feat: Download prebuilt plugin binaries instead of building with Go

.github/workflows/release.yml

@@ -28,6 +28,19 @@ jobs:
           ref: ${{ inputs.tag }}
           persist-credentials: false
 
+      - name: Check the tag matches the plugin default version
+        if: github.event_name != 'pull_request'
+        env:
+          TAG: ${{ inputs.tag || github.ref_name }}
+        run: |
+          default_version="$(sed -n 's/^ *PLUGIN_DEFAULT_VERSION=//p' env0.plugin.yaml)"
+          if [[ "$TAG" == *-* ]]; then
+            echo "Prerelease $TAG, PLUGIN_DEFAULT_VERSION is $default_version"
+          elif [[ "$TAG" != "$default_version" ]]; then
+            echo "::error::Tag $TAG does not match PLUGIN_DEFAULT_VERSION=$default_version in env0.plugin.yaml"
+            exit 1
+          fi
+
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod

README.md

@@ -57,7 +57,13 @@ The plugin uses the env0 API to fetch the output values from another environment
 
 ## Inputs
 
-N/A
+* `version` (optional): The release tag of the plugin binary to use, for example `0.5.0`. If you do not set it, the plugin uses the release that matches the plugin version in `use:` (for example `@0.5.0` uses the `0.5.0` binary).
+
+## How the plugin installs
+
+The plugin downloads a prebuilt binary for the agent architecture (`amd64` or `arm64`) from the [GitHub releases](https://github.com/env0/env0-import-variable-plugin/releases) and verifies its SHA-256 checksum. It does not install Go. If the download fails, the plugin installs Go and builds the binary from source.
+
+Use `use: https://github.com/env0/env0-import-variable-plugin` in your custom flow to get this behavior. If you copied the old plugin script into your `env0.yaml`, replace it with `use:`.
 
 ## Example Usage
 
@@ -70,7 +76,7 @@ deploy:
     terraformPlan:
       before:
         - name: Import Variables # The name that will be presented in the UI for this step
-          use: https://github.com/env0/env0-import-variable-plugin@0.4.4
+          use: https://github.com/env0/env0-import-variable-plugin
           inputs: {}
 
 ```

env0.plugin.yaml

@@ -1,16 +1,70 @@
 name: Variable Helper
 icon: https://assets-global.website-files.com/5ceab5395d0f478e169de7c0/5fdf4acfdb893538adabd1ab_Code%20automation%402x.png
-inputs: {}
+inputs:
+  version:
+    description: Release tag of the plugin binary to use (for example 0.5.0). Defaults to the release that matches this plugin version.
+    required: false
 run:
   exec: |
-    sudo apk add go
-    rm -rf env0-import-variable-plugin
-    git clone --depth=1 --single-branch https://github.com/env0/env0-import-variable-plugin
-    cd env0-import-variable-plugin
-    #cat main.go
-    go build -o ./bin/import-variable-plugin main.go 
-    mv ./bin/import-variable-plugin /opt
-    mv ./importVariables.sh /opt/importEnvVariables
+    PLUGIN_REPO=https://github.com/env0/env0-import-variable-plugin
+    PLUGIN_DEFAULT_VERSION=0.5.0
+    PLUGIN_VERSION='${inputs.version}'
+    if [[ -z "$PLUGIN_VERSION" || "$PLUGIN_VERSION" == *'{inputs.'* ]]; then
+      PLUGIN_VERSION="$PLUGIN_DEFAULT_VERSION"
+    fi
+
+    plugin_arch() {
+      case "$(uname -m)" in
+        x86_64|amd64) echo amd64 ;;
+        aarch64|arm64) echo arm64 ;;
+        *) return 1 ;;
+      esac
+    }
+
+    release_url() {
+      echo "$PLUGIN_REPO/releases/download/$PLUGIN_VERSION/$1"
+    }
+
+    verify_checksum() {
+      local expected actual
+      expected="$(awk -v name="$2" '$2 == name { print $1 }' "$1/checksums.txt")"
+      actual="$(sha256sum "$1/$2" | awk '{ print $1 }')"
+      [[ -n "$expected" && "$expected" == "$actual" ]]
+    }
+
+    install_prebuilt() {
+      local arch binary download_dir
+      arch="$(plugin_arch)" || return 1
+      binary="import-variable-plugin_linux_$arch"
+      download_dir="$(mktemp -d)"
+      curl -fsSL --retry 3 -o "$download_dir/$binary" "$(release_url "$binary")" &&
+        curl -fsSL --retry 3 -o "$download_dir/importVariables.sh" "$(release_url importVariables.sh)" &&
+        curl -fsSL --retry 3 -o "$download_dir/checksums.txt" "$(release_url checksums.txt)" &&
+        verify_checksum "$download_dir" "$binary" &&
+        verify_checksum "$download_dir" importVariables.sh &&
+        chmod +x "$download_dir/$binary" "$download_dir/importVariables.sh" &&
+        mv "$download_dir/$binary" /opt/import-variable-plugin &&
+        mv "$download_dir/importVariables.sh" /opt/importEnvVariables
+      local result=$?
+      rm -rf "$download_dir"
+      return $result
+    }
+
+    build_from_source() {
+      sudo apk add go
+      rm -rf env0-import-variable-plugin
+      git clone --depth=1 --single-branch --branch "$PLUGIN_VERSION" "$PLUGIN_REPO" ||
+        git clone --depth=1 --single-branch "$PLUGIN_REPO"
+      cd env0-import-variable-plugin
+      go build -o ./bin/import-variable-plugin main.go
+      mv ./bin/import-variable-plugin /opt
+      mv ./importVariables.sh /opt/importEnvVariables
+    }
+
+    if ! install_prebuilt; then
+      echo "Could not download the prebuilt plugin binary, building it from source"
+      build_from_source
+    fi
     cd $ENV0_TEMPLATE_DIR
     import-variable-plugin
     importEnvVariables

test/env0.yaml

@@ -5,17 +5,7 @@ deploy:
     setupVariables:
       after:
         - name: Import Variables
-          run: |
-            sudo apk add go
-            git clone --depth=1 --single-branch https://github.com/env0/env0-import-variable-plugin --branch ${REF:-main}
-            cd env0-import-variable-plugin
-            cat main.go
-            go build -o ./bin/import-variable-plugin main.go 
-            mv ./bin/import-variable-plugin /opt
-            mv ./importVariables.sh /opt/importEnvVariables
-            cd $ENV0_TEMPLATE_DIR
-            import-variable-plugin
-            importEnvVariables
+          use: https://github.com/env0/env0-import-variable-plugin
     terraformOutput:
       after:
         - name: Test Outputs