feat: auto-refresh checksums (#2573)

* fix: refresh checksums

Signed-off-by: Carlos A Becker <caarlos0@gmail.com>

* fix: better logs

Signed-off-by: Carlos A Becker <caarlos0@gmail.com>

* fix: keep no art behavior, add more tests

Signed-off-by: Carlos A Becker <caarlos0@gmail.com>

* fix: refresh in more places

Signed-off-by: Carlos A Becker <caarlos0@gmail.com>

* chore: fmt

Signed-off-by: Carlos A Becker <caarlos0@gmail.com>

* fix: refresh in the end

Signed-off-by: Carlos A Becker <caarlos0@gmail.com>

* fix: marshal extra with refresh

Signed-off-by: Carlos A Becker <caarlos0@gmail.com>

* fix: signature

Signed-off-by: Carlos A Becker <caarlos0@gmail.com>

internal/pipe/blob/upload.go

@@ -102,9 +102,7 @@ func doUpload(ctx *context.Context, conf config.Blob) error {
 			dataFile := artifact.Path
 			uploadFile := path.Join(folder, artifact.Name)
 
-			err := uploadData(ctx, conf, up, dataFile, uploadFile, bucketURL)
-
-			return err
+			return uploadData(ctx, conf, up, dataFile, uploadFile, bucketURL)
 		})
 	}
 

internal/pipe/checksums/checksums.go

@@ -3,6 +3,7 @@
 package checksums
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -17,6 +18,8 @@ import (
 	"github.com/goreleaser/goreleaser/pkg/context"
 )
 
+var errNoArtifacts = errors.New("there are no artifacts to sign")
+
 // Pipe for checksums.
 type Pipe struct{}
 
@@ -35,7 +38,33 @@ func (Pipe) Default(ctx *context.Context) error {
 }
 
 // Run the pipe.
-func (Pipe) Run(ctx *context.Context) (err error) {
+func (Pipe) Run(ctx *context.Context) error {
+	filename, err := tmpl.New(ctx).Apply(ctx.Config.Checksum.NameTemplate)
+	if err != nil {
+		return err
+	}
+	filepath := filepath.Join(ctx.Config.Dist, filename)
+	if err := refresh(ctx, filepath); err != nil {
+		if errors.Is(err, errNoArtifacts) {
+			return nil
+		}
+		return err
+	}
+	ctx.Artifacts.Add(&artifact.Artifact{
+		Type: artifact.Checksum,
+		Path: filepath,
+		Name: filename,
+		Extra: map[string]interface{}{
+			artifact.ExtraRefresh: func() error {
+				log.WithField("file", filename).Info("refreshing checksums")
+				return refresh(ctx, filepath)
+			},
+		},
+	})
+	return nil
+}
+
+func refresh(ctx *context.Context, filepath string) error {
 	filter := artifact.Or(
 		artifact.ByType(artifact.UploadableArchive),
 		artifact.ByType(artifact.UploadableBinary),
@@ -62,7 +91,7 @@ func (Pipe) Run(ctx *context.Context) (err error) {
 	}
 
 	if len(artifactList) == 0 {
-		return nil
+		return errNoArtifacts
 	}
 
 	g := semerrgroup.New(ctx.Parallelism)
@@ -85,12 +114,8 @@ func (Pipe) Run(ctx *context.Context) (err error) {
 		return err
 	}
 
-	filename, err := tmpl.New(ctx).Apply(ctx.Config.Checksum.NameTemplate)
-	if err != nil {
-		return err
-	}
 	file, err := os.OpenFile(
-		filepath.Join(ctx.Config.Dist, filename),
+		filepath,
 		os.O_APPEND|os.O_WRONLY|os.O_CREATE|os.O_TRUNC,
 		0o644,
 	)
@@ -99,12 +124,6 @@ func (Pipe) Run(ctx *context.Context) (err error) {
 	}
 	defer file.Close()
 
-	ctx.Artifacts.Add(&artifact.Artifact{
-		Type: artifact.Checksum,
-		Path: file.Name(),
-		Name: filename,
-	})
-
 	// sort to ensure the signature is deterministic downstream
 	sort.Strings(sumLines)
 	_, err = file.WriteString(strings.Join(sumLines, ""))

internal/pipe/checksums/checksums_test.go

@@ -3,6 +3,7 @@ package checksums
 import (
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/goreleaser/goreleaser/internal/artifact"
@@ -20,27 +21,28 @@ func TestPipe(t *testing.T) {
 	const archive = binary + ".tar.gz"
 	const linuxPackage = binary + ".rpm"
 	const checksums = binary + "_bar_checksums.txt"
+	const sum = "61d034473102d7dac305902770471fd50f4c5b26f6831a56dd90b5184b3c30fc  "
 
 	tests := map[string]struct {
 		ids  []string
-		want []string
+		want string
 	}{
 		"default": {
-			want: []string{
-				binary,
-				archive,
-				linuxPackage,
-			},
+			want: strings.Join([]string{
+				sum + binary,
+				sum + linuxPackage,
+				sum + archive,
+			}, "\n") + "\n",
 		},
 		"select ids": {
 			ids: []string{
 				"id-1",
 				"id-2",
 			},
-			want: []string{
-				binary,
-				archive,
-			},
+			want: strings.Join([]string{
+				sum + binary,
+				sum + archive,
+			}, "\n") + "\n",
 		},
 	}
 	for name, tt := range tests {
@@ -89,17 +91,50 @@ func TestPipe(t *testing.T) {
 			var artifacts []string
 			for _, a := range ctx.Artifacts.List() {
 				artifacts = append(artifacts, a.Name)
+				require.NoError(t, a.Refresh(), "refresh should not fail and yield same results as nothing changed")
 			}
 			require.Contains(t, artifacts, checksums, binary)
 			bts, err := os.ReadFile(filepath.Join(folder, checksums))
 			require.NoError(t, err)
-			for _, want := range tt.want {
-				require.Contains(t, string(bts), "61d034473102d7dac305902770471fd50f4c5b26f6831a56dd90b5184b3c30fc  "+want)
-			}
+			require.Contains(t, tt.want, string(bts))
 		})
 	}
 }
 
+func TestRefreshModifying(t *testing.T) {
+	const binary = "binary"
+	folder := t.TempDir()
+	file := filepath.Join(folder, binary)
+	require.NoError(t, os.WriteFile(file, []byte("some string"), 0o644))
+	ctx := context.New(
+		config.Project{
+			Dist:        folder,
+			ProjectName: binary,
+			Checksum: config.Checksum{
+				NameTemplate: "{{ .ProjectName }}_{{ .Env.FOO }}_checksums.txt",
+				Algorithm:    "sha256",
+			},
+		},
+	)
+	ctx.Git.CurrentTag = "1.2.3"
+	ctx.Env = map[string]string{"FOO": "bar"}
+	ctx.Artifacts.Add(&artifact.Artifact{
+		Name: binary,
+		Path: file,
+		Type: artifact.UploadableBinary,
+	})
+	require.NoError(t, Pipe{}.Run(ctx))
+	checks := ctx.Artifacts.Filter(artifact.ByType(artifact.Checksum)).List()
+	require.Len(t, checks, 1)
+	previous, err := os.ReadFile(checks[0].Path)
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(file, []byte("some other string"), 0o644))
+	require.NoError(t, checks[0].Refresh())
+	current, err := os.ReadFile(checks[0].Path)
+	require.NoError(t, err)
+	require.NotEqual(t, string(previous), string(current))
+}
+
 func TestPipeFileNotExist(t *testing.T) {
 	folder := t.TempDir()
 	ctx := context.New(
@@ -188,7 +223,9 @@ func TestPipeCouldNotOpenChecksumsTxt(t *testing.T) {
 }
 
 func TestPipeWhenNoArtifacts(t *testing.T) {
-	ctx := &context.Context{}
+	ctx := &context.Context{
+		Artifacts: artifact.New(),
+	}
 	require.NoError(t, Pipe{}.Run(ctx))
 	require.Len(t, ctx.Artifacts.List(), 0)
 }

internal/pipe/sign/sign.go

@@ -95,11 +95,22 @@ func (Pipe) Run(ctx *context.Context) error {
 			return sign(ctx, cfg, ctx.Artifacts.Filter(artifact.And(filters...)).List())
 		})
 	}
-	return g.Wait()
+	if err := g.Wait(); err != nil {
+		return err
+	}
+
+	return ctx.Artifacts.
+		Filter(artifact.ByType(artifact.Checksum)).
+		Visit(func(a *artifact.Artifact) error {
+			return a.Refresh()
+		})
 }
 
 func sign(ctx *context.Context, cfg config.Sign, artifacts []*artifact.Artifact) error {
 	for _, a := range artifacts {
+		if err := a.Refresh(); err != nil {
+			return err
+		}
 		artifacts, err := signone(ctx, cfg, a)
 		if err != nil {
 			return err

internal/pipe/sign/sign_test.go

@@ -612,6 +612,12 @@ func testSign(tb testing.TB, ctx *context.Context, certificateNames, signaturePa
 		Name: "checksum2",
 		Path: filepath.Join(tmpdir, "checksum2"),
 		Type: artifact.Checksum,
+		Extra: map[string]interface{}{
+			"Refresh": func() error {
+				file := filepath.Join(tmpdir, "checksum2")
+				return os.WriteFile(file, []byte("foo"), 0o644)
+			},
+		},
 	})
 	ctx.Artifacts.Add(&artifact.Artifact{
 		Name: "artifact4_1.0.0_linux_amd64",