Revert "Add docker image and refactor release pipeline (#310)"

This reverts commit 6195002ae5. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2026-10-30 14:02:26 +01:00 · 2021-03-11 12:42:18 -05:00
parent 6195002ae5
commit 5e62bca72f
14 changed files with 231 additions and 619 deletions
@@ -1,15 +1,11 @@
-.SHELLFLAGS := -o pipefail -ec
-SHELL := /bin/bash
-
-BIN := syft
-TEMPDIR := ./.tmp
+BIN = syft
+TEMPDIR = ./.tmp
 RESULTSDIR = $(TEMPDIR)/results
 COVER_REPORT = $(RESULTSDIR)/cover.report
 COVER_TOTAL = $(RESULTSDIR)/cover.total
 LINTCMD = $(TEMPDIR)/golangci-lint run --tests=false --config .golangci.yaml
-SNAPSHOT_CMD = $(shell realpath $(shell pwd)/$(SNAPSHOTDIR)/syft_linux_amd64/syft)
-ACC_TEST_IMAGE := centos:8.2.2004
-ACC_DIR := ./test/acceptance
+ACC_TEST_IMAGE = centos:8.2.2004
+ACC_DIR = ./test/acceptance
 BOLD := $(shell tput -T linux bold)
 PURPLE := $(shell tput -T linux setaf 5)
 GREEN := $(shell tput -T linux setaf 2)
@@ -26,39 +22,18 @@ INTEGRATION_CACHE_BUSTER="789bacdf"
 BOOTSTRAP_CACHE="789bacdf"

 ## Build variables
-DISTDIR := ./dist
-SNAPSHOTDIR := ./snapshot
-COMMIT = $(shell git log --format=%H -n 1)
-DATE = $(shell date -u +"%Y-%m-%dT%H:%M:%SZ")
-GITTREESTATE = $(if $(shell git status --porcelain),dirty,clean)
+DISTDIR=./dist
+SNAPSHOTDIR=./snapshot
+GITTREESTATE=$(if $(shell git status --porcelain),dirty,clean)
+SNAPSHOT_CMD=$(shell realpath $(shell pwd)/$(SNAPSHOTDIR)/syft_linux_amd64/syft)

-# Homebrew variables
-HOMEBREW_FORMULA_FILE = "$(DISTDIR)/$(BIN).rb"
-BREW_DIR = "$(TEMPDIR)/homebrew"
-BREW_BIN_DIR = "$(BREW_DIR)/bin"
-BREW_CMD = "$(BREW_BIN_DIR)/brew"
-
-ifeq "$(strip $(VERSION_TAG))" ""
-	override VERSION_TAG = $(shell git describe --always --tags --dirty)
+ifeq "$(strip $(VERSION))" ""
+ override VERSION = $(shell git describe --always --tags --dirty)
 endif

-# Version variables and functions
-is_dirty = $(findstring dirty,$(1))
-get_version_from_version_tag = $(shell echo "$(1)" | tr -d 'v')
-VERSION = $(call get_version_from_version_tag,$(VERSION_TAG))
-major = $(shell echo "$(1)" | cut -d '.' -f 1)
-minor = $(shell echo "$(1)" | cut -d '.' -f 2)
-patch = $(shell echo "$(1)" | cut -d '.' -f 3)
-
 # used to generate the changelog from the second to last tag to the current tag (used in the release pipeline when the release tag is in place)
-LAST_TAG = $(shell git describe --abbrev=0 --tags $(shell git rev-list --tags --max-count=1))
-SECOND_TO_LAST_TAG = $(shell git describe --abbrev=0 --tags $(shell git rev-list --tags --skip=1 --max-count=1))
-
-CONTAINER_IMAGE_REPOSITORY := "anchore/$(BIN)"
-CONTAINER_IMAGE_TAG_MAJOR := "$(CONTAINER_IMAGE_REPOSITORY):$(call major,$(VERSION))"
-CONTAINER_IMAGE_TAG_MINOR := "$(CONTAINER_IMAGE_REPOSITORY):$(call major,$(VERSION)).$(call minor,$(VERSION))"
-CONTAINER_IMAGE_TAG_PATCH := "$(CONTAINER_IMAGE_REPOSITORY):$(call major,$(VERSION)).$(call minor,$(VERSION)).$(call patch,$(VERSION))"
-CONTAINER_IMAGE_TAG_LATEST := "$(CONTAINER_IMAGE_REPOSITORY):latest"
+LAST_TAG := $(shell git describe --abbrev=0 --tags $(shell git rev-list --tags --max-count=1))
+SECOND_TO_LAST_TAG := $(shell git describe --abbrev=0 --tags $(shell git rev-list --tags --skip=1 --max-count=1))

 ## Variable assertions

@@ -78,34 +53,14 @@ ifndef DISTDIR
 	$(error DISTDIR is not set)
 endif

+ifndef SNAPSHOTDIR
+	$(error SNAPSHOTDIR is not set)
+endif
+
 define title
    @printf '$(TITLE)$(1)$(RESET)\n'
 endef

-define build_binary
-	GOOS="$1" \
-	GOARCH="$2" \
-	CGO_ENABLED=0 \
-	go build \
-		-o "./$3/syft_$1_$2/syft" \
-		-ldflags "-w -s -extldflags '-static' \
-		-X github.com/anchore/syft/internal/version.version=$(VERSION) \
-		-X github.com/anchore/syft/internal/version.gitCommit=$(COMMIT) \
-		-X github.com/anchore/syft/internal/version.buildDate=$(DATE) \
-		-X github.com/anchore/syft/internal/version.gitTreeState=$(BUILD_GIT_TREE_STATE)"
-endef
-
-define build_container_image
-	tags=( \
-		"-t $(CONTAINER_IMAGE_TAG_MAJOR)" \
-		"-t $(CONTAINER_IMAGE_TAG_MINOR)" \
-		"-t $(CONTAINER_IMAGE_TAG_PATCH)" \
-		"-t $(CONTAINER_IMAGE_TAG_LATEST)" \
-	) && \
-	DOCKER_BUILDKIT=1 docker build --build-arg DIST_DIR=$1 --no-cache $${tags[@]} -f "./Dockerfile" .
-	# Using buildkit due to https://github.com/moby/moby/issues/37965
-endef
-
 ## Tasks

 .PHONY: all
@@ -119,6 +74,14 @@ test: unit validate-cyclonedx-schema integration acceptance-linux ## Run all tes
 help:
 	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "$(BOLD)$(CYAN)%-25s$(RESET)%s\n", $$1, $$2}'

+.PHONY: ci-bootstrap
+ci-bootstrap:
+	DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y bc jq libxml2-utils
+
+.PHONY:
+ci-bootstrap-mac:
+	github_changelog_generator --version || sudo gem install github_changelog_generator
+
 .PHONY: bootstrap
 bootstrap: ## Download and install all go dependencies (+ prep tooling in the ./tmp dir)
 	$(call title,Bootstrapping dependencies)
@@ -131,15 +94,7 @@ bootstrap: ## Download and install all go dependencies (+ prep tooling in the ./
 	# install utilities
 	[ -f "$(TEMPDIR)/golangci" ] || curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ v1.26.0
 	[ -f "$(TEMPDIR)/bouncer" ] || curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ v0.2.0
-	[ -f "$(TEMPDIR)/nfpm" ] || curl -sfL curl -sfL https://install.goreleaser.com/github.com/goreleaser/nfpm.sh | sh -s -- -b $(TEMPDIR)/ v2.2.2
-	[ -f "$(BREW_CMD)" ] || (mkdir -p "$(BREW_DIR)" && curl -L https://github.com/Homebrew/brew/tarball/master | tar -xz --strip 1 -C "$(BREW_DIR)")
-
-.PHONY: bootstrap-ci-linux
-bootstrap-ci-linux: bootstrap
-	DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y bc jq libxml2-utils gettext
-
-.PHONY: bootstrap-ci-mac
-bootstrap-ci-mac: bootstrap
+	[ -f "$(TEMPDIR)/goreleaser" ] || curl -sfL https://install.goreleaser.com/github.com/goreleaser/goreleaser.sh | sh -s -- -b $(TEMPDIR)/ v0.140.0

 .PHONY: static-analysis
 static-analysis: lint check-licenses
@@ -183,8 +138,10 @@ unit: fixtures ## Run unit tests (with coverage)
 .PHONY: integration
 integration: ## Run integration tests
 	$(call title,Running integration tests)
+
 	go test -v ./test/integration

+
 # note: this is used by CI to determine if the integration test fixture cache (docker image tars) should be busted
 integration-fingerprint:
 	find test/integration/test-fixtures/image-* -type f -exec md5sum {} + | awk '{print $1}' | sort | md5sum | tee test/integration/test-fixtures/cache.fingerprint && echo "$(INTEGRATION_CACHE_BUSTER)" >> test/integration/test-fixtures/cache.fingerprint
@@ -207,32 +164,22 @@ generate-json-schema:  ## Generate a new json schema
 clear-test-cache: ## Delete all test cache (built docker image tars)
 	find . -type f -wholename "**/test-fixtures/cache/*.tar" -delete

-.PHONY: build-linux
-build-linux: ## Build binaries for mac
-	$(call title,Building binaries for linux)
-	$(call build_binary,linux,amd64,$(DISTDIR))
+.PHONY: build
+build: $(SNAPSHOTDIR) ## Build release snapshot binaries and packages

-.PHONY: build-mac
-build-mac: ## Build binaries for mac
-	$(call title,Building binaries for macOS)
-	$(call build_binary,darwin,amd64,$(DISTDIR))
+$(SNAPSHOTDIR): ## Build snapshot release binaries and packages
+	$(call title,Building snapshot artifacts)
+	# create a config with the dist dir overridden
+	echo "dist: $(SNAPSHOTDIR)" > $(TEMPDIR)/goreleaser.yaml
+	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml

-# note: mac packaging is intentionally left out (requires secrets and there is no acceptance test for packaged mac assets)
-.PHONY: snapshot
-snapshot:
-	$(call build_binary,linux,amd64,$(SNAPSHOTDIR))
-	$(call build_binary,darwin,amd64,$(SNAPSHOTDIR))
-	$(call build_container_image,$(SNAPSHOTDIR))
-
-	docker image save $(CONTAINER_IMAGE_TAG_LATEST) -o $(SNAPSHOTDIR)/image.tar
-
-	.github/scripts/package-linux.sh \
-		$(SNAPSHOTDIR) \
-		$(VERSION) \
-		$(TEMPDIR)
+	# build release snapshots
+	BUILD_GIT_TREE_STATE=$(GITTREESTATE) \
+	$(TEMPDIR)/goreleaser release --skip-publish --rm-dist --snapshot --config $(TEMPDIR)/goreleaser.yaml

+# note: we cannot clean the snapshot directory since the pipeline builds the snapshot separately
 .PHONY: acceptance-mac
-acceptance-mac: ## Run acceptance tests on built binaries (Mac)
+acceptance-mac: $(SNAPSHOTDIR) ## Run acceptance tests on build snapshot binaries and packages (Mac)
 	$(call title,Running acceptance test: Run on Mac)
 	$(ACC_DIR)/mac.sh \
 			$(SNAPSHOTDIR) \
@@ -240,11 +187,26 @@ acceptance-mac: ## Run acceptance tests on built binaries (Mac)
 			$(ACC_TEST_IMAGE) \
 			$(RESULTSDIR)

+# note: we cannot clean the snapshot directory since the pipeline builds the snapshot separately
 .PHONY: acceptance-linux
-acceptance-linux: acceptance-test-deb-package-install acceptance-test-rpm-package-install ## Run acceptance tests on built binaries and packages (Linux)
+acceptance-linux: acceptance-test-deb-package-install acceptance-test-rpm-package-install ## Run acceptance tests on build snapshot binaries and packages (Linux)
+
+# note: this is used by CI to determine if the inline-scan report cache should be busted for the inline-compare tests
+.PHONY: compare-fingerprint
+compare-fingerprint:
+	find test/inline-compare/* -type f -exec md5sum {} + | grep -v '\-reports' | grep -v 'fingerprint' | awk '{print $1}' | sort | md5sum | tee test/inline-compare/inline-compare.fingerprint && echo "$(COMPARE_CACHE_BUSTER)" >> test/inline-compare/inline-compare.fingerprint
+
+.PHONY: compare-snapshot
+compare-snapshot: $(SNAPSHOTDIR) ## Compare the reports of a run of a snapshot build of syft against inline-scan
+	chmod 755 $(SNAPSHOT_CMD)
+	@cd test/inline-compare && SYFT_CMD=$(SNAPSHOT_CMD) make
+
+.PHONY: compare
+compare:  ## Compare the reports of a run of a main-branch build of syft against inline-scan
+	@cd test/inline-compare && make

 .PHONY: acceptance-test-deb-package-install
-acceptance-test-deb-package-install:
+acceptance-test-deb-package-install: $(SNAPSHOTDIR)
 	$(call title,Running acceptance test: DEB install)
 	$(ACC_DIR)/deb.sh \
 			$(SNAPSHOTDIR) \
@@ -253,7 +215,7 @@ acceptance-test-deb-package-install:
 			$(RESULTSDIR)

 .PHONY: acceptance-test-rpm-package-install
-acceptance-test-rpm-package-install:
+acceptance-test-rpm-package-install: $(SNAPSHOTDIR)
 	$(call title,Running acceptance test: RPM install)
 	$(ACC_DIR)/rpm.sh \
 			$(SNAPSHOTDIR) \
@@ -261,56 +223,11 @@ acceptance-test-rpm-package-install:
 			$(ACC_TEST_IMAGE) \
 			$(RESULTSDIR)

-# note: this is used by CI to determine if the inline-scan report cache should be busted for the inline-compare tests
-.PHONY: compare-fingerprint
-compare-fingerprint:
-	find test/inline-compare/* -type f -exec md5sum {} + | grep -v '\-reports' | grep -v 'fingerprint' | awk '{print $1}' | sort | md5sum | tee test/inline-compare/inline-compare.fingerprint && echo "$(COMPARE_CACHE_BUSTER)" >> test/inline-compare/inline-compare.fingerprint
-
-.PHONY: compare-snapshot
-compare-snapshot:  ## Compare the reports of a run of a snapshot build of syft against inline-scan
-	chmod 755 $(SNAPSHOT_CMD)
-	@cd test/inline-compare && SYFT_CMD=$(SNAPSHOT_CMD) make
-
-.PHONY: compare
-compare:  ## Compare the reports of a run of a main-branch build of syft against inline-scan
-	cd test/inline-compare && make
-
-.PHONY: setup-macos-signing
-setup-macos-signing: ## Prepare for macOS-specific signing process
-	$(call title,Preparing macOS environment for code signing)
-	.github/scripts/mac-prepare-for-signing.sh
-
-.PHONY: package-mac
-package-mac: setup-macos-signing bootstrap-ci-mac ## Create signed and notarized release assets for macOS
-	$(call title,Creating packaging for macOS -- signed and notarized)
-
-	# Create signed and notarized assets
-	gon "./gon.hcl"
-
-	# Update asset names. This won't be necessary once Gon supports variable injection.
-	@ORIGINAL_NAME="$(DISTDIR)/output" && NEW_NAME="$(DISTDIR)/syft_$(VERSION)_darwin_amd64" && \
-		mv -v "$${ORIGINAL_NAME}.dmg" "$${NEW_NAME}.dmg" && \
-		mv -v "$${ORIGINAL_NAME}.zip" "$${NEW_NAME}.zip"
-
-.PHONY: package-linux
-package-linux:
-	$(call title,Creating packaging for Linux)
-	.github/scripts/package-linux.sh \
-		$(DISTDIR) \
-		$(VERSION) \
-		$(TEMPDIR)
-
-.PHONY: package
-package: package-mac package-linux
-
 .PHONY: changlog-release
-.SILIENT: changelog-release
 changelog-release:
-	echo "Last tag: $(SECOND_TO_LAST_TAG)"
-	echo "Current tag: $(VERSION_TAG)"
-	docker run --rm \
-		-v "$(shell pwd)":/usr/local/src/your-app \
-		ferrarimarco/github-changelog-generator \
+	@echo "Last tag: $(SECOND_TO_LAST_TAG)"
+	@echo "Current tag: $(VERSION)"
+	@github_changelog_generator \
 		--user anchore \
 		--project $(BIN) \
 		-t ${GITHUB_TOKEN} \
@@ -319,13 +236,12 @@ changelog-release:
 		--no-issues-wo-labels \
 		--since-tag $(SECOND_TO_LAST_TAG)

-	printf '\n$(BOLD)$(CYAN)Release $(VERSION_TAG) Changelog$(RESET)\n\n'
-	cat CHANGELOG.md
+	@printf '\n$(BOLD)$(CYAN)Release $(VERSION) Changelog$(RESET)\n\n'
+	@cat CHANGELOG.md

 .PHONY: changelog-unreleased
-.SILENCE: changelog-unreleased
 changelog-unreleased: ## show the current changelog that will be produced on the next release (note: requires GITHUB_TOKEN set)
-	docker run -it --rm \
+	@docker run -it --rm \
 		-v "$(shell pwd)":/usr/local/src/your-app \
 		ferrarimarco/github-changelog-generator \
 		--user anchore \
@@ -334,104 +250,48 @@ changelog-unreleased: ## show the current changelog that will be produced on the
 		--exclude-labels 'duplicate,question,invalid,wontfix,size:small,size:medium,size:large,size:x-large' \
 		--since-tag $(LAST_TAG)

-	printf '\n$(BOLD)$(CYAN)Unreleased Changes (closed PRs and issues will not be in the final changelog)$(RESET)\n'
+	@printf '\n$(BOLD)$(CYAN)Unreleased Changes (closed PRs and issues will not be in the final changelog)$(RESET)\n'

-	docker run -it --rm \
+	@docker run -it --rm \
 		-v $(shell pwd)/CHANGELOG.md:/CHANGELOG.md \
 		rawkode/mdv \
 			-t 748.5989 \
 			/CHANGELOG.md

-.PHONY: homebrew-formula-generate
-.SILENT: homebrew-formula-generate
-homebrew-formula-generate:
-	$(call title,Generating homebrew formula)
-	.github/scripts/homebrew-formula-generate.sh \
-		"$(VERSION_TAG)" \
-		"$(HOMEBREW_FORMULA_FILE)"
+.PHONY: release
+release: clean-dist ci-bootstrap-mac changelog-release ## Build and publish final binaries and packages. Intended to be run only on macOS.
+	$(call title,Publishing release artifacts)

-.PHONY: homebrew-formula-test
-.SILENT: homebrew-formula-test
-homebrew-formula-test: bootstrap
-	$(call title,Testing homebrew formula)
+	# Prepare for macOS-specific signing process
+	.github/scripts/mac-prepare-for-signing.sh

-	echo "Cleaning up any versions of $(BIN) previously installed by $(BREW_CMD)"
-	$(BREW_CMD) uninstall --force "$(HOMEBREW_FORMULA_FILE)"
+	# create a config with the dist dir overridden
+	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
+	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml

-	echo "Testing homebrew installation using formula"
-	$(BREW_CMD) install --formula "$(HOMEBREW_FORMULA_FILE)"
+	# release (note the version transformation from v0.7.0 --> 0.7.0)
+	bash -c "\
+		BUILD_GIT_TREE_STATE=$(GITTREESTATE) \
+		VERSION=$(VERSION:v%=%) \
+		$(TEMPDIR)/goreleaser \
+			--rm-dist \
+			--config $(TEMPDIR)/goreleaser.yaml \
+			--release-notes <(cat CHANGELOG.md)"

-	INSTALLED_BIN="$(BREW_BIN_DIR)/$(BIN)" && \
-	echo "Now running '$${INSTALLED_BIN} version':" && \
-	"$${INSTALLED_BIN}" version
-
-.PHONY: homebrew-formula-publish
-.SILENT: homebrew-formula-publish
-homebrew-formula-publish:
-	$(call title,Publishing homebrew formula)
-
-	FORMULA_FILE="$$(realpath $(HOMEBREW_FORMULA_FILE))" && \
-	\
-	pushd "$(TEMPDIR)" && \
-		rm -rfv "./homebrew-syft" && \
-		gh repo clone anchore/homebrew-syft && \
-		\
-		pushd "homebrew-syft" && \
-			cp -vf "$${FORMULA_FILE}" "./$(BIN).rb" && \
-			git commit -am "Brew formula update for $(BIN) version $(VERSION_TAG)" && \
-			git push && \
-		popd && \
-	popd
-
-.PHONY: version-check-update
-.SILENT: version-check-update
-version-check-update:
-	$(call title,Updating version check)
+	# verify checksum signatures
+	.github/scripts/verify-signature.sh "$(DISTDIR)"

 	# upload the version file that supports the application version update check (excluding pre-releases)
-	.github/scripts/update-version-file.sh "$(DISTDIR)" "$(VERSION_TAG)"
-
-.PHONY: stage-released-linux-artifact
-stage-released-linux-artifact:
-	mkdir -p ./$(DISTDIR)/syft_linux_amd64
-	curl -L -o ./$(DISTDIR)/syft.tar.gz https://github.com/anchore/syft/releases/download/$(VERSION_TAG)/syft_$(VERSION)_linux_amd64.tar.gz
-	tar -C ./$(DISTDIR)/syft_linux_amd64 -xvf ./$(DISTDIR)/syft.tar.gz syft
-
-.PHONY: container-image-build
-.SILENT: container-image-build
-container-image-build:
-	$(call title,Building and tagging container image for $(BIN))
-	$(call build_container_image,$(DISTDIR))
-
-.PHONY: container-image-test
-.SILENT: container-image-test
-container-image-smoke-test:
-	$(call title,Smoke testing container image)
-	docker run --pull never --rm "$(CONTAINER_IMAGE_TAG_LATEST)" version
-
-.PHONY: container-image-push
-.SILENT: container-image-push
-container-image-push:
-	$(call title,Pushing container image tags)
-
-	tags=( \
-		"$(CONTAINER_IMAGE_TAG_MAJOR)" \
-		"$(CONTAINER_IMAGE_TAG_MINOR)" \
-		"$(CONTAINER_IMAGE_TAG_PATCH)" \
-		"$(CONTAINER_IMAGE_TAG_LATEST)" \
-	) && \
-    for tag in $${tags[@]}; do \
-		docker push "$${tag}"; \
-    done
+	.github/scripts/update-version-file.sh "$(DISTDIR)" "$(VERSION)"

 .PHONY: clean
 clean: clean-dist clean-snapshot ## Remove previous builds and result reports
 	rm -rf $(RESULTSDIR)/*

-.PHONY: clean-dist
-clean-dist:
-	rm -rf $(DISTDIR) $(TEMPDIR)/goreleaser.yaml
-
 .PHONY: clean-snapshot
 clean-snapshot:
 	rm -rf $(SNAPSHOTDIR) $(TEMPDIR)/goreleaser.yaml
+
+.PHONY: clean-dist
+clean-dist:
+	rm -rf $(DISTDIR) $(TEMPDIR)/goreleaser.yaml