chore: build releases on a single Linux runner (switch to rcodesign) (#3890)

* chore: build, sign and notarize darwin binaries on linux

* chore: download rcodesign during release

* chore: change nfpm install to be a download instead of compile

* chore: delete apple cert secrets after build

* fix: fix dependencies in archive.sh and build_go.sh

* chore: reduce output from rcodesign

.github/workflows/release.yaml

@@ -1,10 +1,4 @@
 # GitHub release workflow.
-#
-# This workflow is a bit complicated because we have to build darwin binaries on
-# a mac runner, but the mac runners are extremely slow. So instead of running
-# the entire release on a mac (which will take an hour to run), we run only the
-# mac build on a mac, and the rest on a linux runner. The final release is then
-# published using a final linux runner.
 name: release
 on:
   push:
@@ -31,7 +25,7 @@ env:
   CODER_RELEASE: ${{ github.event.inputs.snapshot && 'false' || 'true' }}
 
 jobs:
-  linux-windows:
+  release:
     runs-on: ubuntu-latest
     env:
       # Necessary for Docker manifest
@@ -72,11 +66,38 @@ jobs:
             js-${{ runner.os }}-
 
       - name: Install nfpm
-        run: go install github.com/goreleaser/nfpm/v2/cmd/nfpm@v2.16.0
+        run: |
+          set -euo pipefail
+          wget -O /tmp/nfpm.deb https://github.com/goreleaser/nfpm/releases/download/v2.18.1/nfpm_amd64.deb
+          sudo dpkg -i /tmp/nfpm.deb
       - name: Install zstd
         run: sudo apt-get install -y zstd
 
-      - name: Build Linux and Windows Binaries
+      - name: Install rcodesign
+        run: |
+          set -euo pipefail
+
+          # Install a prebuilt binary of rcodesign for linux amd64. Once the
+          # following PR is merged and released upstream, we can download
+          # directly from GitHub releases instead:
+          #   https://github.com/indygreg/PyOxidizer/pull/635
+          wget -O /tmp/rcodesign https://cdn.discordapp.com/attachments/283356472258199552/1016767245717872700/rcodesign
+          sudo install --mode 755 /tmp/rcodesign /usr/local/bin/rcodesign
+
+      - name: Setup Apple Developer certificate and API key
+        run: |
+          set -euo pipefail
+          touch /tmp/{apple_cert.p12,apple_cert_password.txt,apple_apikey.p8}
+          chmod 600 /tmp/{apple_cert.p12,apple_cert_password.txt,apple_apikey.p8}
+          echo "$AC_CERTIFICATE_P12_BASE64" | base64 -d > /tmp/apple_cert.p12
+          echo "$AC_CERTIFICATE_PASSWORD" > /tmp/apple_cert_password.txt
+          echo "$AC_APIKEY_P8_BASE64" | base64 -d > /tmp/apple_apikey.p8
+        env:
+          AC_CERTIFICATE_P12_BASE64: ${{ secrets.AC_CERTIFICATE_P12_BASE64 }}
+          AC_CERTIFICATE_PASSWORD: ${{ secrets.AC_CERTIFICATE_PASSWORD }}
+          AC_APIKEY_P8_BASE64: ${{ secrets.AC_APIKEY_P8_BASE64 }}
+
+      - name: Build binaries
         run: |
           set -euo pipefail
           go mod download
@@ -84,9 +105,19 @@ jobs:
           version="$(./scripts/version.sh)"
           make gen/mark-fresh
           make -j \
-            -W coderd/database/querier.go \
-            build/coder_"$version"_linux_{amd64,arm64,armv7}.{tar.gz,apk,deb,rpm} \
-            build/coder_"$version"_windows_{amd64,arm64}.zip \
+            build/coder_"$version"_linux_{amd64,armv7,arm64}.{tar.gz,apk,deb,rpm} \
+            build/coder_"$version"_{darwin,windows}_{amd64,arm64}.zip \
+            build/coder_helm_"$version".tgz
+        env:
+          CODER_SIGN_DARWIN: "1"
+          AC_CERTIFICATE_FILE: /tmp/apple_cert.p12
+          AC_CERTIFICATE_PASSWORD_FILE: /tmp/apple_cert_password.txt
+          AC_APIKEY_ISSUER_ID: ${{ secrets.AC_APIKEY_ISSUER_ID }}
+          AC_APIKEY_ID: ${{ secrets.AC_APIKEY_ID }}
+          AC_APIKEY_FILE: /tmp/apple_apikey.p8
+
+      - name: Delete Apple Developer certificate and API key
+        run: rm -f /tmp/{apple_cert.p12,apple_cert_password.txt,apple_apikey.p8}
 
       - name: Build Linux Docker images
         run: |
@@ -112,157 +143,37 @@ jobs:
           # push it
           if [[ "$(git tag | grep '^v' | grep -vE '(rc|dev|-|\+|\/)' | sort -r --version-sort | head -n1)" == "v$(./scripts/version.sh)" ]]; then
             ./scripts/build_docker_multiarch.sh \
-              --target "$(./scripts/image_tag.sh --version latest)" \
               --push \
+              --target "$(./scripts/image_tag.sh --version latest)" \
               $(cat build/coder_"$version"_linux_{amd64,arm64,armv7}.tag)
           fi
 
-      - name: Upload binary artifacts
-        uses: actions/upload-artifact@v3
-        with:
-          name: linux
-          path: |
-            ./build/*.zip
-            ./build/*.tar.gz
-            ./build/*.apk
-            ./build/*.deb
-            ./build/*.rpm
+      - name: ls build
+        run: ls -lh build
 
-  # The mac binaries get built on mac runners because they need to be signed,
-  # and the signing tool only runs on mac. This darwin job only builds the Mac
-  # binaries and uploads them as job artifacts used by the publish step.
-  darwin:
-    runs-on: macos-latest
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-
-      # If the event that triggered the build was an annotated tag (which our
-      # tags are supposed to be), actions/checkout has a bug where the tag in
-      # question is only a lightweight tag and not a full annotated tag. This
-      # command seems to fix it.
-      # https://github.com/actions/checkout/issues/290
-      - name: Fetch git tags
-        run: git fetch --tags --force
-
-      - uses: actions/setup-go@v3
-        with:
-          go-version: "~1.19"
-
-      - name: Import Signing Certificates
-        uses: Apple-Actions/import-codesign-certs@v1
-        with:
-          p12-file-base64: ${{ secrets.AC_CERTIFICATE_P12_BASE64 }}
-          p12-password: ${{ secrets.AC_CERTIFICATE_PASSWORD }}
-
-      - name: Cache Node
-        id: cache-node
-        uses: actions/cache@v3
-        with:
-          path: |
-            **/node_modules
-            .eslintcache
-          key: js-${{ runner.os }}-test-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            js-${{ runner.os }}-
-
-      - name: Install dependencies
-        run: |
-          set -euo pipefail
-          # The version of bash that macOS ships with is too old
-          brew install bash
-
-          # The version of make that macOS ships with is too old
-          brew install make
-          echo "$(brew --prefix)/opt/make/libexec/gnubin" >> $GITHUB_PATH
-
-          # BSD getopt is incompatible with the build scripts
-          brew install gnu-getopt
-          echo "$(brew --prefix)/opt/gnu-getopt/bin" >> $GITHUB_PATH
-
-          # Used for notarizing the binaries
-          brew tap mitchellh/gon
-          brew install mitchellh/gon/gon
-
-          # Used for compressing embedded slim binaries
-          brew install zstd
-
-      - name: Build darwin Binaries (with signatures)
-        run: |
-          set -euo pipefail
-          go mod download
-
-          version="$(./scripts/version.sh)"
-          make gen/mark-fresh
-          make -j \
-            build/coder_"$version"_darwin_{amd64,arm64}.zip
-        env:
-          CODER_SIGN_DARWIN: "1"
-          AC_USERNAME: ${{ secrets.AC_USERNAME }}
-          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
-          AC_APPLICATION_IDENTITY: BDB050EB749EDD6A80C6F119BF1382ECA119CCCC
-
-      - name: Upload Binary Artifacts
-        uses: actions/upload-artifact@v3
-        with:
-          name: darwin
-          path: ./build/*.zip
-
-  publish:
-    runs-on: ubuntu-latest
-    needs:
-      - linux-windows
-      - darwin
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-
-      # If the event that triggered the build was an annotated tag (which our
-      # tags are supposed to be), actions/checkout has a bug where the tag in
-      # question is only a lightweight tag and not a full annotated tag. This
-      # command seems to fix it.
-      # https://github.com/actions/checkout/issues/290
-      - name: Fetch git tags
-        run: git fetch --tags --force
-
-      - name: mkdir artifacts
-        run: mkdir artifacts
-
-      - name: Download darwin Artifacts
-        uses: actions/download-artifact@v3
-        with:
-          name: darwin
-          path: artifacts
-
-      - name: Download Linux and Windows Artifacts
-        uses: actions/download-artifact@v3
-        with:
-          name: linux
-          path: artifacts
-
-      - name: ls artifacts
-        run: ls artifacts
-
-      - name: Publish Helm
-        run: |
-          set -euxo pipefail
-
-          version="$(./scripts/version.sh)"
-          make -j \
-            build/coder_helm_"$version".tgz
-          mv ./build/*.tgz ./artifacts/
-
-      - name: Publish Release
+      - name: Publish release
         run: |
           ./scripts/publish_release.sh \
             ${{ (github.event.inputs.dry_run || github.event.inputs.snapshot) && '--dry-run' }} \
-            ./artifacts/*.zip \
-            ./artifacts/*.tar.gz \
-            ./artifacts/*.tgz \
-            ./artifacts/*.apk \
-            ./artifacts/*.deb \
-            ./artifacts/*.rpm
+            ./build/*.zip \
+            ./build/*.tar.gz \
+            ./build/*.tgz \
+            ./build/*.apk \
+            ./build/*.deb \
+            ./build/*.rpm
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload artifacts to actions (if dry-run or snapshot)
+        if: ${{ github.event.inputs.dry_run || github.event.inputs.snapshot }}
+        uses: actions/upload-artifact@v2
+        with:
+          name: release-artifacts
+          path: |
+            ./build/*.zip
+            ./build/*.tar.gz
+            ./build/*.tgz
+            ./build/*.apk
+            ./build/*.deb
+            ./build/*.rpm
+          retention-days: 7