Repository navigation
docs: Update projects #48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: 2026 The RISE Project | |
| # SPDX-License-Identifier: MIT | |
| --- | |
| # Upstream builds Linux wheels with cibuildwheel + setuptools-golang (which runs | |
| # `go build -buildmode=c-shared` on gotfparse/cmd/tfparse/main.go, wrapping Aqua | |
| # Security's defsec/trivy HCL engine): | |
| # https://github.com/cloud-custodian/tfparse/blob/v0.6.21/.github/workflows/release.yml | |
| name: Build tfparse wheels (riscv64) | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: 'Version glob to (re)build; empty builds every version of docs/packages/tfparse.yaml not released yet' | |
| required: false | |
| default: '' | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - '.github/workflows/build-tfparse.yml' | |
| - 'docs/packages/tfparse.yaml' | |
| push: | |
| branches: [main] | |
| paths: | |
| - '.github/workflows/build-tfparse.yml' | |
| - 'docs/packages/tfparse.yaml' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read # to fetch code (actions/checkout) | |
| env: | |
| MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64 | |
| # Matches upstream's .tool-versions. | |
| GO_VERSION: '1.26.3' | |
| GO_SHA256: 3b8fd5112340b72587e42c619f43270f1bc21f63cfdb587e6b72e0336580727c | |
| jobs: | |
| setup: | |
| uses: $/.github/workflows/_setup.yml | |
| with: | |
| package: tfparse | |
| version: ${{ inputs.version }} | |
| build_wheels: | |
| needs: [setup] | |
| if: needs.setup.outputs.versions != '[]' | |
| name: Build tfparse ${{ matrix.version }} ${{ matrix.python }}-manylinux_riscv64 | |
| runs-on: ubuntu-24.04-riscv | |
| timeout-minutes: 180 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| version: ${{ fromJSON(needs.setup.outputs.versions) }} | |
| # No cp314t: upstream ships cp310-cp314 only, all cp3x-cp3x (no abi3 -- the | |
| # Extension carries no py_limited_api, and the compiled artifact is a Go | |
| # c-shared library loaded through cffi's ffi.dlopen(), not a CPython extension). | |
| python: ["cp312", "cp313", "cp314"] | |
| env: | |
| TFPARSE_VERSION: ${{ matrix.version }} | |
| steps: | |
| - name: Checkout tfparse v${{ env.TFPARSE_VERSION }} | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| repository: cloud-custodian/tfparse | |
| ref: v${{ env.TFPARSE_VERSION }} | |
| persist-credentials: false | |
| - name: Build wheel | |
| uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074 # v4.2.0 | |
| with: | |
| output-dir: wheelhouse/ | |
| only: ${{ matrix.python }}-manylinux_riscv64 | |
| env: | |
| CIBW_MANYLINUX_RISCV64_IMAGE: ${{ env.MANYLINUX_RISCV64_IMAGE }} | |
| CIBW_BEFORE_ALL_LINUX: >- | |
| curl -sSfL -o /tmp/go.tar.gz https://go.dev/dl/go${{ env.GO_VERSION }}.linux-riscv64.tar.gz && | |
| echo "${{ env.GO_SHA256 }} /tmp/go.tar.gz" | sha256sum -c && | |
| tar -zxf /tmp/go.tar.gz -C /usr/local/ && | |
| rm /tmp/go.tar.gz | |
| CIBW_ENVIRONMENT_LINUX: 'PATH="/usr/local/go/bin:$PATH" PIP_EXTRA_INDEX_URL=https://pypi.riseproject.dev/simple/' | |
| # Upstream's own tests shell out to the terraform CLI (pytest-terraform's | |
| # TerraformRunner.init()) to fetch provider plugins -- Hashicorp ships no | |
| # riscv64 terraform build, so that suite can't run here. Exercise the | |
| # compiled defsec/HCL engine directly instead, the same thing the test | |
| # suite ultimately checks, on a fixture that takes no provider init. | |
| CIBW_TEST_COMMAND: >- | |
| python -c "import os, tempfile; from tfparse import load_from_path; | |
| d = tempfile.mkdtemp(); | |
| open(os.path.join(d, 'main.tf'), 'w').write('resource \"aws_s3_bucket\" \"test\" { bucket = \"my-test-bucket\" }'); | |
| parsed = load_from_path(d); | |
| assert parsed['aws_s3_bucket'][0]['bucket'] == 'my-test-bucket', parsed; | |
| print('tfparse smoke test OK')" | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: tfparse-${{ env.TFPARSE_VERSION }}-${{ matrix.python }}-manylinux_riscv64 | |
| path: wheelhouse/*.whl | |
| if-no-files-found: error | |
| publish: | |
| name: Publish tfparse ${{ matrix.version }} | |
| needs: [setup, build_wheels] | |
| if: needs.setup.outputs.versions != '[]' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| version: ${{ fromJSON(needs.setup.outputs.versions) }} | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| uses: $/.github/workflows/_publish-wheel.yml | |
| secrets: | |
| app-private-key: ${{ secrets.RISEPROJECT_APP_PRIVATE_KEY }} | |
| with: | |
| artifact-pattern: tfparse-${{ matrix.version }}-*-manylinux_riscv64 |