets.GRS_CONFIG_USER1_PASSWORD }}
-    artifactory_username: ${{ secrets.ARTIFACTORY_USER }}
-    artifactory_password: ${{ secrets.ARTIFACTORY_PASSWORD }}
-
-- name: "Create signed tag"
-  uses: mongodb/drivers-github-tools/garasign/git-sign@main
-  with:
-    command: "git tag -m 'Tag' -s --local-user=${{ vars.GPG_KEY_ID }} <tag>"
-    garasign_username: ${{ secrets.GRS_CONFIG_USER1_USERNAME }}
-    garasign_password: ${{ secrets.GRS_CONFIG_USER1_PASSWORD }}
-    artifactory_username: ${{ secrets.ARTIFACTORY_USER }}
-    artifactory_password: ${{ secrets.ARTIFACTORY_PASSWORD }}
-    skip_setup: true
-```
+    ...
 
-If the action is used multiple times within the same job, the `skip_setup`
-option can be set to a truthy value to avoid unnecessary logins to artifactory.
+- name: Create signed commit
+  uses: mongodb/drivers-github-tools/git-sign@v2
+
+- name: Create signed tag
+  uses: mongodb/drivers-github-tools/git-sign@v2
+```
 
 ### gpg-sign
 
 This action is used to create detached signatures for files:
 
 ```yaml
-- name: "Create detached signature"
-  uses: mongodb/drivers-github-tools/garasign/gpg-sign@main
+- name: Setup
+  uses: mongodb/drivers-github-tools/setup@v2
+  with:
+    ...
+
+- name: Create detached signature
+  uses: mongodb/drivers-github-tools/gpg-sign@v2
   with:
     filenames: somefile.ext
-    garasign_username: ${{ secrets.GRS_CONFIG_USER1_USERNAME }}
-    garasign_password: ${{ secrets.GRS_CONFIG_USER1_PASSWORD }}
-    artifactory_username: ${{ secrets.ARTIFACTORY_USER }}
-    artifactory_password: ${{ secrets.ARTIFACTORY_PASSWORD }}
 ```
 
 The action will create a signature file `somefile.ext.sig` in the working
 directory.
-If the action is used multiple times within the same job, the `skip_setup`
-option can be set to a truthy value to avoid unnecessary logins to artifactory.
 
-You can also supply multiple space-separated filenames to sign a list of files:
+You can also supply a glob pattern to sign a group of files:
 
 ```yaml
-- name: "Create detached signature"
-  uses: mongodb/drivers-github-tools/garasign/gpg-sign@main
+- name: Setup
+  uses: mongodb/drivers-github-tools/setup@v2
+  with:
+    ...
+
+- name: Create detached signature
+  uses: mongodb/drivers-github-tools/garasign/gpg-sign@v1
   with:
     filenames: dist/*
-    garasign_username: ${{ secrets.GRS_CONFIG_USER1_USERNAME }}
-    garasign_password: ${{ secrets.GRS_CONFIG_USER1_PASSWORD }}
-    artifactory_username: ${{ secrets.ARTIFACTORY_USER }}
-    artifactory_password: ${{ secrets.ARTIFACTORY_PASSWORD }}
 ```
 
 ## Reporting tools
 
 The following tools are meant to aid in generating Software Security Development Lifecycle
 reports associated with a product release.
 
-### Papertrail
+### Authorized Publication
 
 This action will create a record of authorized publication on distribution channels.
-By default it will create a "papertrail.txt" file in the current directory.
+It will create the file `$S3_ASSETS/authorized_publication.txt`
 
 ```yaml
-- name: "Create papertrail report"
-  uses: mongodb/drivers-github-tools/papertrail@main
+- name: Setup
+  uses: mongodb/drivers-github-tools/setup@v2
+  with:
+    ...
+
+- name: Create Authorized Publication Report
+  uses: mongodb/drivers-github-tools/authorized-pub@v2
   with:
     product_name: Mongo Python Driver
     release_version: ${{ github.ref_name }}
     filenames: dist/*
     token: ${{ github.token }}
 ```
+
+## Python Helper Scripts
+
+These scripts are opinionated helper scripts for Python releases.
+
+### Bump and Tag
+
+Bump the version and create a new tag.  Verify the tag.
+Push the commit and tag to the source branch unless `dry_run` is set.
+
+```yaml
+- name: Setup
+  uses: mongodb/drivers-github-tools/setup@v2
+  with:
+    ...
+
+- uses: mongodb/drivers-github-tools/python/bump-and-tag@v2
+  with:
+    version: ${{ inputs.version }}
+    version_bump_script: ./.github/scripts/bump-version.sh
+    dry_run: ${{ inputs.dry_run }}
+```
+
+### Publish
+
+Handles tasks related to publishing Python packages, including
+signing `dist` file and publishing the `dist` files to PyPI.
+It will also push the following (dev) version to the source branch.
+It will create a draft GitHub release and attach the signature files.
+Finally, it will publish a report to the appropriate S3 bucket.
+If `dry_run` is set, nothing will be published or pushed.
+
+```yaml
+- name: Setup
+  uses: mongodb/drivers-github-tools/setup@v2
+  with:
+    ...
+
+- uses: mongodb-labs/drivers-github-tools/python/publish@v2
+  with:
+    version: ${{ inputs.version }}
+    following_version: ${{ inputs.following_version }}
+    version_bump_script: ./.github/scripts/bump-version.sh
+    product_name: winkerberos
+    token: ${{ github.token }}
+    dry_run: ${{ inputs.dry_run }}
+```

authorized-pub/action.yml

@@ -0,0 +1,35 @@
+name: Authorized Publication
+description: Generate report for authorized publication on distribution channels
+inputs:
+  product_name:
+    description: Name of product
+    required: true
+  release_version:
+    description: The release version
+    required: true
+  filenames:
+    description: Artifact filename(s) to include in the report, can be a glob pattern
+    required: true
+  token:
+    description: The GitHub token for the action
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Prepare report
+      shell: bash
+      run: |
+          export GH_TOKEN=${{ inputs.token }}
+          NAME=$(gh api users/${{ github.actor }} --jq '.name')
+          export REPORT=$S3_ASSETS/authorized_publication.txt
+          echo "Product: ${{ inputs.product_name }}" > $REPORT
+          echo "Version: ${{ inputs.release_version }}" >> $REPORT
+          echo "Releaser: $NAME"  >> $REPORT
+          echo "Build Source: GitHub Actions"
+          echo "Build Number: ${{ github.run_id }}"
+          for filename in ${{ inputs.filenames }}; do
+              SHA=$(shasum -a 256 $filename | awk '{print $1;}')
+              echo "Filename: $filename"  >> $REPORT
+              echo "Shasum: $SHA"  >> $REPORT
+          done

garasign/git-sign/action.yml

@@ -0,0 +1,23 @@
+name: "Run git actions in a signing container"
+description: "Allows running arbitrary git actions in a container with GPG keys loaded"
+inputs:
+  command:
+    description: "Command to run inside the container"
+    required: true
+  artifactory_image:
+    description: "Image to use for artifactory"
+    default: release-tools-container-registry-local/garasign-git
+
+runs:
+  using: composite
+  steps:
+    - name: "Run git command"
+      run: |
+        podman run \
+          --env-file=$GARASIGN_ENVFILE \
+          --rm \
+          -v $(pwd):$(pwd) \
+          -w $(pwd) \
+          ${ARTIFACTORY_REGISTRY}/${{ inputs.artifactory_image }} \
+          /bin/bash -c "gpgloader && ${{ inputs.command }}"
+      shell: bash

garasign/gpg-sign/action.yml

@@ -0,0 +1,28 @@
+name: "Sign artifact(s) using garasign"
+description: "Signs release artifact(s)"
+inputs:
+  filenames:
+    description: "File name(s) to sign, can be a glob pattern"
+    required: true
+  artifactory_image:
+    description: "Image to use for artifactory"
+    default: release-tools-container-registry-local/garasign-gpg
+
+runs:
+  using: composite
+  steps:
+    - name: "Create detached signature for file"
+      shell: bash
+      run: |
+        podman run \
+          --env-file=$GARASIGN_ENVFILE \
+          --rm \
+          -v $(pwd):$(pwd) \
+          -w $(pwd) \
+          ${ARTIFACTORY_REGISTRY}/${{ inputs.artifactory_image }} \
+          /bin/bash -c 'gpgloader && for filename in ${{ inputs.filenames }}; do gpg --detach-sign --armor --output ${filename}.sig ${filename}; done'
+
+    - name: "Move the signature files to the release directory"
+      shell: bash
+      run: |
+        mv ${{inputs.filenames}}.sig $RELEASE_ASSETS