{"id":14970140,"url":"https://github.com/hashicorp/actions-go-build","last_synced_at":"2025-10-19T09:32:49.423Z","repository":{"id":38238260,"uuid":"495782082","full_name":"hashicorp/actions-go-build","owner":"hashicorp","description":"Define a reproducible Go build.","archived":false,"fork":false,"pushed_at":"2024-10-01T06:02:35.000Z","size":9043,"stargazers_count":7,"open_issues_count":10,"forks_count":3,"subscribers_count":7,"default_branch":"main","last_synced_at":"2024-10-03T11:46:42.995Z","etag":null,"topics":["build","crt","go","reproducible","slsa"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/hashicorp.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-05-24T10:52:30.000Z","updated_at":"2024-08-12T15:49:24.000Z","dependencies_parsed_at":"2024-08-12T18:15:06.069Z","dependency_job_id":null,"html_url":"https://github.com/hashicorp/actions-go-build","commit_stats":{"total_commits":599,"total_committers":3,"mean_commits":"199.66666666666666","dds":0.008347245409014992,"last_synced_commit":"e20c6be7bf010e40e930dab20e6da63176725ec1"},"previous_names":[],"tags_count":17,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hashicorp%2Factions-go-build","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hashicorp%2Factions-go-build/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hashicorp%2Factions-go-build/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hashicorp%2Factions-go-build/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/hashicorp","download_url":"https://codeload.github.com/hashicorp/actions-go-build/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":219869243,"owners_count":16555572,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["build","crt","go","reproducible","slsa"],"created_at":"2024-09-24T13:43:06.523Z","updated_at":"2025-10-19T09:32:49.417Z","avatar_url":"https://github.com/hashicorp.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Go Build Action [![Heimdall](https://heimdall.hashicorp.services/api/v1/assets/actions-go-build/badge.svg?key=5c34743984c6ac17fabc3e68b7f6d34620de4e877ab1c529405ed7f4843147bf)](https://heimdall.hashicorp.services/site/assets/actions-go-build) [![CI](https://github.com/hashicorp/actions-go-build/actions/workflows/test.yml/badge.svg)](https://github.com/hashicorp/actions-go-build/actions/workflows/test.yml)\n\n_**Build and package a (reproducible) Go binary.**_\n\n- **Define** the build.\n- **Assert** that it is reproducible (optionally).\n- **Use** the resultant artifacts in your workflow.\n\n_This is intended for internal HashiCorp use only; Internal folks please refer to RFC **ENGSRV-084** for more details._\n\n\u003c!-- insert:dev/docs/table_of_contents --\u003e\n* [Features](#features)\n* [Local Usage](#local-usage)\n* [Usage in GHA](#usage-in-gha)\n  * [Examples](#examples)\n  * [Inputs](#inputs)\n  * [Build Instructions](#build-instructions)\n  * [Ensuring Reproducibility](#ensuring-reproducibility)\n* [Development](#development)\n\u003c!-- end:insert:dev/docs/table_of_contents --\u003e\n\n## Features\n\n- **Results are zipped** using standard HashiCorp naming conventions.\n- **You can include additional files** in the zip like licenses etc.\n- **Convention over configuration** means minimal config required.\n- **Reproducibility** is checked at build time.\n- **Fast feedback** if accidental nondeterminism is introduced.\n\n## Local Usage\n\nThe core functionality of this action is contained in a Go CLI, which\nyou can also install and use locally. See [the CLI docs](docs/cli.md)\nfor more.\n\n## Usage in GHA\n\nThis Action can run on both Ubuntu and macOS runners.\n\n### Examples\n\n#### Minimal(ish) Example\n\nThis example shows building a single `linux/amd64` binary.\n\n[See this simple example workflow running here](https://github.com/hashicorp/actions-reproducible-build/actions/workflows/example.yml).\n\n\u003c!-- insert:dev/docs/print_example_workflow example.yml --\u003e\n```yaml\nname: Minimal Example (main)\non: push\njobs:\n  example:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v3\n      - name: Build\n        uses: hashicorp/actions-go-build@main\n        with:\n          go_version: 1.24\n          os: linux\n          arch: amd64\n          work_dir: testdata/example-app\n          debug: true\n          instructions: |\n            go build -o \"$BIN_PATH\" -trimpath -buildvcs=false\n```\n\u003c!-- end:insert:dev/docs/print_example_workflow example.yml --\u003e\n\n#### More Realistic Example\n\nThis example shows usage of the action inside a matrix configured to produce\nbinaries for different platforms. It also injects the version, revision, and\nrevision time into the binary via `-ldflags`, uses the `netcgo` tag for darwin,\nand disables CGO for linux and windows builds.\n\n[See this matrix example workflow running here](https://github.com/hashicorp/actions-reproducible-build/actions/workflows/example-matrix.yml).\n\n\u003c!-- insert:dev/docs/print_example_workflow example-matrix.yml --\u003e\n```yaml\nname: Matrix Example (main)\non: push\njobs:\n  example:\n    runs-on: ${{ matrix.runner }}\n    strategy:\n      matrix:\n        include:\n          - { runner: macos-latest,  os: darwin,  arch: amd64, tags: netcgo        }\n          - { runner: macos-latest,  os: darwin,  arch: arm64, tags: netcgo        }\n          - { runner: ubuntu-latest, os: linux,   arch: amd64, env:  CGO_ENABLED=0 }\n          - { runner: ubuntu-latest, os: linux,   arch: amd64, env:  CGO_ENABLED=0 }\n          - { runner: ubuntu-latest, os: windows, arch: amd64, env:  CGO_ENABLED=0 }\n    steps:\n      - uses: actions/checkout@v3\n      - name: Build\n        uses: hashicorp/actions-go-build@main\n        with:\n          product_name: example-app\n          product_version: 1.2.3\n          go_version: 1.24\n          os: ${{ matrix.os }}\n          arch: ${{ matrix.arch }}\n          instructions: |-\n            cd ./testdata/example-app \u0026\u0026 \\\n            ${{ matrix.env }} \\\n              go build \\\n                -o \"$BIN_PATH\" \\\n                -trimpath \\\n                -buildvcs=false \\\n                -tags=\"${{ matrix.tags }}\" \\\n                -ldflags \"\n                  -X 'main.Version=$PRODUCT_VERSION'\n                  -X 'main.Revision=$PRODUCT_REVISION'\n                  -X 'main.RevisionTime=$PRODUCT_REVISION_TIME'\n                \"\n```\n\u003c!-- end:insert:dev/docs/print_example_workflow example-matrix.yml --\u003e\n\n### Inputs\n\n\u003c!-- insert:dev/docs/inputs_doc --\u003e\n|  Name                                      |  Description                                                                                              |\n|  -----                                     |  -----                                                                                                    |\n|  `product_name`\u0026nbsp;_(optional)_          |  Used to calculate default `bin_name` and `zip_name`. Defaults to repository name.                        |\n|  `product_version`\u0026nbsp;_(optional)_       |  Full version of the product being built (including metadata).                                            |\n|  `product_version_meta`\u0026nbsp;_(optional)_  |  The metadata field of the version.                                                                       |\n|  **`go_version`**\u0026nbsp;_(required)_        |  Version of Go to use for this build.                                                                     |\n|  **`os`**\u0026nbsp;_(required)_                |  Target product operating system.                                                                         |\n|  **`arch`**\u0026nbsp;_(required)_              |  Target product architecture.                                                                             |\n|  `reproducible`\u0026nbsp;_(optional)_          |  Assert that this build is reproducible. Options are `assert` (the default), `report`, or `nope`.         |\n|  `bin_name`\u0026nbsp;_(optional)_              |  Name of the product binary generated. Defaults to `product_name` minus any `-enterprise` suffix.         |\n|  `zip_name`\u0026nbsp;_(optional)_              |  Name of the product zip file. Defaults to `\u003cproduct_name\u003e_\u003cproduct_version\u003e_\u003cos\u003e_\u003carch\u003e.zip`.            |\n|  `work_dir`\u0026nbsp;_(optional)_              |  The working directory, to run the instructions in. Defaults to the current directory.                    |\n|  **`instructions`**\u0026nbsp;_(required)_      |  Build instructions to generate the binary. See [Build Instructions](#build-instructions) for more info.  |\n|  `debug`\u0026nbsp;_(optional)_                 |  Enable debug-level logging.                                                                              |\n|  `clean`\u0026nbsp;_(optional)_                 |  Build with the clean flag on.       |\n\u003c!-- end:insert:dev/docs/inputs_doc --\u003e\n\n### Outputs\n|  Name                                      |  Description                                                                                              |\n|  -----                                     |  -----                                                                                                    |\n|  `zip_name`                                |  The provided or calculated zip file name                                                                 |\n|  `target_dir`                              |  Name of the directory where an artifact can be assembled                                                 |\n\n### Build Instructions\n\nThe `instructions` input is a bash script that builds the product binary.\nIt should be kept as simple as possible.\nTypically this will be a simple `go build` invocation,\nbut it could hit a make target, or call another script.\nSee [Example Build Instructions](#example-build-instructions)\nbelow for examples of valid instructions.\n\nThe instructions _must_ use the environment variable `$BIN_PATH`\nbecause the minimal thing they can do is to write the compiled binary to `$BIN_PATH`.\n\nIn order to add other files like licenses etc to the zip file, you need to\nwrite them into `$TARGET_DIR` in your build instructions.\n\n#### Build Environment\n\nWhen the `instructions` are executed, there are a set of environment variables\nalready exported that you can make use of\n(see [Environment Variables](#environment-variables) below).\n\n#### Environment Variables\n\n\u003c!-- insert:dev/docs/environment_doc --\u003e\n|  Name                     |  Description                                                                    |\n|  -----                    |  -----                                                                          |\n|  `PRODUCT_NAME`           |  Same as the `product_name` input.                                              |\n|  `PRODUCT_VERSION`        |  Same as the `product_version` input.                                           |\n|  `PRODUCT_REVISION`       |  The git commit SHA of the product repo being built.                            |\n|  `PRODUCT_REVISION_TIME`  |  UTC timestamp of the `PRODUCT_REVISION` commit in iso-8601 format.             |\n|  `OS`                     |  Same as the `os` input.                                                        |\n|  `ARCH`                   |  Same as the `arch` input.                                                      |\n|  `GOOS`                   |  Same as `OS`.                                                                  |\n|  `GOARCH`                 |  Same as `ARCH`.                                                                |\n|  `WORKTREE_DIRTY`         |  Whether the workrtree is dirty (`true` or `false`).                            |\n|  `WORKTREE_HASH`          |  Unique hash of the work tree. Same as PRODUCT_REVISION unless WORKTREE_DIRTY.  |\n|  `TARGET_DIR`             |  Absolute path to the zip contents directory.                                   |\n|  `BIN_PATH`               |  Absolute path to where instructions must write Go executable.                  |\n\u003c!-- end:insert:dev/docs/environment_doc --\u003e\n\n#### Reproducibility Assertions\n\nThe `reproducible` input has three options:\n\n- `assert` (the default) means perform a verification build and fail if it's not identical to the primary build.\n- `report` means perform a verification build, log the results, but do not fail.\n- `nope`   means do not perform a verification build at all.\n\nSee [Ensuring Reproducibility](#ensuring-reproducibility), below for tips on making your build reproducible.\n\n#### Example Build Instructions\n\nThe examples below all illustrate valid build instructions using `go build` flags\nthat give the build some chance at being reproducible.\n\n---\n\nSimplest Go 1.17 invocation. (Uses `-trimpath` to aid with reproducibility.)\n\n```yaml\ninstructions: go build -o \"$BIN_PATH\" -trimpath\n```\n\n---\n\nSimplest Go 1.18+ invocation. (Additionally uses `-buildvcs=false` to aid with reproducibility.)\n\n```yaml\ninstructions: go build -o \"$BIN_PATH\" -trimpath -buildvcs=false\n```\n\n---\n\nMore complex build, including copying a license file into the zip and `cd`ing into\na subdirectory to perform the go build.\n\n```yaml\ninstructions: |\n\tcp LICENSE \"$TARGET_DIR/\"\n\tcd sub/directory\n\tgo build -o \"$BIN_PATH\" -trimpath -buildvcs=false\n```\n\n---\n\nAn example using `make`:\n\n```yaml\ninstructions: make build\n```\n\nWith this Makefile:\n\n```Makefile\nbuild:\n\tgo build -o \"$BIN_PATH\" -trimpath -buildvcs=false\n```\n\n---\n\nSee also the [example workflow](#example-workflow) above,\nwhich injects info into the binary using `-ldflags`.\n\n\n### Ensuring Reproducibility\n\nIf you are aiming to create a reproducible build, you need to at a minimum ensure that\nyour build is independent from the _time_ it is run, and from the _path_ that the module\nis at on the filesystem.\n\n#### Build Time\n\nEmbedding the actual 'build time' into your binary will ensure that it isn't reproducible,\nbecause this time will be different for each build. Instead, you can use the\n`PRODUCT_REVISION_TIME` which is the time of the latest commit, which will be the same\nfor each build of that commit.\n\n#### Build Path\n\nBy default `go build` embeds the absolute path to the source files inside the binaries\nfor use in stack traces and debugging. However, this reduces reproducibility because\nthat path is likely to be different for different builds.\n\nUse the `-trimpath` flag to remove the portion of the path that is dependent on the\nabsolute module path to aid with reproducibility.\n\n#### VCS information\n\nGo 1.18+ embeds information about the current checkout directory of your code, including\nmodified and new files. In some cases this interferes with reproducibility. You can\nturn this off using the `-buildvcs=false` flag.\n\n## Development\n\nDevelopment docs have moved to [docs/development.md](docs/development.md).\n\nThe core functionality of this action is contained in a Go CLI, which can also be installed\nand run locally. See [the CLI docs](docs/cli.md) for instructions on installing and using\nthe CLI.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhashicorp%2Factions-go-build","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhashicorp%2Factions-go-build","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhashicorp%2Factions-go-build/lists"}