From 8534836923dac685725d588a855c8e764bbcc146 Mon Sep 17 00:00:00 2001
From: Appu <appu@google.com>
Date: Mon, 9 Aug 2021 14:22:30 -0400
Subject: [PATCH] Also add version info to goreleaser (#822)

- shared configuration generation in ./scripts/version-ldflags

Signed-off-by: Appu Goundan <appu@google.com>
---
 .github/workflows/goreleaser.yaml |  5 +++++
 .goreleaser.yml                   |  5 ++++-
 Makefile                          | 22 ++--------------------
 scripts/version-ldflags           | 25 +++++++++++++++++++++++++
 4 files changed, 36 insertions(+), 21 deletions(-)
 create mode 100755 scripts/version-ldflags

diff --git a/.github/workflows/goreleaser.yaml b/.github/workflows/goreleaser.yaml
index 23ecad77..adc479a8 100644
--- a/.github/workflows/goreleaser.yaml
+++ b/.github/workflows/goreleaser.yaml
@@ -33,6 +33,10 @@ jobs:
         uses: actions/setup-go@37335c7bb261b353407cff977110895fa0b4f7d8 # v2.1.3
         with:
           go-version: 1.16
+      -
+        name: Configure ldflags
+        id: ldflags
+        run: echo "::set-output name=version_flags::$(./scripts/version-ldflags)"
       -
         name: Import GPG key
         id: import_gpg
@@ -49,3 +53,4 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
+          VERSION_LDFLAGS: ${{ steps.ldflags.outputs.version_flags }}
diff --git a/.goreleaser.yml b/.goreleaser.yml
index 3c357189..b767bfe9 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -9,13 +9,16 @@ builds:
       - linux
       - windows
       - darwin
-# List of combinations of GOOS + GOARCH + GOARM to ignore.
+    # List of combinations of GOOS + GOARCH + GOARM to ignore.
     # Default is empty.
     ignore:
       - goos: darwin
         goarch: 386
       - goos: darwin
         goarch: arm64
+    # CI should set VERSION_LDFLAGS to the output of ./scripts/version_ldflags
+    ldflags:
+      - -s -w {{.Env.VERSION_LDFLAGS}}
 archives:
   - replacements:
       linux: Linux
diff --git a/Makefile b/Makefile
index 215213cd..d620ffc9 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,7 @@
 SHELL := /bin/bash
 GOPATH := $(go env GOPATH)
 GINKGO := ginkgo
+GIT_HASH := $(git rev-parse HEAD)
 GOLANGGCI_LINT := golangci-lint
 PROTOC_GEN_GO := protoc-gen-go
 PROTOC := $(shell which protoc)
@@ -8,26 +9,7 @@ IMAGE_NAME = scorecard
 OUTPUT = output
 IGNORED_CI_TEST="E2E TEST:blob|E2E TEST:executable"
 
-# generate VERSION_LDFLAGS
-GIT_VERSION ?= $(shell git describe --tags --always --dirty)
-GIT_HASH ?= $(shell git rev-parse HEAD)
-DATE_FMT = +'%Y-%m-%dT%H:%M:%SZ'
-SOURCE_DATE_EPOCH ?= $(shell git log -1 --pretty=%ct)
-ifdef SOURCE_DATE_EPOCH
-    BUILD_DATE ?= $(shell date -u -d "@$(SOURCE_DATE_EPOCH)" "$(DATE_FMT)" 2>/dev/null || date -u -r "$(SOURCE_DATE_EPOCH)" "$(DATE_FMT)" 2>/dev/null || date -u "$(DATE_FMT)")
-else
-    BUILD_DATE ?= $(shell date "$(DATE_FMT)")
-endif
-GIT_TREESTATE = clean
-DIFF = $(shell git diff --quiet >/dev/null 2>&1; if [ $$? -eq 1 ]; then echo "1"; fi)
-ifeq ($(DIFF), 1)
-    GIT_TREESTATE = dirty
-endif
-
-# version should be injected in the cmd package
-PKG=$(shell go list -m | head -n1)/cmd
-
-VERSION_LDFLAGS=-X $(PKG).gitVersion=$(GIT_VERSION) -X $(PKG).gitCommit=$(GIT_HASH) -X $(PKG).gitTreeState=$(GIT_TREESTATE) -X $(PKG).buildDate=$(BUILD_DATE)
+VERSION_LDFLAGS=$(shell ./scripts/version-ldflags)
 
 ############################### make help #####################################
 .PHONY: help
diff --git a/scripts/version-ldflags b/scripts/version-ldflags
new file mode 100755
index 00000000..f4513af3
--- /dev/null
+++ b/scripts/version-ldflags
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+# Copyright 2021 Security Scorecard Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+# shared by Makefile and .goreleaser.yml to inject 
+# version info into cmd/version.go via ldflags
+GIT_VERSION=$(git describe --tags --always --dirty)
+GIT_HASH=$(git rev-parse HEAD)
+BUILD_DATE=$(date +'%Y-%m-%dT%H:%M:%SZ')
+GIT_TREESTATE=$(if git diff --quiet; then echo "clean"; else echo "dirty"; fi)
+PKG=$(go list -m | head -n1)/cmd
+echo "-X $PKG.gitVersion=$GIT_VERSION -X $PKG.gitCommit=$GIT_HASH -X $PKG.gitTreeState=$GIT_TREESTATE -X $PKG.buildDate=$BUILD_DATE"