builds.yml

name: Builds
on:
  pull_request:
  push:
    branches:
      - latest-candidate

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
  cancel-in-progress: true

jobs:
  snap:
    name: Trigger snap build
    runs-on: ubuntu-22.04
    if: ${{ github.repository == 'canonical/lxd-pkg-snap' && github.event_name == 'push' && github.actor != 'dependabot[bot]' }}
    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2

      - name: Install Go
        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed  # v5.1.0
        with:
          go-version: 'stable'

      - name: Setup Launchpad SSH access
        env:
          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
          LAUNCHPAD_LXD_BOT_KEY: ${{ secrets.LAUNCHPAD_LXD_BOT_KEY }}
        run: |
          set -eux
          mkdir -m 0700 -p ~/.ssh/
          ssh-agent -a "${SSH_AUTH_SOCK}" > /dev/null
          ssh-add - <<< "${{ secrets.LAUNCHPAD_LXD_BOT_KEY }}"
          ssh-add -L > ~/.ssh/id_ed25519.pub
          # In ephemeral environments like GitHub Action runners, relying on TOFU isn't providing any security
          # so require the key obtained by `ssh-keyscan` to match the expected hash from https://help.launchpad.net/SSHFingerprints
          ssh-keyscan git.launchpad.net >> ~/.ssh/known_hosts
          ssh-keygen -qlF git.launchpad.net | grep -xF 'git.launchpad.net RSA SHA256:UNOzlP66WpDuEo34Wgs8mewypV0UzqHLsIFoqwe8dYo'

      - name: Trigger Launchpad snap build
        env:
          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
          TARGET: ${{ github.ref_name }}
        run: |
          set -eux
          git config --global transfer.fsckobjects true
          git config --global user.name "Canonical LXD Bot"
          git config --global user.email "lxd@lists.canonical.com"
          git config --global commit.gpgsign true
          git config --global gpg.format "ssh"
          git config --global user.signingkey ~/.ssh/id_ed25519.pub
          localRev="$(git rev-parse HEAD)"
          go install github.com/canonical/lxd-ci/lxd-snapcraft@latest
          git clone -b "${TARGET}" git+ssh://lxdbot@git.launchpad.net/~canonical-lxd/lxd ~/lxd-pkg-snap-lp
          # XXX: `originVer` contains an array with the 2 versions
          originVer=($(lxd-snapcraft -package lxd -get-version -file snapcraft.yaml))
          rsync -a --exclude .git --delete . ~/lxd-pkg-snap-lp/
          cd ~/lxd-pkg-snap-lp
          lxd-snapcraft -package lxd -set-version "${originVer[0]}-${localRev:0:7}" -set-source-commit ""
          git add --all
          git commit --all --quiet -s --allow-empty -m "Automatic upstream build (${TARGET})" -m "Upstream commit: ${localRev}"
          git show
          git push --quiet